The CDO should coordinate with HUD’s Records Office, Privacy Office, and program offices to develop data policies and procedures for data inventory, categorization, and labeling in support of zero trust architecture.

Status

HUD is working on a plan to address the recommendation. HUD OIG anticipates receiving a corrective action plan no later than April 11, 2025, with a plan for resolving this recommendation.

Analysis

By addressing the recommendation, HUD will be positioned better to protect and prioritize protection for data in its IT systems. This will allow HUD to have a better understanding of the specifics of the most sensitive data as well as allow recommendation 2024-OE-0002a-003 to be addressed by HUD.

HUD maintains billions of records of PII and sensitive data within IT systems and the IT environment. Knowing more specifics about the data is essential in the ability to protect and recover from attempted exfiltration attempts.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research, and the Deputy Chief Information Officer, Office of the Chief Information Officer develop the project management documents, as required by HUD’s Project Planning and Management Life Cycle V2.0 policy, including obtaining required approvals and ensuring that an adequate project risk management process is established for identifying, analyzing, and responding to project risks.

We recommend that the General Deputy Assistant Secretary, Office of Policy Development and Research; the Deputy Chief Information Officer; and the Director, Office of Disaster Recovery, identify and incorporate at least one additional data source into the Disaster Recovery Data Portal to further assist grantees with duplication of benefits assessments.

Ensure there are resources available for further development of geocoding services that fulfill HUD’s responsibilities stated in 43 U.S.C. § 2808(a)(5) and 43 U.S.C. § 2808(a)(12) through the reactivation of the lapsed Geocode Service Center contract.

We recommend that the Director of HUD’s Office of Davis-Bacon and Labor Standards seek guidance from the Department of Labor to correct the wage determinations where applicable for the five projects addressed in this report.

We recommend that the Director of HUD’s Office of Davis-Bacon and Labor Standards based on the outcome of recommendation 1A, determine the correct wages to be paid to workers and ensure that appropriate actions are taken to pay the workers.

We recommend that the Director of HUD’s Office of Davis-Bacon and Labor Standards update HUD Handbook 1344.1, REV-2, CHG-2, and Labor Relations Letter No. LR-96-03 to comply with the Department of Labor’s policies and guidance on the application of wage determinations for construction projects.

We recommend that the Director of HUD’s Office of Davis-Bacon and Labor Standards develop and implement controls to ensure that the appropriate Davis-Bacon wage rate determinations are implemented in the contracts of FHA-insured multifamily construction projects that require multiple wage determinations, including the requirement that contract specifications clearly identify the portions of the contract subject to each assigned wage determination, and that adequate documentation to support wage determinations is maintained.

Take appropriate actions to prioritize the need for resources necessary to ensure that HUD fully implements the remaining four responsibilities as required by sections 759(a)(1), 759(a)(2), 759(a)(4), and 759(a)(5) of the Geospatial Data Act of 2018.

Deobligate all obligations marked for deobligation during the departmentwide OOR, including as much as $54,909 in 13 administrative obligations marked for deobligation as of September 30, 2018

Deobligate all obligations marked for deobligation during the departmentwide OOR, including as much as $279,282 in 11 administrative obligations marked for deobligation as of September 30, 2017.

Deobligate all obligations marked for deobligation during the departmentwide OOR, including as much as $78,021 in two administrative obligations marked for deobligation as of September 30, 2017.

Complete all steps necessary for an effective evaluation effort.

Work with grant program offices to overcome reporting challenges. Ensure that grant program offices report OMB-requested data. Learn from and leverage results of participating grant programs.

Work with PD&R on an evaluation approach and design for the Promise Zone initiative. Ensure that OFPM has the appropriate resources for its new Communications and Data Analysis Division.