Revise the Ginnie Mae Confidential Information Policy to state that in the future, (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

The CDO should coordinate with HUD’s Records Office, Privacy Office, and program offices to develop data policies and procedures for data inventory, categorization, and labeling in support of zero trust architecture.

Status

HUD is working on a plan to address the recommendation. HUD OIG anticipates receiving a corrective action plan no later than April 11, 2025, with a plan for resolving this recommendation.

Analysis

By addressing the recommendation, HUD will be positioned better to protect and prioritize protection for data in its IT systems. This will allow HUD to have a better understanding of the specifics of the most sensitive data as well as allow recommendation 2024-OE-0002a-003 to be addressed by HUD.

HUD maintains billions of records of PII and sensitive data within IT systems and the IT environment. Knowing more specifics about the data is essential in the ability to protect and recover from attempted exfiltration attempts.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research, and the Deputy Chief Information Officer, Office of the Chief Information Officer develop the project management documents, as required by HUD’s Project Planning and Management Life Cycle V2.0 policy, including obtaining required approvals and ensuring that an adequate project risk management process is established for identifying, analyzing, and responding to project risks.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research; the Deputy Chief Information Officer; and the Director, Office of Disaster Recovery, identify and incorporate at least one additional data source into the Disaster Recovery Data Portal to further assist grantees with duplication of benefits assessments.

Update its policy and procedures to define its authority for marketing troubled issuer portfolios and the conditions that must exist to extinguish issuers using rapid relocation.

Corrective Action Taken

As of February 2024, HUD addressed this recommendation in a Management Decision by providing the updated extinguishment SOP, the Rapid Relocation Process Flow, and the Rapid Relocation Extinguishment Process Steps, updated to include the conditions that must be present to execute an extinguishment using rapid relocation. We believe that these guidance enhancements will help Ginnie Mae to reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Update its policy and procedures to define what type of information Ginnie Mae may disclose and how it will handle protected information before extinguishment.

Corrective Action Taken

Ginnie Mae provided the updated SOP to clarify data and information handling through all phases of the termination/extinguishment process. Specifically, the updated procedures state that Ginnie Mae does not disclose Issuer or portfolio information within the Rapid Relo process. Ginnie Mae provided clarity in this enhancement that will reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Update its Policies and procedures to define how Ginnie Mae will determine the portfolio value and price before Sale.

Corrective Action Taken

Ginnie Mae updated its Rapid Relocation Extinguishment SOP to specify the valuation model for rapid relocations will use the same valuation models as other extinguishment options, including examples of portfolio valuation. We believe this guidance enhancement will help Ginnie Mae to reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Update its policies and procedures to define how Ginnie Mae intends to identify and evaluate prospective buyers to ensure its ability to absorb the extinguished portfolio before executing the purchase and sale agreement.

Corrective Action Taken

Ginnie Mae updated its Rapid Relocation Extinguishment SOP to require an Impact Analysis Evaluation of each prospective buyer under the Rapid Relocation Extinguishment program. The Impact Analysis Evaluation mirrors similar activities performed on select standard Pool Transfer participants and includes details (such as adjusted net worth, delinquency, loan court and total unpaid principle balance) to confirm prospective buyers are able to absorb the extinguished portfolio before executing the purchase and sale agreement. We believe this guidance enhancement will help Ginnie Mae to reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Assesses what information Ginnie Mae needs from the MSS to ensure that they have the capacity for a large- or multiple-issuer extinguishment.

Prescribes how the contracting officer representative will review information provided by the MSS and provide actionable feedback to ensure MSS readiness.

Develop and implement an agencywide crisis readiness plan addressing likely hazards arising from a crisis. This guidance should include all key elements that meet CIGFO crisis guidance.

Update and synchronize the SOP and the matching procedure. The updates should include notifications that provide issuers with unmatched loans adequate time to take corrective action to comply with the requirements of the MBS Guide to put $903 million to better use by ensuring that the appropriate agency insurance or guarantee is in place.

Ensure that all necessary information regarding terminated VA loans is included in the matching process.

Ensure there are resources available for further development of geocoding services that fulfill HUD’s responsibilities stated in 43 U.S.C. § 2808(a)(5) and 43 U.S.C. § 2808(a)(12) through the reactivation of the lapsed Geocode Service Center contract.

Create separate reporting lines between model development and model validation functions so that both critical model functions do not report to OER, are appropriately segregated in accordance with industry guidance, and follow the foundational component of internal control standards.

Take appropriate actions to prioritize the need for resources necessary to ensure that HUD fully implements the remaining four responsibilities as required by sections 759(a)(1), 759(a)(2), 759(a)(4), and 759(a)(5) of the Geospatial Data Act of 2018.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.