Implement procedures to periodically review RPA system access and remove access for users that are not authorized or no longer have a need to use the system.

Implement procedures to ensure that attended bots use the security rights and credentials of the attending user.

Research, evaluate, and implement technical or alternative solutions to deploy essential computer software updates using appropriate secure methods to ensure that computer security updates occur in a timely manner to minimize risk to HUD’s systems and operations

Research, evaluate, and implement technical solutions to provide additional improvements to VPN and related remote working capabilities of HUD system users.

Perform routine VPN stress tests as part of its contingency planning and testing processes to regularly identify and remediate network performance issues and ensure that network capabilities are sufficient for teleworking.

Research, evaluate, and implement technical solutions to resolve the user account management issues and the underlying issue in the technical environment.

Assess its help desk system against other technical solutions and ensure that the help desk solution used captures complete data on technical support requests. This measure includes but is not limited to ensuring that sequence gaps are properly documented or do not occur, valid transactions are accepted by the help desk system, rejected transactions are identified, and the history of each transaction is retained.

Consider conducting an analysis of staffing resources needed to manage the REO and notes sales on tribal trust properties program and adjust staffing accordingly.

In conjunction with corrective actions being taken on previous audits, revise ONAP’s internal policy and procedures to include detailed written policies and procedures for the marketing, preservation, and sale of defaulted loan notes and REO properties on tribal trust and other restricted lands.

Work with the Office of the Chief Information Officer to develop an electronic solution, such as a new module in Native Advantage or one similar to FHA’s P260 tracking system, to track the sale of defaulted loan notes and REO properties on tribal trust and other restricted lands. While the solution is being developed, HUD should put controls into place to ensure that manual systems used to track defaulted loans and REO properties are complete and accurate.

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to develop and implement a plan to manage lead-based paint and lead-based paint hazards in public housing.

Requires the REAC in coordination with OFO to determine the number of developments and associated units that contain lead-based paint and lead-based paint hazards.

Status

In May 2023, HUD published a final rule establishing a new approach to defining and assessing housing quality: The National Standards for the Physical Inspection of Real Estate. Public Housing regulations were amended, and Public Housing program participants were required to comply with this final rule and use the NSPIRE standards starting July 1, 2023. The Real Estate Assessment Center and Office of Field Operations will collaborate with the Office of Lead Hazard Control and Healthy Homes, the Office of Policy Development and Research, and a statistician to evaluate data collected under the NSPIRE inspection program to estimate the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards. As of November 2024, PIH reported that inspections have had a slow start due to procurement delays. Additionally, the NSPIRE system did not get the requested functionality to collect lead inspections. The final action target date is March 31, 2025.

Analysis

To address this recommendation, HUD will need to provide evidence that it collected and evaluated data under NSPIRE and estimated the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards.

Implementation of this recommendation will assist HUD in working with PHAs to address the public housing units that contain lead-based paint and lead-based paint hazards and help HUD’s oversight of units in need of hazard reduction.

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to determine the cost to eliminate or control the lead-based paint and lead based paint hazards in public housing and the timeframe to complete such work based on the existing funding levels and strategies that could accelerate the timeframe.

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to implement adequate procedures and controls to ensure that public housing agencies appropriately identify and control lead-based paint and eliminate lead-based paint hazards in public housing.

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to determine whether the public housing agencies identified as having lead-based paint hazards in their housing developments maintain and implement a plan for managing lead-based paint. For any public housing agency that does not have a plan for the management of lead-based paint in its public housing developments, as appropriate, HUD should inform the public housing agency that it should develop and implement its own plan.

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to assess the lead-based paint hazard reduction activities performed at the 19 developments associated with 18 public housing agencies reviewed that did not implement interim controls and ongoing maintenance and reevaluation activities or adequately document that previously identified lead-based paint had been abated or treated with interim controls and subjected to ongoing maintenance and reevaluation activities. If those reduction activities did not fully abate the lead-based paint, HUD should ensure that the public housing agencies implement interim controls and ongoing maintenance and reevaluation programs and maintain required documentation.

HUD OCIO should implement procedures to ensure that information in cybersecurity risk registers is obtained accurately, consistently, and in a reproducible format and is used to a. quantify and aggregate security risks, b. normalize cybersecurity risk information across organizational units, and c. prioritize operational risk response (derived from metric 5).

HUD OCIO and the HUD Chief Risk Officer should coordinate to implement procedures to monitor the effectiveness of cybersecurity risk responses to ensure that risk tolerances are maintained at an appropriate level (derived from metric 5).

HUD OCIO and the Office of Administration should implement procedures to ensure proper validation of media sanitization in accordance with HUD Media Protection Procedures 2.0 (February 2022) and form HUD 1067A, Certification of Sanitization (derived from metric 36).

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.