Open Recommendations

HUD OCIO should ensure that external systems, such as cloud systems and cloud service providers, have and maintain configuration management plans that are consistent with HUD's defined configuration management requirements (IG FISMA metric 19).

HUD OCIO should define and implement metrics to monitor the effectiveness of ICAM program activities and assist in identifying areas for improvement (IG FISMA metric 26).

HUD OCIO should develop a comprehensive ICAM policy, strategy, process, and technology solution roadmap, including milestones, budget estimates, and appropriate technology solution details (IG FISMA metric 27). This recommendation replaces FY 2020 FISMA recommendation 11.

HUD OCIO should define policies and guidance for the use of system-specific access agreements (IG FISMA metric 29).

HUD OCIO should develop a plan that includes milestones and funding requirements for implementing phishing-resistant MFA for all users in alignment with Federal requirements (IG FISMA metrics 30 and 31).

HUD OCIO, in coordination with other appropriate HUD offices, should define and communicate policies and procedures for use of MFA at HUD facilities (IG FISMA metrics 30 and 31).

HUD OCIO should define a plan to meet the logging requirements at all event logging maturity levels (basic, intermediate, advanced) in accordance with OMB M-21-31. This plan should include logging sufficient to allow for reviewing privileged user activities (IG FISMA metrics 32 and 54).

HUD OCIO should develop and implement monitoring and enforcement procedures to ensure that non-GFE devices (for example, BYOD), such as those owned by contractors or HUD employees, are either: (a) prohibited from connecting to the HUD network; or (b) properly authorized and configured before connection to the HUD network (IG FISMA metrics 2, 21, and 33).

HUD OCIO should develop and implement procedures and contract terms to enforce forfeiture of non-GFE devices (for example, BYOD), to allow for analysis when security incidents occur (IG FISMA metrics 33 and 55).

HUD OCIO should define a process and assign responsibility to evaluate the effectiveness of its incident response technologies and adjust configurations and toolsets to improve the incident response program (IG FISMA metric 58).

HUD OCIO should update its enterprisewide business impact prioritization analysis procedures to include system dependencies and the characterization of system components (IG FISMA metric 61).

Update the EAC Procurement Handbook to reflect current requirements in the Federal Acquisition Regulation.

Complete contractor performance evaluations for all nonexpired internal contracts.

Record the required procurement information for all nonexpired internal contracts in the Federal Procurement Data System.

Implement a process to ensure timely and accurate reporting of contractual obligations to the Federal Procurement Data System.

Some or all of the recommendation is not publicly available due to concerns with information protected under the Freedom of Information Act.

Some or all of the recommendation is not publicly available due to concerns with information protected under the Freedom of Information Act.

Some or all of the recommendation is not publicly available due to concerns with information protected under the Freedom of Information Act.

Some or all of the recommendation is not publicly available due to concerns with information protected under the Freedom of Information Act.

Some or all of the recommendation is not publicly available due to concerns with information protected under the Freedom of Information Act.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the PuertoRico DOE to reallocate the $2.5 million in unallowable indirect costs charged to the Restart program grant.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Puerto Rico DOE to ensure that a purchasing officer assesses whether equipment purchases should be capitalized using the requirements established in 2 C.F.R. 200.1, the Department’s indirect costs agreements, and Regulation 11 “Basic Rules for the Control and Accounting of Fixed Assets,” (December 2005)

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Puerto Rico DOE to complete its process of identifying schools in need of technology equipment and redistribute the 215 technology equipment devices as appropriate

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Puerto Rico DOE to work with school staff and teachers to find the 21 technology equipment devices that are missing and follow the procedures in the Mobile Devices Management Guide to report the missing equipment to the police, if necessary.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Puerto Rico DOE to review and update written policies and procedures for the management of fixed assets and mobile equipment devices to ensure that educational regional offices and schools properly manage surplus technology equipment.