Open Recommendations

Enhance operational vulnerability and software patch management procedures to ensure vulnerabilities that cannot be patched, such as configuration weaknesses and unsupported software, are investigated and resolved in a timely manner, or implement a risk acceptance or POA&Ms process.

Update the vulnerability remediation process, including monitoring corrective actions for vulnerabilities identified during the scanning process, monitoring vendor patch releases and end-of-life notifications, and monitoring patching tools to ensure patches are applied, as intended.

Enhance operational vulnerability management procedures to ensure vulnerabilities that cannot be patched, such as configuration weaknesses and unsupported software, are investigated and resolved in a timely manner.

Identify all servers, workstations, and networked devices within the WARS boundary that are necessary for its successful operation. Remove any unnecessary assets, update system documentation to include relevant details, monitor the WARS for future changes, and maintain an accurate asset list.

Upgrade or replace unsupported software and install the latest security updates/patches for all servers, workstations, and networked devices within the system boundary.

Develop and implement monitoring procedures to identify trends in sole-source purchasing. This could include (1) determining the specific reports that will be used for monitoring sole-source purchase orders, (2) establishing the frequency of the reports, and (3) identifying a list of individual directors and management officials who will receive reports. In addition, develop clear guidelines on what constitutes discrepancies and how they are identified, addressed, documented, and retained for future reference.

We recommend that HUD require the City to reassess the eight infrastructure projects still in the design or planning phase to determine whether the City can complete the projects or how the remaining funds could be best used within the 6 years remaining for the grant period to ensure that the City is protected from future storm and rain events.

We recommend that HUD require the City to for the $14,683,335 originally budgeted for the Milneburg and Microgrid projects, work with HUD to (1) determine whether its planned action plan amendment would constitute the need to submit a substantial action plan amendment, (2) ensure that any modifications in its action plan amendment would lessen the susceptibility of rain and flood events within the Gentilly area, and (3) require that any activities pursued under the action plan amendment could reasonably be expected to be completed by the September 30, 2029, deadline.

We recommend that HUD require the City to review the number and type of positions for its National Disaster Resilience staff that are responsible for the oversight and completion of infrastructure projects and ensure that it has the appropriate staffing levels to complete adequate monitoring and oversight of the projects.

We recommend that HUD require the City to revise its risk assessment plan and process to ensure that monitoring is regularly conducted for its infrastructure projects through project completion, including establishing a monitoring schedule to ensure the progression and completion of the infrastructure projects.

We recommend that HUD require the City to develop and submit to HUD for approval an updated planning and administration budget and staffing plan, after reassessing the infrastructure projects in recommendation 1A, to complete the National Disaster Resilience projects with the funds and within the timeframe remaining.

We recommend that HUD require the City to analyze the method used to charge planning and administration costs to ensure that all costs are applied to the correct costs category and are valid charges to the National Disaster Resilience grant.

We recommend that HUD require the City to review misallocated planning and administration funds and reallocate any mistakenly allocated funds to the correct National Disaster Resilience project or grant activity. This measure could make available additional funds for program oversight.

We recommend that HUD require the City to develop a plan for how the City will continue to fulfill the required monitoring and oversight responsibilities of the National Disaster Resilience programs and projects if it runs out of planning and administration funds before it completes these programs and projects.

We recommend that HUD require the City to provide monitoring reports and supporting documentation to show that it conducted periodic monitoring of NORA' s performance and compliance with program rules and regulations and ensured that NORA promptly remedies any findings or concerns. This includes, but is not limited to, ensuring that NORA (1) provides adequate oversight of the contractors providing service under the program and (2) maintains documentation to support eligibility for program participants.

We recommend that HUD require the City to develop and implement a methodology for NORA to conduct periodic evaluations at appropriate points during the construction process to assess the quality of the work on all new properties and correct any issues identified.

We recommend that HUD require the City to develop and implement a plan for how to review the condition of the property updates and determine where repairs are needed.

We recommend that HUD require the City to analyze the effectiveness of the Retrofit program and identify what improvements are needed to better benefit program participants and lessen their burden, to include obtaining input from program participants, and implement those improvements.

We recommend that HUD require the City to support or repay, from nonfederal funds, $5,078 in the square footage overcharge for work not completed, according to the project design and invoice documentation.

We recommend that HUD require the City to provide supporting documentation for the 4 program participants that did not have adequate income documentation. If the supporting documentation cannot be provided, repay, from nonfederal funds, $99,347.

We recommend that HUD require the City to since the property updates have been completed for the 24 program participants that did not receive the green infrastructure training, provide documentation that any subsequent program participants completed the green infrastructure training workshop before the grant agreement is signed and construction begins.

Complete the implementation of an automated solution to help ensure a complete and accurate inventory of software assets.

Define a required frequency for updating the system inventory and implement a quality control process to validate that system inventories are updated in a timely manner.

Update existing policy and procedures to ensure plans of action and milestones are closed only after the planned corrective actions and milestones have been implemented.

Review the Enterprise Risk Management Framework Guide annually and update if needed.