Federal Reports

Although the Department had several notable improvements in implementing its cybersecurity initiatives, its overall IT security programs and practices were not effective in all of the five security functions. We had findings in all eight metric domains, which included findings with the same or similar conditions identified in prior reports. Specifically, we found that the Department can strengthen its controls in areas such as - (1) Risk Management. Remediation process for its Plan of Action and Milestones; enterprise supply chain assessment strategy; IT inventory reporting; and required IT security clauses for its contracts: (2) Configuration Management. Use of unsecure connections and appropriateapplication connection protocols; and reliance on unsupported operating systems, databases, and applications in its production environments:(3) Identify and Access Management. Removing access of terminated users to the Department’s network and database management: and(4) Incident Response. Timely reporting of incidents; and ensuring data loss prevention tools work accordingly. Until the Department improves in these areas, it cannot ensure that its overall information security program adequately protects its systems and resources fromcompromise and loss.

Features of the April 1– September 30, 2020 Semi-Annual report include: • A letter from the Special Inspector General on the Emergency Economic Stability Act and impacts as a result of COVID-19.o Through EESA’s valuable programs, underemployed and unemployed American’s can stay in their homes. • An Overview of the SIGTARP’s oversight of Making Home Affordable, including the Home Affordable Modification Program. o With the expiration of the foreclosure moratorium in the CARES Act, HAMP continues to prevent foreclosures for the more than 700,000 participants who live in all 50 states.• An overview of SIGTARP’s oversight of the Hardest Hit Fund.o HHF was extended to assist those impacted by the pandemic. During the past six-months states have seen significant increases in applications. There is currently more than $492 million still available to help homeowners.• An overview of the SIGTARP’s oversight of bank and TARP investment programs.o EESA programs for troubled assets (or TARP ‘bailout’) are largely closed after a decade. There are TARP securities in two banks and three credit unions. SIGTARP investigations have resulted in 450 criminal charges issued.

This report was submitted to the Comptroller General in accordance with Section 5 of the Government Accountability Office Act of 2008. The report summarizes the activities of the Office of Inspector General (OIG) for the six-month reporting period ending September 30, 2020. During the reporting period, the OIG issued two audit reports, closed four investigations and initiated two additional investigations. The OIG processed 56 hotline complaints, many of which were referred to other OIGs for action because the matters involved were within their jurisdictions. The OIG also initiated five proactive inquiries based upon traditional areas of vulnerability that cut across agencies and core administrative functions and closed two inquiries.The OIG remained active in the GAO and OIG communities by briefing new GAO employees on its audit and investigative missions, and participating in committees and working groups of the Council of Inspectors General on Integrity and Efficiency, including those related to the Pandemic Response Accountability Committee. Details of these activities and other accomplishments are provided in the report.