Open Recommendations

(U) Rec. 2.n: The DoD OIG recommended that the U.S. Special Operations Command Director for Command, Control, Communications and Computer/Cyber, Chief Information Officer Implement a cyber incident response plan and controls to ensure \that the plan is reviewed and approved annually.

(U) Rec. 3.a: The DoD OIG recommended that the Director of the Defense Information Systems Agency's Joint Enterprise Services Directorate update inventory records for all classified mobile devices to include information for the six elements required in an accountable property system of record.

(U) Rec. 3.b: The DoD OIG recommended that the Director of the Defense Information Systems Agency's Joint Enterprise Services Directorate develop and implement a process to ensure inventories are conducted periodically and records are updated in a timely manner; immediately reconcile all issued and on-site classified mobile devices; update inventory records; and take appropriate action if you are unable to properly reconcile a classified mobile device.

(U) Rec. 3.c: Report is Classified.

(U) Rec. 3.d: Report is Classified.

(U) Rec. 3.e: The DoD OIG recommended that the Director of the Defense Information Systems Agency's Joint Enterprise Services Directorate immediately revalidate and document the user justification for the devices and recall the device if the user no longer has a valid mission need, revise existing access policies to require detailed written justifications for obtaining classified mobile devices, and establish processes to periodically, at least annually, revalidate the need for continued access to the devices.

(U) Rec. 3.f: Report is Classified.

(U) Rec. 3.g: Report is Classified.

(U) Rec. 3.h: The DoD OIG recommended that the Director of the Defense Information Systems Agency's Joint Enterprise Services Directorate revise existing or develop new classified mobile device training programs that include information on all 23 Office of the Secretary of Defense memorandum requirements.

(U) Rec. 3.i: The DoD OIG recommended that the Director of the Defense Information Systems Agency's Joint Enterprise Services Directorate provide all existing classified mobile device users with the updated training that includes all 23 Office of the Secretary of Defense memorandum requirements.

(U) Rec. 3.j: The DoD OIG recommended that the Director of the Defense Information Systems Agency's Joint Enterprise Services Directorate establish a mechanism to track the status of all classified mobile device user agreements and ensure that all users have acknowledged the most recent version of the user agreement.

(U) Rec. 3.k: The DoD OIG recommended that the Director of the Defense Information Systems Agency's Joint Enterprise Services Directorate develop and implement procedures for retaining signed classified mobile device user agreements.

(U) Rec. 3.l: Report is Classified.

(U) Rec. 3.m: Report is Classified.

(U) Rec. 4: Report is Classified.

(U) Rec. 5: Report is Classified.

Review and clarify for all stakeholders the roles, responsibilities, and lines of authority and decision-making for each stage of the program and update program documentation accordingly.

Prioritize filling key senior management vacancies as soon as practical. In addition, prioritize filling key program team vacancies, as appropriate, including those requested for FY 2025.

Update the program’s risk register to include contingency plans for high impact risks.

Establish and implement a method to track the amount of CALR S&E funds expended separately from other IIJA NFS S&E funds.

HUD OCIO should identify needs to address Federal requirements by performing a gap analysis on its zero trust architecture strategic plan.

HUD OCIO should establish a zero trust architecture implementation plan that includes milestones and resources to address all zero trust pillars.

The CDO should coordinate with HUD's Records Office, Privacy Office, and program offices to develop data policies and procedures for data inventory, categorization, and labeling in support of zero trust architecture.

Status

HUD is working on a plan to address the recommendation. HUD OIG anticipates receiving a corrective action plan no later than April 11, 2025, with a plan for resolving this recommendation.

Analysis

HUD OCIO should develop system policies and procedures for dynamic access controls that include just-in-time and just-enough access tailored to individual actions and individual resource needs.

HUD's Privacy Office should require program offices to periodically review systems in all environments (testing, development, production) for unnecessary disclosure of personally identifiable information (PII).