Develop ALU engagement standards and incorporate them into acquisition policies and procedures.

Update guidance to clarify the different roles and responsibilities of the ALU, CO, CS, and COR.

We recommend that the Chief Procurement Officer develop, implement, and communicate requirements for program offices to establish written minimum roles and responsibilities for their respective procurement management functions, including but not limited to CORs, PMs, and SMEs.

Revise HUD’s Controlled Unclassified Information Policy to include the anti-gag provision.

Revise HUD’s Controlled Unclassified Information Policy to state that (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

Implement a plan to annually survey all HUD program offices to identify nondisclosure policies, forms, and agreements issued and to determine whether they include the anti-gag provision as required by WPEA and, as necessary, to take corrective action to ensure that they include the anti-gag provision.

Communicate across HUD that (a) HUD employees are required to include the anti-gag provision in nondisclosure policies, forms, and agreements applicable to HUD employees and (b) program offices should consider requiring their employees to request OGC assistance when implementing and enforcing nondisclosure policies, forms, and agreements applicable to HUD employees.

Revise the Ginnie Mae Confidential Information Policy to state that in the future, (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

HUD OCIO should identify needs to address Federal requirements by performing a gap analysis on its zero trust architecture strategic plan.

HUD OCIO should establish a zero trust architecture implementation plan that includes milestones and resources to address all zero trust pillars.

HUD OCIO should capture risks that are associated with zero trust architecture implementation and document these risks in its risk register.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Housing should include zero trust requirements as part of the Housing Strategic Roadmap for Housing Modernization.

HUD OCIO should a) resolve the conflicts between its Inventory of Automated Systems (IAS) policy and web applications policy to clarify if web applications will be inventories in IAS, the web application Sharepoint site, or both; and b) implement the chosen resolution to this conflict to develop a consistent inventory of web applications (IG FISMA metric 1).

HUD OCIO should demonstrate that it can implement its defined security responses if a baseline configuration is changed without authorization. This can be shown by either a response to a real incident if one happens or through a testing exercise if there are no applicable incidents (IG FISMA metric 23).

HUD OCIO should review its security training program and determine whether it should provide general cybersecurity awareness training to external users of its systems and data (IG FISMA metric 44).

Implement a process to identify teleworkers most at risk of receiving incorrect locality payments, verify that their official duty stations are correct and they are reporting to their official duty stations as required, and if necessary, correct their locality payments.

Determine how to measure the impact of recruitment efforts related to individuals who identiy as Hispanic or Latino.

Implement a process to measure the impact of recruitment efforts related to individuals who identify as Hispanic or Latino.

Implement a process to collect and maintain information about recruitment efforts related to indiviuals who identify as Hispanic or Latino from all HUD program offices and their respective field offices.