Federal Reports

We assessed Agency compliance with applicable policy requirements and procedures for the Defense Intelligence Agency’s Military Equal Opportunity Program. We issued the results of our evaluation, along with one recommendation, in a final report dated December 13, 2024.

We obtained the U.S. Department of Housing and Urban Development’s (HUD) two nondisclosure policies and two nondisclosure forms applicable to HUD employees. We also obtained 13 nondisclosure agreements between HUD and HUD employees. The nondisclosure policies, forms, and agreements did not include the anti-gag provision as required by the Whistleblower Protection Enhancement Act (WPEA) of 2012. HUD had not ensured that these nondisclosure policies, forms, and agreements included the anti-gag provision as required by law.

When HUD employees are subject to policies, forms, and agreements that do not include the anti-gag provision as required by law, the employees may be discouraged from exercising their legally protected whistleblower rights. In addition, implementing or enforcing nondisclosure policies, forms, or agreements that do not include the anti-gag provision may be a prohibited personnel practice, and the practice may result in disciplinary action or a civil penalty. It may also be a violation of the Antideficiency Act to use congressionally appropriated funds to implement or enforce nondisclosure policies, forms, and agreements that do not include the anti-gag provision as required by annual appropriations acts. We did not make a determination on whether violations of the Antideficiency Act took place at HUD because the Office of the Chief Financial Officer is responsible for making such determinations.

HUD program offices followed a decentralized process for implementing and enforcing nondisclosure policies, forms, and agreements applicable to HUD employees. However, as part of this decentralized process, the Office of General Counsel and program offices did not ensure that HUD’s nondisclosure policies, forms, and agreements included the anti-gag provision as required by WPEA. Based on the nondisclosure agreements we reviewed, HUD did not communicate to its employees the legal requirement to include the anti-gag provision in nondisclosure policies, forms, and agreements. Additionally, HUD’s nondisclosure policies did not communicate that HUD employees must include the anti-gag provision in nondisclosure forms and agreements.

WPEA requires agencies that have a nondisclosure policy, form, or agreement to post the anti-gag provision on the agency website, accompanied by the list of Executive orders and statutory provisions that are controlling in case of a conflict. On October 15, 2024, in response to our evaluation, HUD posted this information on its website.

We provided HUD with six recommendations to ensure HUD’s compliance with the legal requirement to include the anti-gag provision in its nondisclosure policies, forms, and agreements. Because we received and agreed with the Office of the Chief Administrative Officer’s proposed management decision, the status of recommendations 1 and 2 is “resolved-open.” The status of recommendations 3, 4, 5, and 6 will remain “unresolved-open” until we agree to the proposed management decisions from Office of the Chief Financial Officer, OGC, and the Government National Mortgage Association (Ginnie Mae).

The OIG evaluated the U.S. Department of Housing and Urban Development’s (HUD) progress in applying zero trust security principles to protect personally identifiable information (PII). HUD maintained a significant number of records that contain PII with limited zero trust controls in place to secure these data. In FY 2022, HUD established a zero trust implementation plan to help the agency address the five zero trust pillars established by CISA; however, by FY 2024, HUD had made limited progress in the initiatives established in its plan. In FY 2024, HUD began to implement some technical controls to support identity pillar functions but lacked overall direction and a clear plan to make significant zero trust progress. HUD did not have an automated process to inventory or categorize data, which restricted its visibility into its PII. HUD monitored its information technology (IT) and cybersecurity risks through its OCIO risk register process; However, the register did not contain specific ZTA implementation risks. HUD did not ensure that systems applied granular access controls, including access tailored to individual actions and individual resource needs. Lastly, agencies were required to fully implement multifactor authentication (MFA) by November 2021 and phishing-resistant MFA for external users by January 2023. As of May 2024, HUD had begun phishing-resistant MFA implementation for just one of its authentication systems. We issued six recommendations to improve HUD’s management of PII in a zero trust environment.