Work with HUD’s Office of Lead Hazard Control and Healthy Homes to assess whether the lead-based paint inspections and risk assessments with missing elements are sufficient to support the lead-based paint status of the Authority’s properties. If it is determined that the lead-based paint and risk assessment reports are not sufficient, HUD should require the Authority to perform new assessments.

Provide evidence that the owners corrected the 248 deficiencies for the 48 units with outstanding deficiencies. If the owners fail to make corrections, the Authority should implement its stop payment procedures and provide supporting documentation to HUD.

Implement a quality control process for monitoring its contracted inspectors to ensure that units meet HUD’s requirements to prevent nearly $36 million in program funds from being spent on units that do not meet HQS over the next year.

Implement procedures and controls regarding its quality control inspections to ensure that the results of those inspections are appropriately used to evaluate and monitor the performance of the Authority’s contracted inspectors and documentation is maintained on communications with the contractor on corrective actions taken to address recurring inspection deficiencies.

Pursue collection from the applicable owner or reimburse its HCV Program $5,194 from non-Federal funds for HAP that was not properly stopped for two units with outstanding HQS deficiencies.

Provide support showing whether HAP was appropriately stopped for the four units cited in the finding or reimburse or pursue collection of $10,233 from non-Federal funds for HAP to owners with outstanding HQS deficiencies.

Implement procedures and controls regarding its stop payment process to ensure that it consistently (1) stops payments as required by its HCV Program administrative plan and HUD requirements, (2) verifies and documents the correction of deficiencies, and (3) maintains sufficient documentation to support the stop payment for each unit.

Implement controls over its inspection processes and procedures to ensure that emergency failures are properly identified, reinspected, and corrected within 24 hours in accordance with its HCV Program administrative plan or the housing assistance to the owner is stopped.

Work with its contractor to ensure that the contractor’s inspectors receive training on how to properly identify and categorize life-threatening deficiencies.

Develop and implement policies and procedures that align with HUD’s requirements and controls to ensure that owners follow the requirements of the LSHR.

Work with HUD’s Office of Lead Hazard Control and Healthy Homes to provide technical assistance to the Authority’s staff to develop and implement policies, procedures, and controls for managing cases of children with EBLLs to ensure compliance with the LSHR, including attempts to collaborate with public health departments to identify cases of EBLL in children under 6 years of age under its HCV Program and updating its policies and procedures accordingly.

HUD OCIO should implement a process to consistently update and maintain its inventory of hardware assets and ensure that the inventory is consistent with the automated discovery scans used to perform vulnerability, configurations, and continuous diagnostics and mitigation scans and use this inventory to consistently remove unauthorized hardware assets from the HUD network (IG FISMA metrics 2, 20, and 21).

HUD OCIO should report at least 80 percent of its government-furnished equipment through the DHS CDM program (IG FISMA metric 2).

HUD OCIO should implement a process to consistently update and maintain its inventory of software assets and ensure that the inventory is consistent with the automated discovery scans used to perform vulnerability, configurations, and continuous diagnostics and mitigation scans and use this inventory to consistently remove unauthorized software assets from the HUD network (IG FISMA metrics 2, 20, and 21).

HUD OCIO should update its software inventory policies and procedures to account for critical software as defined by EO 14028 (IG FISMA metrics 3 and 21).

HUD OCIO should implement policies and procedures to maintain inventories of critical software and software licenses, critical software platforms, and all software installed on critical software platforms (both critical software and noncritical software) and use the inventory of critical software platforms and all software installed on them to ensure that only supported versions of software are used on those critical software platforms (IG FISMA metrics 3 and 21).

HUD OCIO should in coordination with the Chief Risk Officer (CRO), document cybersecurity risk management roles and responsibilities in a consolidated list and; define procedures to hold personnel accountable to their assigned roles in the consolidated list (IG FISMA metric 7)

HUD OCIO should consistently implement personnel accountability procedures to ensure that assigned cybersecurity risk management roles are being performed in an effective manner (IG FISMA metric 7).

HUD OCIO should ensure that external systems, such as cloud systems and cloud service providers, have and maintain configuration management plans that are consistent with HUD’s defined configuration management requirements (IG FISMA metric 19).

HUD OCIO should define and implement metrics to monitor the effectiveness of ICAM program activities and assist in identifying areas for improvement (IG FISMA metric 26).