HUD OCIO should develop and implement processes to monitor and analyze qualitative and quantitative performance measures for the effectiveness of its ISCM program (IG FISMA metric 47).

HUD OCIO should define a process and assign responsibility to evaluate the effectiveness of its incident response technologies and adjust configurations and toolsets to improve the incident response program (IG FISMA metric 58).

HUD OCIO should update its enterprisewide business impact prioritization analysis procedures to include system dependencies and the characterization of system components (IG FISMA metric 61).

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Update its policy and procedures to define its authority for marketing troubled issuer portfolios and the conditions that must exist to extinguish issuers using rapid relocation.

Corrective Action Taken

As of February 2024, HUD addressed this recommendation in a Management Decision by providing the updated extinguishment SOP, the Rapid Relocation Process Flow, and the Rapid Relocation Extinguishment Process Steps, updated to include the conditions that must be present to execute an extinguishment using rapid relocation. We believe that these guidance enhancements will help Ginnie Mae to reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Update its policy and procedures to define what type of information Ginnie Mae may disclose and how it will handle protected information before extinguishment.

Corrective Action Taken

Ginnie Mae provided the updated SOP to clarify data and information handling through all phases of the termination/extinguishment process. Specifically, the updated procedures state that Ginnie Mae does not disclose Issuer or portfolio information within the Rapid Relo process. Ginnie Mae provided clarity in this enhancement that will reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Update its Policies and procedures to define how Ginnie Mae will determine the portfolio value and price before Sale.

Corrective Action Taken

Ginnie Mae updated its Rapid Relocation Extinguishment SOP to specify the valuation model for rapid relocations will use the same valuation models as other extinguishment options, including examples of portfolio valuation. We believe this guidance enhancement will help Ginnie Mae to reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Update its policies and procedures to define how Ginnie Mae intends to identify and evaluate prospective buyers to ensure its ability to absorb the extinguished portfolio before executing the purchase and sale agreement.

Corrective Action Taken

Ginnie Mae updated its Rapid Relocation Extinguishment SOP to require an Impact Analysis Evaluation of each prospective buyer under the Rapid Relocation Extinguishment program. The Impact Analysis Evaluation mirrors similar activities performed on select standard Pool Transfer participants and includes details (such as adjusted net worth, delinquency, loan court and total unpaid principle balance) to confirm prospective buyers are able to absorb the extinguished portfolio before executing the purchase and sale agreement. We believe this guidance enhancement will help Ginnie Mae to reduce exposure to risk when facilitating a sale and transfer of a troubled issuer’s portfolio and ensure that it sells portfolios with limited loss to the Government and with minimal disruption to the mortgage market.

Assesses what information Ginnie Mae needs from the MSS to ensure that they have the capacity for a large- or multiple-issuer extinguishment.

Prescribes how the contracting officer representative will review information provided by the MSS and provide actionable feedback to ensure MSS readiness.

Develop and implement an agencywide crisis readiness plan addressing likely hazards arising from a crisis. This guidance should include all key elements that meet CIGFO crisis guidance.

Identify short- and long-term plans for the RPA program that align its capabilities, staffing needs, funding projections, and mission needs.

Implement procedures to capture and monitor centralized logs to maintain appropriate visibility into bot activities and provide for auditability of bot actions.

Implement procedures to periodically review RPA system access and remove access for users that are not authorized or no longer have a need to use the system.

Implement procedures to ensure that attended bots use the security rights and credentials of the attending user.

Research, evaluate, and implement technical or alternative solutions to deploy essential computer software updates using appropriate secure methods to ensure that computer security updates occur in a timely manner to minimize risk to HUD’s systems and operations