Collaborate with ONDCP to determine the necessary adjustments to the CoC reporting methodology that ensures HUD reports annual numeric targets and actuals to ONDCP by the required November 1 due date.

Collaborate with ONDCP to determine the necessary adjustments to the RHP reporting methodology that ensures HUD reports numeric targets to ONDCP by the required November 1 due date.

We recommend that HUD’s General Deputy Assistant Secretary for Community Planning and Development implement training on civil rights monitoring reviews. Additionally, CPD should ensure that training on civil rights monitoring reviews is regularly provided to CPD staff.

We recommend that HUD’s General Deputy Assistant Secretary for Community Planning and Development implement updated guidance and protocols for monitoring civil rights compliance and require CPD staff to incorporate civil rights monitoring into the risk analysis process.

We recommend that HUD’s General Deputy Assistant Secretary for Community Planning and Development develop guidance clarifying the use of the exhibit for on-site, hybrid, and remote monitoring to ensure a full review of grantees’ compliance with civil rights requirements, and incorporate this guidance into the training developed as a result of recommendation 1A.

We recommend that the Director of CPD’s Office of Disaster Recovery require active disaster recovery grantees to report in DRGR other sources of funding used for non-Federal match activities.

We recommend that the Director of CPD’s Office of Disaster Recovery develop and implement internal controls to ensure that grantees completely and accurately report non-Federal match activities in DRGR.

We recommend that HUD work with Connecticut and Shelby County to fully realize the program benefits by (1) assessing whether any of the current project activities need to be replaced with more viable project activities, thereby ensuring that any modifications to the project activities will lessen the susceptibility of rain and flood events; (2) assessing whether administrative funds have been properly allocated and charged to identify any possible cost savings; (3) determining whether enough administrative funds or other available funds exist to complete the administration of the grant project activities; and (4) developing and implementing a written plan of action that will assist with expediting the project activities that could reasonably be expected to be completed by the September 30, 2029, deadline.

We recommend that HUD conduct onsite or remote monitoring for the City of Minot and Tennessee, which have not had any monitoring since grant inception, to ensure that these grantees are on track to meet their program goals.

We recommend that HUD for grantees with delayed project activities (California, Connecticut, Louisiana, Tennessee, Virginia, New York City, Minot, and Shelby County), require each grantee to provide a detailed timeline with milestone dates of when projects should be completed and provide updates to ensure that grantees stay on schedule.

We recommend that HUD for its disaster-related program wide activities, revise the action plan and quarterly performance review checklists to a format that more specifically and directly addresses the subject program.

We recommend that HUD for its disaster-related program wide activities, require grantees to provide documentation showing that they have upfront collaboration with partnering entities in executing the grant program. If the grantee plans to hire contractors, HUD should ensure that grantees have a plan to quickly onboard contractors early in the program.

HUD OCIO should identify needs to address Federal requirements by performing a gap analysis on its zero trust architecture strategic plan.

HUD OCIO should establish a zero trust architecture implementation plan that includes milestones and resources to address all zero trust pillars.

HUD OCIO should develop system policies and procedures for dynamic access controls that include just-in-time and just-enough access tailored to individual actions and individual resource needs.

HUD OCIO should capture risks that are associated with zero trust architecture implementation and document these risks in its risk register.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.