Open Recommendations

Sensitive

Sensitive

Sensitive

Sensitive

We recommend the Vice President, Enterprise Planning, take steps to improve consistency in the capacity plan.

We recommend the Vice President, Enterprise Planning, evaluate the solar cost assumptions in the capacity planning model and take actions as necessary.

We recommend the Vice President, Enterprise Planning, consider aligning the Power Supply Plan Input Schedule with the Power Supply Plan Inputs listed in procedures.

We recommend the Vice President, Enterprise Planning, ensure Power Supply Plan inputs are approved and submitted by designated input providers for inclusion in the Power Supply Plan.

We recommend the Vice President, Enterprise Planning, review, update, and approve the Standard Programs and Processes in the Power Supply Plan process.

We recommend the Vice President, Communications, reinforce the process for engaging strategic business unit/business unit leaders for communication approval.

Revise HUD's Controlled Unclassified Information Policy to include the anti-gag provision.

Revise HUD's Controlled Unclassified Information Policy to state that (a) nondisclosure forms and agreements must include the anti-gag provision as required by law and (b) confidentiality clauses in personnel settlement agreements must include the anti-gag provision if the clause restricts disclosure of any other information beyond the terms and conditions of the agreement itself.

Review whether potential violations of the Antideficiency Act took place because of implementing or enforcing any nondisclosure policies, forms, or agreements that do not include the anti-gag provision as required by law. If it is determined that a violation occurred, the Chief Financial Officer should take disciplinary actions as appropriate and report the identified violations to the oversight authorities, including the HUD Secretary, the President, the Office of Management and Budget, Congress, and the Comptroller General.

Communicate across HUD that (a) HUD employees are required to include the anti-gag provision in nondisclosure policies, forms, and agreements applicable to HUD employees and (b) program offices should consider requiring their employees to request OGC assistance when implementing and enforcing nondisclosure policies, forms, and agreements applicable to HUD employees.

We recommend that the Department of Health and Human Services Office of the Chief Information Officer enforce existing information security continuous monitoring (ISCM) requirements for detecting, preventing, and reporting the installation of unauthorized software across OpDivs referenced in HHS Policy for Information Security and Privacy Protection (IS2P) and enforce the new ISCM policy once approved.

We recommend that the Department of Health and Human Services Office of the Chief Information Officer enforce HHS's continuous monitoring policy for detecting, preventing, and reporting unauthorized or suspicious network activity across OpDivs.

We recommend that the Department of Health and Human Services Office of the Chief Information Officer update the HHS IS2P to require OpDivs to implement NIST 800-53, Revision 5, CA-8 (2) Red Team Exercises at least every 2 years and RA-10 Threat Hunting yearly for high and moderate Federal Information Processing Standards Publication 199 impact systems.

Review and clarify for all stakeholders the roles, responsibilities, and lines of authority and decision-making for each stage of the program and update program documentation accordingly.

Prioritize filling key senior management vacancies as soon as practical. In addition, prioritize filling key program team vacancies, as appropriate, including those requested for FY 2025.

Update the program’s risk register to include contingency plans for high impact risks.

Establish and implement a method to track the amount of CALR S&E funds expended separately from other IIJA NFS S&E funds.

The CDO should coordinate with HUD's Records Office, Privacy Office, and program offices to develop data policies and procedures for data inventory, categorization, and labeling in support of zero trust architecture.

Status

HUD is working on a plan to address the recommendation. HUD OIG anticipates receiving a corrective action plan no later than April 11, 2025, with a plan for resolving this recommendation.

Analysis

HUD OCIO should develop system policies and procedures for dynamic access controls that include just-in-time and just-enough access tailored to individual actions and individual resource needs.

HUD's Privacy Office should require program offices to periodically review systems in all environments (testing, development, production) for unnecessary disclosure of personally identifiable information (PII).

HUD OCIO should capture risks that are associated with zero trust architecture implementation and document these risks in its risk register.