Ensure role-based privacy training is provided to all personnel with privacy responsibilities

Ensure privacy awareness training is provided to all contractor and third party personnel

Provide personnel tasked with handling Privacy Act requests with recurring training on Privacy Act exceptions

Establish documentation procedures for accounting of disclosures made under the Privacy Act, as required by 5 USC 552a(c)

Establish an annual computer matching activity reporting process to meet the requirements of OMB Circular A-108

Determine if general support system privacy threshold assessments or privacy impact assessments should be completed; if not, document the rationale

Develop the technical capability to identify, inventory, and monitor the existence of PII within the HUD environment

Develop and implement a process to inventory all agency PII holdings not less than annually.

Renew the PII minimization effort, to include a prioritization by the SAOP of specific minimization initiatives

Require all system owners to review the records retention practices for each information system and take any corrective actions necessary to ensure adherence to the applicable records retention schedule

A. Issue a clean desk policy prohibiting unattended and unsecured sensitive data in workplaces. B. Implement procedures to enforce the clean desk policy.

Update the occupant emergency plan so that it lists the ways occupants are to report fires or other emergencies

Periodically provide training on the occupant emergency plan once it is updated

Create a process to help ensure that fire drills for the Weaver Building occur every year

Deobligate all obligations marked for deobligation during the departmentwide OOR, including as much as $2,266,017 in 100 administrative obligations marked for deobligation as of September 30, 2017.

Ensure that originating base IAAs and modifications are maintained in HUD’s procurement system of record, PRISM, including manual documentation and records from HIAMS.

Develop, document, and implement policies and procedures for initiating, recording, and approving IAAs and subsequent modifications.

Monitor the records management procedures of OCPO field offices for administering consistency among contracting officers processing IAAs and corresponding modifications.

Strengthen current purchase card controls to ensure that purchases are supported by all required approvals before the purchase is made.

Review the four cardholders with incomplete approvals and determine whether the purchases were allowable and proper. If they were not for official government use, OCPO should determine whether the cardholders paid the credit bill for the improper charges, request reimbursement when applicable, and ensure that appropriate administrative sanctions are taken.