Federal Reports

Although the Department had several notable improvements in implementing its cybersecurity initiatives, its overall IT security programs and practices were not effective in all of the five security functions. We had findings in all eight metric domains, which included findings with the same or similar conditions identified in prior reports. Specifically, we found that the Department can strengthen its controls in areas such as - (1) Risk Management. Remediation process for its Plan of Action and Milestones; enterprise supply chain assessment strategy; IT inventory reporting; and required IT security clauses for its contracts: (2) Configuration Management. Use of unsecure connections and appropriateapplication connection protocols; and reliance on unsupported operating systems, databases, and applications in its production environments:(3) Identify and Access Management. Removing access of terminated users to the Department’s network and database management: and(4) Incident Response. Timely reporting of incidents; and ensuring data loss prevention tools work accordingly. Until the Department improves in these areas, it cannot ensure that its overall information security program adequately protects its systems and resources fromcompromise and loss.

Features of the April 1– September 30, 2020 Semi-Annual report include: • A letter from the Special Inspector General on the Emergency Economic Stability Act and impacts as a result of COVID-19.o Through EESA’s valuable programs, underemployed and unemployed American’s can stay in their homes. • An Overview of the SIGTARP’s oversight of Making Home Affordable, including the Home Affordable Modification Program. o With the expiration of the foreclosure moratorium in the CARES Act, HAMP continues to prevent foreclosures for the more than 700,000 participants who live in all 50 states.• An overview of SIGTARP’s oversight of the Hardest Hit Fund.o HHF was extended to assist those impacted by the pandemic. During the past six-months states have seen significant increases in applications. There is currently more than $492 million still available to help homeowners.• An overview of the SIGTARP’s oversight of bank and TARP investment programs.o EESA programs for troubled assets (or TARP ‘bailout’) are largely closed after a decade. There are TARP securities in two banks and three credit unions. SIGTARP investigations have resulted in 450 criminal charges issued.