HUD’s Office of Administration, in coordination with OCIO, should update and communicate its PII minimization plan. The plan should include detailed procedures to regularly review and remove unnecessary PII collections in accordance with OMB Circular A-130 (IG FISMA metric 35).

Ensure that future policies and guidance developed to return HUD’s offices to normal operations include the specific criteria, metrics, and defined geographic area to be used by all offices as applicable.

Develop and implement sufficient policies and controls to ensure that (1) applicable criteria in any future guidance are met and all safety measures are sufficiently completed before returning HUD’s offices to normal operations and (2) sufficient documentation is maintained to support that the applicable criteria were met.

We recommend that HUD’s Chief Administrative Officer implement the corrective actions and internal process improvements in internal control developed as a result of the Chief Financial Officer’s investigation addressed in recommendation 1A.

We recommend that HUD’s Chief Administrative Officer provide training to responsible staff and officials to ensure that those that may be involved with negotiating any GSA rent credits, like the credits addressed in this report, identify such potential rent credit transactions and follow the corrective actions and process improvements implemented to resolve recommendation 1B.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Designate a Senior Agency Official for Records Management at the Assistant Secretary level or its equivalent.

Update and issue agency formal records policy, including detailed procedures and requirements for completing and maintaining program office and agencywide inventories of systems, records, and PII.

Establish and disseminate a policy on safeguarding or prohibiting the transportation of PII records out of the office for telework purposes.

Standardize processes and duties for all RMLOs.

Conduct a staffing resource assessment for the HUD records program and identify any skills gaps or resource needs.

Deobligate all obligations marked for deobligation during the departmentwide OOR, including as much as $574,511 in 79 administrative obligations marked for deobligation as of September 30, 2018.

Ensure the privacy program is staffed with experienced personnel (such as a Chief Privacy Officer) to manage the operational aspects of the program.

Issue a notice at the Secretary level delegating and clarifying the authority and responsibilities of the SAOP and Privacy Office

A. Document the roles and specific responsibilities of all positions assigned privacy responsibilities. B. Communicate these responsibilities on a recurring basis, at least annually, to individuals holding these positions.

Implement thorough human capital processes to ensure execution of the HUD privacy program and all its requirements

Finalize and approve the draft privacy program strategic plan

Ensure the privacy program is integrated with the enterprise risk program and that privacy risks are incorporated into the agency risk management process

Establish an executive leadership dashboard to communicate continuous monitoring of key program risks and issues

A. Develop an internal privacy program communication plan to describe how privacy issues will be disseminated and best practices will be shared. B. Implement the communication plan