The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and supply chain risk management (SCRM) requirements.  This recommendation includes (a) identification and prioritization of externally provided systems (new and legacy), components, and services; (b) how HUD maintains awareness of its upstream suppliers; (c) the integration of acquisition processes, tools, and techniques to use the acquisition process to protect the supply chain; and (d) contract tools or procurement methods to confirm that contractors are meeting their obligations. 

Corrective Action

HUD finalized its Supply Chain Risk Management (SCRM) policy in April 2025, which utilizes a SCRM questionnaire to assess each vendor’s supply chain risk, and identifies and prioritizes risks accordingly.  HUD’s SCRM program team manages a supply chain risk register which records prior and current vendors, and those that have undergone risk assessments to maintain visibility into its upstream suppliers and track changes over time.  HUD also used multiple tools such as supply chain risk criteria and sourcing research and market analysis to evaluate vendors and strengthen protection of the supply chain during acquisition.  By implementing these procedures, as well as, having HUD’s program management team conducting annual and quarterly performance reviews for all vendors, HUD ensures contractors are meeting their contractual obligations.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Conduct a departmentwide comprehensive staff capacity assessment to identify resource and skills gaps of staff involved in IT acquisitions.

Develop a plan for clearly defining, communicating, and enforcing IT acquisition process standards, including acquisition process roles and responsibilities.

Standardize position descriptions and job analyses for mission-critical occupations, high-risk occupations, and positions with high-volume staffing needs.

Develop and share best practices with HUD’s program offices on how hiring managers can execute hiring process responsibilities to meet timeliness goals.

Determine the cause for the variations in the timeliness of the preemployment and security checks step in FY 2017, 2018, and 2019 and develop appropriate process improvements.

Develop and document comprehensive reference documents on the hiring processes, procedures, roles, and responsibilities.

Develop and implement regular training for process owners on the hiring process.

Create and implement a knowledge management strategy, such as developing standard operating procedures, reference sheets, and program office fact sheets.

Corrective Action Taken

OCHCO developed and implemented client profiles for each HUD program office to address knowledge loss and the need for offices to explain or reexplain their mission and functions. The profiles will serve as a central repository to learn about the various programs and missions of HUD and will allow OCHCO staff, other key HUD program office staff, and HUD’s service provider staff to view critical information for each HUD program office.

Conduct a feasibility study for an automated POL.

Develop and implement time-to-hire goals that account for each hiring process step.

Develop and document methodologies on how OCHCO calculates hiring metrics to ensure that its hiring metrics and hiring goals align across all of its data sources, including the POL, the human capital dashboard, and the HCOP.

Track the quality of candidates as measured by the hiring officials.