We recommend that the Deputy Secretary Develop and execute a detailed plan and timeline for both testing and reporting estimates of improper payments in the PIH-TBRA and PBRA programs in compliance with Federal law and OMB guidance.

Status

In response to the Management Alert, the Deputy Secretary stated that she would provide a plan in 30 days. On April 10, 2024, the Chief Financial Officer, Assistant Secretary for Housing, and Principal Deputy Assistant Secretary for Public and Indian Housing (PIH) stated their respective executives have been working together to develop a plan to accelerate HUD’s ability to produce statistically valid estimates. With respect to project-based rental assistance (PBRA), HUD plans to use ongoing data collection for fiscal year (FY) 2023 tier 1 and tier 2 payments to develop a statistical estimate in FY 2024. With respect to PIH-TBRA, in lieu of pursuing an estimate for the FY 2024 reporting cycle, PIH will focus on “its existing efforts to enhance PIH [IT] systems”, which HUD considers to be a more strategic use of resources. It is not clear from HUD’s response what PIH will do differently than it already had planned prior to the management alert as HUD did not provide a detailed plan or timeline for OIG review. As of June 21, 2024, a detailed plan or timeline has not been provided.

Analysis

As of June 21, 2024, HUD has not provided a detailed plan or timeline for OIG review. It remains unclear how HUD will produce an estimate in the PBRA programs in 2024 and when it will be able to produce an estimate for PIH-TBRA.

For HUD to close this recommendation, it must finish testing the full life cycle of payments in these programs and publicly report estimates of the improper payments in them. Merely producing a plan with future action target dates is not sufficient to meet the spirit of this recommendation.

PBRA and PIH-TBRA are the two largest program expenditures in HUD's portfolio, totaling $45.3 billion in FY 23, or 67.5 percent of HUD's total expenditures. HUD has been challenged with developing a compliant sampling methodology that can test the full payment cycle and that can be executed within the required timeframes. HUD’s sampling methodology did not test the full payment cycle. Further, the associated sample testing and statistical estimation of improper payments could not be completed in time for the required annual reporting of improper payment estimates in the Agency Financial Report (AFR), normally issued in November. To fully address this recommendation, the sampling methodology should test the full payment cycle, and the associated sample testing and statistical estimation must be completed in time to be included in the AFR.

Implementation of this recommendation will result in HUD better safeguarding taxpayer dollars and decrease improper payments.

HUD (a) identify all contracts related to its programs that pre-date July 1, 2013 and that have not yet been modified to include Section 4712 whistleblower protections; and (b) review all contracts entered into on or after July 1, 2013, to ensure they include a clause that requires contractors to comply with Section 4712.

Status

As of June 2024, we have not yet reached agreement on a management decision with HUD over the corrective action they propose to take to address the recommendation.

Analysis

To fully address this recommendation, HUD must (a) identify all contracts related to its programs that pre-date July 1, 2013 and that have not yet been modified to include Section 4712 whistleblower protections; and (b) review all contracts entered on or after July 1, 2013, to ensure they include a clause that requires contractors to comply with Section 4712.

Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

Seek voluntary cooperation from program participants to proactively modify pre-2013 contracts for the purpose of including a clause requiring compliance with Section 4712.

Status

As of June 2024, we have not yet reached agreement on a management decision with HUD over the corrective action they propose to take to address the recommendation.

Analysis

To fully address this recommendation, HUD must provide evidence that it has sought voluntary cooperation from program participants to proactively modify pre-2013 contracts for the purpose of including a clause requiring compliance with Section 4712.

Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

Use its best efforts to include a clause requiring compliance with Section 4712 at the time of major modifications to contracts with program participants with whom HUD is unable to gain voluntary cooperation.

Status

As of June 2024, we have not yet reached agreement on a management decision with HUD over the corrective action they propose to take to address the recommendation.

Analysis

To fully address this recommendation, HUD must provide evidence that it has taken steps to ensure that it is including a clause requiring compliance with Section 4712 at the time of major modifications to contracts with program participants with whom HUD is unable to gain voluntary cooperation.

Implementation of this recommendation will ensure that Section 4712 whistleblower protections will apply to all individuals working for HUD contractors.

Develop and implement a nationwide protocol for field offices, describing how PHA self-inspections should be reviewed, based on REAC's determination of the number and frequency of PHA self-inspections.

Status

The Office of Field Operations will develop and implement a nationwide protocol for field offices, describing how Public Housing Agency (PHA) self inspections should be reviewed, based on Real Estate Assessment Center’s determination of the number and frequency of PHA self-Inspections. Enforcing the requirements of inspection timing are dependent upon software changes to NSPIRE.

The final action target date is August 15, 2024.

Analysis

To fully address this recommendation, HUD must provide evidence demonstrating that it has implemented control activities to ensure that public housing properties are inspected within required timeframes. Implementation of this recommendation will result in HUD accurately tracking the dates in which public housing properties should be inspected and that they are timely completed.

Implement adequate policies, procedures, and controls to ensure that public housing properties will be inspected within required timeframes.

Status

While the NSPIRE regulations on inspection timing are completed, the Real Estate Assessment Center is not able to make the required modifications in the NSPIRE system to enforce the regulatory guidelines as this time.  HUD is uncertain whether the vendor can make the needed modifications or if additional funding is needed. As of June 2024, PIH was not able to provide an expected time of when HUD will be able to make that determination.

Analysis

To fully address this recommendation, HUD must provide evidence demonstrating that it has implemented control activities to ensure that public housing properties are inspected within required timeframes. Implementation of this recommendation will result in HUD accurately tracking the dates in which public housing properties should be inspected and that they are timely completed. Due to the uncertainty of when software changes to NSPIRE can take place to enforce the timing of inspections, REAC cannot enforce the requirements of inspection timing.

Establish an improper payment council within HUD that consists of senior accountable officials from across the Department with a role in the effort that would work to identify risks and challenges to compliance and identify solutions as a collaborative group.

Status

The Office of the Chief Financial Officer (OCFO) noted that this recommendation cannot be completed by OCFO because OCFO is dependent on other HUD offices. The OCFO believes that this should be closed in light of the recommendation we made in the subsequent January 24, 2024, Management Alert: "Action Is Needed From HUD Leadership To Resolve Systemic Challenges With Improper Payments" which recommended that the Deputy Secretary Develop and execute a detailed plan and timeline for both testing and reporting estimates of improper payments in the Office of Public and Indian Housing’s Tenant-Based Rental Assistance (PIH-TBRA) and Office of Multifamily Housing Programs’ Project-Based Rental Assistance (PBRA) programs in compliance with Federal law and Office of Management and Budget guidance.

Analysis

The January 24, 2024, Management Alert: "Action Is Needed From HUD Leadership To Resolve Systemic Challenges With Improper Payments" found the lack of proper planning and coordination from leadership in HUD’s program and support offices prevents HUD from addressing the root causes behind the failure to comply with improper payment laws.

In response to the Management Alert, the Deputy Secretary stated that she would provide a plan in 30 days. On April 10, 2024, the Chief Financial Officer, Assistant Secretary for Housing, and Principal Deputy Assistant Secretary for Public and Indian Housing (PIH) stated their respective executives have been working together to develop a plan to accelerate HUD’s ability to produce statistically valid estimates. With respect to project-based rental assistance (PBRA), HUD plans to use ongoing data collection for fiscal year (FY) 2023 tier 1 and tier 2 payments to develop a statistical estimate in FY 2024. With respect to PIH-TBRA, in lieu of pursuing an estimate for the FY 2024 reporting cycle, PIH will focus on “its existing efforts to enhance PIH [IT] systems”, which HUD considers to be a more strategic use of resources. It is not clear from HUD’s response what PIH will do differently than it already had planned prior to the management alert as HUD did not provide a detailed plan or timeline for OIG review. As of June 21, 2024, a detailed plan or timeline has not been provided.

To improve coordination, HUD should establish an improper payment council within HUD that consists of senior accountable officials from across the Department. The council would work to identify risks and challenges to compliance and identify solutions as a collaborative group.

PIH in coordination with other HUD offices as necessary, research and address potential causes of the variance in the number of EBLL cases among States on the EBLL tracker and identify solutions that are within HUD's control.

Status

On May 7, 2024, the Office of Field Operations (OFO) stated that it met with the Real Estate Assessment Center (REAC) and Office of Lead Hazard Control and Healthy Homes (OLHCHH) on March 4 and April 23 and agreed that OFO and OLHCHH will review CDC data on counties with the highest prevalence of EBLLs in children for counties whose states that have reported their BLL data to CDC. OFO will review its EBLL tracker to determine reporting rates by the largest public housing authorities in those counties. OLHCHH will assign an analyst to summarize the most recently available prevalence rates based on selected states. Subsequently, OFO will scrutinize public housing authorities within those states to ascertain the reported cases.

The revised estimated completion date is February 28, 2025.

Analysis

To fully address this recommendation, OFO must provide evidence of meetings held and summaries of the research conducted. For example, what was the exchange with OLHCHH, did OFO coordinate with any other offices, and what research was conducted? OFO needs to research potential causes for the variances and determine what HUD could do to address them.

Alternatively, OFO must establish that there are no solutions within HUD’s control to address any identified causes.

Implementation of this recommendation will help ensure that EBLL cases are reported and recorded appropriately in the EBLL tracker.

Update HUD regulations, policies, and procedures following the regulatory process required by the amended Lead Safe Housing Rule, in consideration of CDC’s lowered BLRV of 3.5 ug/dL.

Status

On June 12, 2024, the Office of Lead Hazard Control and Healthy Homes informed HUD OIG that the draft Federal Register notice of its request for information from Lead Safe Housing Rule stakeholders and the general public on its proposal to adopt CDC's BLRV of 3.5 µg/dL as its EBLL under the rule has been circulated for OGC and preclearance review, which will be followed by Departmental clearance. OLHCHH plans on publishing the Federal Register notice by June 30, 2024, with a 60-day comment period. OLHCHH will provide the link and the link and the notice once it is published. OLHCHH will then review public comments in preparing to decide whether to change the rule's current level, and if so, to what level.

The Office of Lead Hazard Control and Healthy Homes estimated this will be completed by June 30, 2024.

Analysis

To fully address this recommendation, OLHCHH must provide evidence that it has updated its regulations, policies, and procedures so that they are consistent with CDC’s lowered BLRV of 3.5 ug/dL.

Alternatively, OLHCHH must establish that its research led it to determine that environmental interventions in cases of children with EBLLs between 3.5 and 4.9 µg/dL were ineffective in reducing the children’s blood lead levels and that lowering HUD’s EBLL regulation to 3.5 µg/dL is unnecessary.

Implementation of this recommendation will help ensure children living in public housing with EBLLs receive effective environmental interventions.

Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD’s fraud risk management program out of the ad hoc phase.

Status

HUD continues to make progress in advancing HUD’s Fraud Risk Management program. HUD issued its Fraud Risk Policy on March 31, 2022. Since then, HUD has integrated fraud risk considerations into risk assessment work completed across HUD, to include processes for Front End Risk Assessments (FERA) and the annual risk profile refresh. Leveraging the history of reports issued by HUD oversight partners, HUD has (1) compiled program level oversight reports to identify fraud risk concerns; (2) initiated a repository to stratify elements of the reports to isolate fraud risk concerns; and (3) isolated trends and themes from the source reports. This baseline work will support the Department’s Fraud Risk Exposure report, due September 2024.

The Chief Risk Officer (CRO) has indicated that it is nearing completion on an entity wide fraud risk exposure analysis. This analysis will tell HUD what programs should be prioritized and reviewed regularly, and which programs can be reviewed less frequently. The programs ranked highest will be first on the list for a full fraud risk assessment and the CRO will lay out a plan and timeline for completing the others. The CRO is also working on a plan to transition from the use of contractor support to full time staff, the plan will occur in phases until 2027, with the first hiring actions occurring soon. The Office of Multifamily Housing (MFH) met with OIG on April 7 to demonstrate the progress they have made on their program-specific fraud risk assessment for the Project Based Rental Assistance Program. MFH expects to complete the assessment by July 15th. the Offices of Public and Indian Housing and Community and Planning and Development have not completed fraud risk assessments, but are working on assigning or hiring staff for dedicated risk management roles.

Analysis

While HUD has made considerable progress in the area of fraud risk management, there is still a lot of work to be done for HUD to complete an entity wide fraud risk assessment. While HUD's exposure analysis will help it to determine where to focus its efforts, HUD still needs to conduct program specific fraud risk assessments. Based on the demonstration by MFH, we believe that MFH has made great progress in its fraud risk assessment and we are encouraged that it has identified areas of weakness that it plans to target. However, PIH and CPD have not been able to demonstrate progress in this area and we do not believe that they will be able to complete program specific fraud risk assessments by 9/30/24.

To fully address this recommendation, HUD must provide evidence that it has performed an agency-wide fraud risk assessment performed at the program level, adopted and implemented its fraud risk assessment program departmental policy and that each HUD program office has established office-specific risk programs/p>

Requires the REAC in coordination with OFO to determine the number of developments and associated units that contain lead-based paint and lead-based paint hazards.

Status

The Real Estate Assessment Center and Office of Field Operations will collaborate with the Office of Lead Hazard Control and Healthy Homes, the Office of Policy Development and Research, and a statistician to evaluate data collected under the NSPIRE inspection program to estimate the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards. The final action target date is March 31, 2025.

Analysis

To address this recommendation, HUD will need to provide evidence that it collected and evaluated data under NSPIRE and estimated the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards.

Implementation of this recommendation will assist HUD in working with PHAs to address the public housing units that contain lead-based paint and lead-based paint hazards and help HUD’s oversight of units in need of hazard reduction.

Update applicable requirements to require assisted property owners, including PHAs, to maintain adequate documentation to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule.

Status

The Office of Lead Hazard Control and Healthy Homes has drafted guidance on the de minimis exception to the Lead Safe Housing Rule for the Office of Public and Indian Housing, the Office of Multifamily Housing, and the Office of Community Planning and Development.

The Office of Lead Hazard Control and Healthy Homes expects to issue the guidance in final by July 2024.

Analysis

To implement this recommendation, HUD needs to provide evidence that it has prepared and issued a notice to target housing owners and public housing agencies on the de minimis exception and conducted trainings/webinars on requirements and best practices pertaining to de minimis.

Implementation of this recommendation and associated corrective actions will ensure assisted property owners are sufficiently informed regarding the requirements to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead safe work practices under the Lead Safe Housing Rule and that assisted property owners are conducting this work safely, thereby ensuring households are residing in safe and healthy HUD assisted housing.

We recommend that the Deputy Chief Financial Officer…In collaboration with all involved program offices, develop and implement a sampling methodology that allows for a sample size that reasonably allows for the testing of the complete payment cycle within the PIIA reporting timeframe.

Status

This recommendation was closed by HUD. However, OIG continues to object to that closure and identifies this as a priority recommendation. After HUD closed this recommendation, it informed OIG that it would not be able to produce estimates of improper payments in these programs for FY 2023 and projected to the Office of Management and Budget that it may not be able to do so until FY 2027, dependent on funding.

For several years, we have reported that HUD was unable to test for improper payments in these programs because the Office of the Chief Financial Officer (OCFO) was unsuccessful in working with the Offices of Public and Indian Housing, Multifamily Housing Programs, and the Chief Information Officer to securely collect program files needed to test payments. This year, OCFO reported that HUD was again unable to complete improper payment testing because it was delayed in implementing a secure platform designed to collect supporting data and documentation and also because of limited staffing resources with technical knowledge of the payment cycles. The lack of proper planning and coordination from leadership in HUD’s program and support offices has prevented HUD from addressing the root causes behind the failure to comply with improper payment laws.

Due to this, HUD OIG issued a management alert to the HUD Deputy Secretary entitled "Action Is Needed From HUD Leadership To Resolve Systemic Challenges With Improper Payments", on January 23, 2024. In response to the Management Alert, the Deputy Secretary stated that she would provide a plan in 30 days. On April 10, 2024, the Chief Financial Officer, Assistant Secretary for Housing, and Principal Deputy Assistant Secretary for Public and Indian Housing (PIH) stated their respective executives have been working together to develop a plan to accelerate HUD’s ability to produce statistically valid estimates. With respect to project-based rental assistance (PBRA), HUD plans to use ongoing data collection for fiscal year (FY) 2023 tier 1 and tier 2 payments to develop a statistical estimate in FY 2024. With respect to PIH-TBRA, in lieu of pursuing an estimate for the FY 2024 reporting cycle, PIH will focus on “its existing efforts to enhance PIH [IT] systems”, which HUD considers to be a more strategic use of resources. It is not clear from HUD’s response what PIH will do differently than it already had planned prior to the management alert as HUD did not provide a detailed plan or timeline for OIG review. As of June 21, 2024, a detailed plan or timeline has not been provided.

Analysis

HUD has been challenged with developing a compliant sampling methodology that can test the full payment cycle and that can be executed within the required timeframes. HUD’s sampling methodology did not test the full payment cycle. Further, the associated sample testing and statistical estimation of improper payments could not be completed in time for the required annual reporting of improper payment estimates in the Agency Financial Report (AFR), normally issued in November. To fully address this recommendation, the sampling methodology should test the full payment cycle, and the associated sample testing and statistical estimation must be completed in time to be included in the AFR.

Implementation of this recommendation will result in HUD better safeguarding taxpayer dollars and decrease improper payments.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. This recommendation includes:

• Identification and prioritization of externally provided systems (new and legacy), components, and services.
• How HUD maintains awareness of its upstream suppliers.
• The integration of acquisition processes tools, and techniques to use the acquisition process to protect the supply chain.
• Contract tools or procurement methods to confirm that contractors are meeting their obligations (derived from OIG FISMA metric 14).

Status

In May 2024, HUD OIG reviewed the Office of the Chief Information Officer’s progress is closing this recommendation as part of the annual FY 2024 FISMA evaluation. At that time, HUD provided additional evidence in the form of draft SCRM Policy, SCRM Procedures, SCRMES Charter, and a SCRM Technical Roadmap. Additionally, HUD provided agency-specific clauses. At the time, the guidance had not yet been finalized.

Analysis

To fully address this recommendation, HUD must establish that it has defined and communicated policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. Implementation of this recommendation will result in HUD continuing to mature in supply chain risk management, establishing and defining the policies and procedures of SCRM requirements as it relates to systems and system components.

Evaluate IT acquisition process workflows and identify ways to simplify the processes, facilitate more effective stakeholder coordination across offices, and create efficiencies when possible.

Status

The Office of the Chief Procurement Officer had agreed to an estimated completion date of March 2024. In April, The Office of the Chief Procurement Officer provided a status update and agreed to provide updated standard operating procedures once completed. However, no updated date for completion was provided.

Analysis

To fully address this recommendation, HUD must provide evidence that it has published its standard operating procedures resulting from its evaluation of workflows and efforts to simplify processes and facilitate more effective coordination.

Implementation of this recommendation will result in a defined IT acquisition process workflow standard operation procedure to ensure coordination across program offices.

Develop a comprehensive process to ensure that complaints received by HUD’s Multifamily Housing Clearinghouse are resolved in a timely manner.

Status

October 2023, the Office of Multifamily Housing Programs reported that HUD was transitioning the Multifamily Clearinghouse responsibilities to the Federal Housing Administration (FHA) Resource Center. The Office stated that it had requested IT Technology Fund funding for FY 2024 for system enhancements to coordinate tenant complaints throughout Multifamily Housing including Multifamily field staff and the Multifamily Clearinghouse Call Center.

Analysis

In June 2024, the Office reported that because the FY 2024 funding was not approved by Congress, it will use the FHA Resource Center and its system that will allow for tracking and monitoring of customer calls. In addition, the Office will request assistance from its Project Based Contract Administrators to use a standard, Multifamily-wide reporting format to standardize and aggregate tenant complaints.

Develop agencywide policies and procedures for the intake, monitoring, and tracking of health and safety complaints.

Status

October 2023, the Office of Multifamily Housing Programs reported that HUD was transitioning the Multifamily Clearinghouse responsibilities to the Federal Housing Administration (FHA) Resource Center. The Office stated that it had requested IT Technology Fund funding for FY 2024 for system enhancements to coordinate tenant complaints throughout Multifamily Housing including Multifamily field staff and the Multifamily Clearinghouse Call Center.

Analysis

In June 2024, the Office reported that because the FY 2024 funding was not approved by Congress, it will use the FHA Resource Center and its system that will allow for tracking and monitoring of customer calls. In addition, the Office will request assistance from its Project Based Contract Administrators to use a standard, Multifamily-wide reporting format to standardize and aggregate tenant complaints.

For the MF-RAP, PIH-TRA, and CPD-HIM programs, ensure that the program's improper payments rate estimates adequately test for and include improper payments of Federal funding that are made by State, local, and other organizations administering these programs and adequately disclose any limitations imposed or encountered when reporting on improper payments, to a degree that fairly informs users of the respective reported information.

Status

This recommendation was closed by HUD. However, OIG continues to object to that closure and identifies this as a priority recommendation. After HUD closed this recommendation, it informed OIG that it would not be able to produce estimates of improper payments in these programs for FY 2023 and projected to the Office of Management and Budget that it may not be able to do so until FY 2027, dependent on funding.

For several years, we have reported that HUD was unable to test for improper payments in these programs because the Office of the Chief Financial Officer (OCFO) was unsuccessful in working with the Offices of Public and Indian Housing, Multifamily Housing Programs, and the Chief Information Officer to securely collect program files needed to test payments. This year, OCFO reported that HUD was again unable to complete improper payment testing because it was delayed in implementing a secure platform designed to collect supporting data and documentation and also because of limited staffing resources with technical knowledge of the payment cycles. The lack of proper planning and coordination from leadership in HUD’s program and support offices has prevented HUD from addressing the root causes behind the failure to comply with improper payment laws.

Due to this, HUD OIG issued a management alert to the HUD Deputy Secretary entitled "Action Is Needed From HUD Leadership To Resolve Systemic Challenges With Improper Payments", on January 23, 2024. In response to the Management Alert, the Deputy Secretary stated that she would provide a plan in 30 days. On April 10, 2024, the Chief Financial Officer, Assistant Secretary for Housing, and Principal Deputy Assistant Secretary for Public and Indian Housing (PIH) stated their respective executives have been working together to develop a plan to accelerate HUD’s ability to produce statistically valid estimates. With respect to project-based rental assistance (PBRA), HUD plans to use ongoing data collection for fiscal year (FY) 2023 tier 1 and tier 2 payments to develop a statistical estimate in FY 2024. With respect to PIH-TBRA, in lieu of pursuing an estimate for the FY 2024 reporting cycle, PIH will focus on “its existing efforts to enhance PIH [IT] systems”, which HUD considers to be a more strategic use of resources. It is not clear from HUD’s response what PIH will do differently than it already had planned prior to the management alert as HUD did not provide a detailed plan or timeline for OIG review. As of June 21, 2024, a detailed plan or timeline has not been provided.

Analysis

HUD has been challenged with developing a compliant sampling methodology that can test the full payment cycle and that can be executed within the required timeframes. HUD’s sampling methodology did not test the full payment cycle. Further, the associated sample testing and statistical estimation of improper payments could not be completed in time for the required annual reporting of improper payment estimates in the Agency Financial Report (AFR), normally issued in November. To fully address this recommendation, the sampling methodology should test the full payment cycle, and the associated sample testing and statistical estimation must be completed in time to be included in the AFR.

Implementation of this recommendation will result in HUD better safeguarding taxpayer dollars and decrease improper payments.

Implement a software asset management capability for software and operating systems to ensure that software executes only from the authorized software inventory and all unauthorized software is blocked from executing on HUD's network.

Status

In April 2024, the Office of the Chief Information Officer reported that it was in the process of implementing a software management tool that would allow it to control which software is authorized to access the network. This is the first step to create rules for allowing only authorized software to be used through HUD's endpoint security software. Final implementation of this new tool is expected by Quarter 2 of FY 2025.

Analysis

To fully address this recommendation, HUD must provide evidence that it has an automated whitelist and implement as per the NIST Special Publication 800-167 or accept the risk and document mitigating measures via a Risk Based Decision memorandum.

Implementation of this recommendation will result in HUD having the capability to ensure only authorized software is used on HUD’s network based on its software asset listing.

Implement multifactor authentication mechanisms for all nonprivileged users who access information systems that process, store, or transmit PII.

Status

In April 2024, the Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, had completed 9 of 15 systems within the first phase, and will be delayed in completing the final system until the last quarter of FY 2024.

Analysis

Implementation of this recommendation will result in an enterprise-wide identity and access management solution which addresses the requirements in Executive Order 14028, titled “Improving the Nation’s Cybersecurity”. Users will be required to use multifactor authentication methods to access HUD data, networks, and devices.