HUD OCIO should implement procedures to ensure that digital identity risk assessments have been performed and documented in accordance with HUD’s defined procedures and Federal guidelines (IG FISMA metrics 30 and 31).
2023-OE-0001 | Enero 29, 2024
HUD FY 2023 Federal Information Security Modernization Act (FISMA) Evaluation Report
Chief Information Officer
- Status2023-OE-0001-16OpenClosedClosed on Agosto 26, 2024
- Status2023-OE-0001-17OpenClosed
HUD OCIO should define a plan to meet the logging requirements at all event logging maturity levels (basic, intermediate, advanced) in accordance with OMB M-21-31. This plan should include logging sufficient to allow for reviewing privileged user activities (IG FISMA metrics 32 and 54).
- Status2023-OE-0001-18OpenClosed
HUD OCIO should develop and implement monitoring and enforcement procedures to ensure that non-GFE devices (for example, BYOD), such as those owned by contractors or HUD employees, are either: (a) prohibited from connecting to the HUD network; or (b) properly authorized and configured before connection to the HUD network (IG FISMA metrics 2, 21, and 33).
- Status2023-OE-0001-19OpenClosed
HUD OCIO should develop and implement procedures and contract terms to enforce forfeiture of non-GFE devices (for example, BYOD), to allow for analysis when security incidents occur (IG FISMA metrics 33 and 55).
- Status2023-OE-0001-21OpenClosedClosed on Agosto 26, 2024
HUD OCIO should develop and implement processes to monitor and analyze qualitative and quantitative performance measures for the effectiveness of its ISCM program (IG FISMA metric 47).
- Status2023-OE-0001-22OpenClosed
HUD OCIO should define a process and assign responsibility to evaluate the effectiveness of its incident response technologies and adjust configurations and toolsets to improve the incident response program (IG FISMA metric 58).
- Status2023-OE-0001-23OpenClosed
HUD OCIO should update its enterprisewide business impact prioritization analysis procedures to include system dependencies and the characterization of system components (IG FISMA metric 61).
2024-IG-0001 | Enero 23, 2024
Management Alert: Action Is Needed From HUD Leadership To Resolve Systemic Challenges With Improper Payments
Deputy Secretary
- Status2024-IG-0001-001-AOpenClosedPrioridadPriority
We believe these open recommendations, if implemented, will have the greatest impact on helping HUD achieve its mission to create strong, sustainable, inclusive communities and quality affordable homes for all.
We recommend that the Deputy Secretary Develop and execute a detailed plan and timeline for both testing and reporting estimates of improper payments in the PIH-TBRA and PBRA programs in compliance with Federal law and OMB guidance.
Status
In response to the Management Alert, the Deputy Secretary stated that she would provide a plan in 30 days. On April 10, 2024, the Chief Financial Officer, Assistant Secretary for Housing, and Principal Deputy Assistant Secretary for Public and Indian Housing (PIH) stated their respective executives have been working together to develop a plan to accelerate HUD’s ability to produce statistically valid estimates. With respect to project-based rental assistance (PBRA), HUD plans to use ongoing data collection for fiscal year (FY) 2023 tier 1 and tier 2 payments to develop a statistical estimate in FY 2024. With respect to PIH-TBRA, in lieu of pursuing an estimate for the FY 2024 reporting cycle, PIH will focus on “its existing efforts to enhance PIH [IT] systems”, which HUD considers to be a more strategic use of resources. It is not clear from HUD’s response what PIH will do differently than it already had planned prior to the management alert as HUD did not provide a detailed plan or timeline for OIG review. As of June 21, 2024, a detailed plan or timeline has not been provided.
Analysis
As of June 21, 2024, HUD has not provided a detailed plan or timeline for OIG review. It remains unclear how HUD will produce an estimate in the PBRA programs in 2024 and when it will be able to produce an estimate for PIH-TBRA.
For HUD to close this recommendation, it must finish testing the full life cycle of payments in these programs and publicly report estimates of the improper payments in them. Merely producing a plan with future action target dates is not sufficient to meet the spirit of this recommendation.
PBRA and PIH-TBRA are the two largest program expenditures in HUD's portfolio, totaling $45.3 billion in FY 23, or 67.5 percent of HUD's total expenditures. HUD has been challenged with developing a compliant sampling methodology that can test the full payment cycle and that can be executed within the required timeframes. HUD’s sampling methodology did not test the full payment cycle. Further, the associated sample testing and statistical estimation of improper payments could not be completed in time for the required annual reporting of improper payment estimates in the Agency Financial Report (AFR), normally issued in November. To fully address this recommendation, the sampling methodology should test the full payment cycle, and the associated sample testing and statistical estimation must be completed in time to be included in the AFR.
Implementation of this recommendation will result in HUD better safeguarding taxpayer dollars and decrease improper payments.
2022-OE-0008 | Enero 19, 2024
U.S. Department of Housing and Urban Development Employee Retention
Office of Chief Human Capital Officer
- Status2022-OE-0008-01OpenClosedClosed on Enero 19, 2024
Implement a transparent process for reviewing open-ended exit survey results and sharing those results with ODEEO, as appropriate, and program offices while still protecting former employees’ confidentiality.
- Status2022-OE-0008-02OpenClosedClosed on Enero 19, 2024
Assess what departing employees mean when they indicate that organizational culture is a motivation for leaving HUD.
- Status2022-OE-0008-03OpenClosedClosed on Agosto 15, 2024
Develop guidance for the program offices to identify the causes behind high attrition rates in governmentwide high-risk MCOs and field offices in large cities.
- Status2022-OE-0008-04OpenClosed
Develop guidance for program offices to develop program office-specific action plans to address any causes found for high attrition rates in governmentwide high-risk MCOs and field offices in large cities.
- Status2022-OE-0008-05OpenClosed
Create a single, unified agency-specific MCO list updated to reflect current progress toward closing skills gaps.
2023-OE-0001a | Diciembre 20, 2023
Fiscal Year 2023 Federal Information Security Modernization Act of 2014 Penetration Test Evaluation Report
Policy Development & Research
- Status2023-OE-0001a-04OpenClosedSensitiveSensitive
Sensitive information refers to information that could have a damaging import if released to the public and, therefore, must be restricted from public disclosure.
The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.
Chief Information Officer
- Status2023-OE-0001a-01OpenClosedSensitiveSensitive
Sensitive information refers to information that could have a damaging import if released to the public and, therefore, must be restricted from public disclosure.
The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.
- Status2023-OE-0001a-02OpenClosedSensitiveSensitive
Sensitive information refers to information that could have a damaging import if released to the public and, therefore, must be restricted from public disclosure.
The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.
- Status2023-OE-0001a-03OpenClosedSensitiveSensitive
Sensitive information refers to information that could have a damaging import if released to the public and, therefore, must be restricted from public disclosure.
The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.
- Status2023-OE-0001a-05OpenClosedSensitiveSensitive
Sensitive information refers to information that could have a damaging import if released to the public and, therefore, must be restricted from public disclosure.
The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.
- Status2023-OE-0001a-06OpenClosedSensitiveSensitive
Sensitive information refers to information that could have a damaging import if released to the public and, therefore, must be restricted from public disclosure.
The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.
2024-BO-0001 | Diciembre 18, 2023
Opportunities Exist To Improve HUD’s FHA Resource Center’s Routing of Housing Discrimination Inquiries
Housing
- Status2024-BO-0001-001-AOpenClosedClosed on Diciembre 18, 2023
We recommend that HUD’s Deputy Assistant Secretary for Single Family Housing update policies and procedures regarding discrimination complaints to ensure consistency among customer service representatives in rerouting these complaints to FHEO.