The CDO should coordinate with HUD’s Records Office, Privacy Office, and program offices to develop data policies and procedures for data inventory, categorization, and labeling in support of zero trust architecture.

Status

HUD is working on a plan to address the recommendation. HUD OIG anticipates receiving a corrective action plan no later than April 11, 2025, with a plan for resolving this recommendation.

Analysis

By addressing the recommendation, HUD will be positioned better to protect and prioritize protection for data in its IT systems. This will allow HUD to have a better understanding of the specifics of the most sensitive data as well as allow recommendation 2024-OE-0002a-003 to be addressed by HUD.

HUD maintains billions of records of PII and sensitive data within IT systems and the IT environment. Knowing more specifics about the data is essential in the ability to protect and recover from attempted exfiltration attempts.

We recommend that HUD’s Deputy Assistant Secretary for Fair Housing and Equal Opportunity update protocols to promote consistent expectations for timely supervisory, legal, and headquarters reviews of complex cases.

We recommend that HUD’s Deputy Assistant Secretary for Fair Housing and Equal Opportunity review and update the MOUs with OGC for each region to identify and remove inefficiencies that can lead to longer FHEO investigation times and OGC review times and identify best practices that can be implemented across all regions.

We recommend that HUD’s Deputy Assistant Secretary for Fair Housing and Equal Opportunity review and update investigative processes followed by each regional office to identify best practices that can be implemented across all regions and identify and remove inefficiencies that can lead to longer investigation times.

We recommend that HUD’s Deputy Assistant Secretary for Enforcement require the Commission to update its intake policy and procedure to clarify which inquiries are to be recorded in HEMS.

We recommend that HUD’s Deputy Assistant Secretary for Enforcement require the Commission to develop an internal agency intake training guide, distribute it to all agency housing staff members, and ensure that all intake staff members participate in HUD-approved training related to intake.

We recommend that HUD’s Deputy Assistant Secretary for Enforcement require the Commission to implement a record retention policy to ensure that decisions on inquiries are sufficiently supported.

We recommend that HUD’s Deputy Assistant Secretary for Enforcement require the Commission to implement a plan to ensure that it has sufficient staff to meet its obligations under FHAP cooperative agreement.

We recommend that HUD’s Deputy Assistant Secretary for Enforcement require the Commission to implement a system to better track the intake and processing of potential fair housing inquiries.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research, and the Deputy Chief Information Officer, Office of the Chief Information Officer develop the project management documents, as required by HUD’s Project Planning and Management Life Cycle V2.0 policy, including obtaining required approvals and ensuring that an adequate project risk management process is established for identifying, analyzing, and responding to project risks.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research; the Deputy Chief Information Officer; and the Director, Office of Disaster Recovery, identify and incorporate at least one additional data source into the Disaster Recovery Data Portal to further assist grantees with duplication of benefits assessments.

Provide more detailed guidance to HUD reviewers on benchmarks for each performance standard.

Update the PAR template to ensure that HUD reviewers include required information.

Assess HUD reviewers’ skills and readiness to determine the appropriate frequency of training.

Provide more detailed guidance to HUD reviewers and FHEO regional directors on when and under what circumstances to recommend or issue a PIP.

Update HUD Handbook 8024.01, REV-2, and regional intake policies and procedures as necessary to include (1) minimum requirements that all regions follow for documenting in HEMS attempts to reach out to claimants when additional information is needed before closing inquiries; (2) policies and procedures for collecting, recording, and documenting all relevant electronic intake information in HEMS; and (3) clarifying that communications with claimants regarding inquiry closure, requests for additional information, and notices of jurisdiction information clearly inform the claimant of the ability to provide additional information within the statute of limitations.

Develop a process to oversee housing discrimination allegations that FHAP agencies close and do not submit to HUD for dual-filing to ensure that the closure and jurisdictional determinations are consistent with the Fair Housing Act. To help address this recommendation, HUD should consider requiring FHAP agencies to enter data on closed inquiries in HEMS and make updates to FHAP agreements as necessary.

Ensure there are resources available for further development of geocoding services that fulfill HUD’s responsibilities stated in 43 U.S.C. § 2808(a)(5) and 43 U.S.C. § 2808(a)(12) through the reactivation of the lapsed Geocode Service Center contract.

Take appropriate actions to prioritize the need for resources necessary to ensure that HUD fully implements the remaining four responsibilities as required by sections 759(a)(1), 759(a)(2), 759(a)(4), and 759(a)(5) of the Geospatial Data Act of 2018.