In April 2024, HUD OIG met with HUD OCIO to discuss progress and requirements for closure of this recommendation. In addition, OIG reviewed this recommendation as part of the annual FY 2024 FISMA evaluation in April 2024 and learned from HUD OCIO that that there would be a procedure update that would implement the ingestion and monitoring of all inbound and outbound traffic. The OIG requested to be provided with these procedures when finalized and evidence of implementation on May 1, 2024.

Corrective Action Taken

HUD OCIO updated its Cybersecurity Incident Response Plan and developed more detection and protection mechanisms to monitor network traffic in its IT environment. These mechanisms include anti-malware agents, data loss prevention, endpoint detection and response, firewalls, and intrusion detection and prevention systems. HUD’s SOC also developed standard operating procedures and playbooks for abnormal traffic alerts triggered by the above tools that are posted internally for SOC personnel to utilize. Addressing this recommendation resulted in improvement of HUD’s networking monitoring process by enhancing visibility into network traffic. It also increased HUD’s incident response program capabilities by ensuring that HUD has a plan to monitor traffic and better detect and respond to security incidents. As part of our regular Federal Information Security Act of 2014 (FISMA) assessments, HUD OIG will continue to assess HUD’s incident response effectiveness and threat detection to ensure HUD addresses new and evolving threats.

Ensure that its staff appropriately determines exemptions from the Lead Safe Housing Rule and documents support of the determinations.

Ensure that its staff determines whether a child under 6 years of age resides in an exempted development. If a child is determined to reside in an exempted development take appropriate actions in accordance with its internal policies

Corrective Action Taken

The Office of Field Operations (OFO) updated the Lead-Based Paint Response Tracker’s Standard Protocol and Roles and Responsibilities to identify the roles and responsibilities of HUD’s headquarters and field office level staff in ensuring PHAs’ compliance with the Lead Safe Housing Rule (LSHR). The protocol provides that the OFO field office staff work directly with PHAs to resolve issues of noncompliance with the LSHR and other Lead-based paint (LBP) guidance by responding to or escalating questions/issues to the headquarters team, directing PHAs to available training and resources on HUD.gov or HUD Exchange, and working with PHAs to obtain sufficient documentation to close an LBP case in the LBP tracker promptly. In regards to a child under 6 years of age residing in an exempted development, staff from the field offices must upload supporting documentation determining whether a pregnant lady or child six years old or younger lives in the development, collect missing information, if applicable, coordinate with OFO team to close cases in the LBP response tracker, indicate in the LBP response tracker if the PHA has provided the documents or if the property is exempt and upload supporting documents.

Require lenders to obtain the borrowers’ consent to verify the existence of delinquent Federal taxes with the IRS during loan origination and deny any applicant with delinquent Federal tax debt and no payment plan or a noncompliant payment plan or an applicant refusing to provide consent from receiving FHA insurance to put at least $6.1 billion to better use by avoiding potential future costs to the FHA insurance fund.

Implement a change to regulations at 24 CFR Part 203 to require curtailment of preforeclosure interest and other costs that are caused by lender servicing delays, resulting in $413,513,975 in funds to be put to better use. This should include updating or seeking statutory authority to update HUD’s regulations as necessary and coordinating with HUD’s Office of Finance and Budget, well before any changes go through departmental clearance, to ensure that planned curtailment requirements can be consistently enforced through the claims process.

Develop a method for using the Do Not Pay portal during the underwriting process to identify delinquent child support and delinquent Federal debt to prevent future FHA loans to ineligible borrowers to put $1.9 billion to better use.

Enforce the requirement for all HUD web applications and services to be approved by the CIO and ensure OCIO reviews and approves all IT contracts and services agreements dealing with creation or support of web applications or services.

Issue a change to regulations at 24 CFR Part 203, which would avoid unnecessary costs to the FHA insurance fund, allowing an estimated $2.23 billion to be put to better use. These changes include (1) a maximum period for filing insurance claims and (2) disallowance of expenses incurred beyond established timeframes.

Update selection rules for CAIVRS to provide for complete reporting of all ineligible borrowers to put $9.5 million to better use.