We recommend that HUD require the City to since the property updates have been completed for the 24 program participants that did not receive the green infrastructure training, provide documentation that any subsequent program participants completed the green infrastructure training workshop before the grant agreement is signed and construction begins.

Develop comprehensive guidance and training for grantees on how to prepare the PR 29 report to ensure that the information collected is reliable, accurate, timely, and in compliance with the Uniform Administrative Guidance for Grants and Cooperative Agreements, specifically 2 CFR 200.302(a)(b) and 2 CFR 200.303

Follow up with the four grantees without adequate supporting documentation and assess their compliance with the financial management requirements in 2 CFR 200.302(b)(3), which require the financial management system of each non-Federal entity to provide for records that adequately identify the source and application of funds for federally funded activities.

Update the CPD Monitoring Handbook to incorporate the review of the PR 29 report when performing financial monitoring reviews.

Develop written procedures on how to review PR 29 report submissions and monitor resubmissions, late submissions, and nonsubmissions.

Evaluate and update IDIS to ensure that resubmissions of PR 29 reports are tracked and prior submissions are preserved and correct the system’s misclassification of unsubmitted and uncertified draft PR 29 reports as submitted.

Determine how often grantees’ requests for reimbursement contain cost outside the quarter and in coordination with OCFO, evaluate CPD’s grant accrual methodology and assumptions to ensure that it adequately considers the impact of these late cost reimbursements.

Develop guidance that encourages grantees to draw down funds for reimbursement on a regular schedule, not less than quarterly.

Work with OCFO to ensure that CPD collects and reports to OCFO all of the information needed to properly account for all CPD activities in HUD’s financial statements in accordance with Federal financial reporting requirements and accounting standards.

Update Line 4 - Cash (grant funds) disbursed during the reporting period in the PR 29 report to allow grantees to report all CDBG grant funds disbursed, including funds that have not yet been drawn down from HUD for reimbursement.

Obtain the required approvals under PRA for the PR 29 report.

HUD’s Office of the Chief Financial Officer (OCFO), in coordination with other appropriate program offices, should define and implement a risk-based process to assess and document IT risk management personnel resourcing needs and that those personnel are allocated effectively to support HUD’s risk management program (IG FISMA metric 7).

HUD OCFO, in coordination with other appropriate program offices, should define and implement a process to document and allocate non-personnel risk management resources in a risk-based manner, to include but not limited to funding, processes, and technology (IG FISMA metric 7).

HUD OCIO should implement a process to consistently update and maintain its inventory of software assets and ensure that the inventory is consistent with the automated discovery scans used to perform vulnerability, configurations, and continuous diagnostics and mitigation scans and use this inventory to consistently remove unauthorized software assets from the HUD network (IG FISMA metrics 2, 20, and 21).

HUD OCIO should in coordination with the Chief Risk Officer (CRO), document cybersecurity risk management roles and responsibilities in a consolidated list and; define procedures to hold personnel accountable to their assigned roles in the consolidated list (IG FISMA metric 7)

HUD OCIO should consistently implement personnel accountability procedures to ensure that assigned cybersecurity risk management roles are being performed in an effective manner (IG FISMA metric 7).

HUD OCIO should define and implement metrics to monitor the effectiveness of ICAM program activities and assist in identifying areas for improvement (IG FISMA metric 26).

HUD OCIO should develop a comprehensive ICAM policy, strategy, process, and technology solution roadmap, including milestones, budget estimates, and appropriate technology solution details (IG FISMA metric 27). This recommendation replaces FY 2020 FISMA recommendation 11.

HUD OCIO should define policies and guidance for the use of system-specific access agreements (IG FISMA metric 29).

HUD OCIO should develop a plan that includes milestones and funding requirements for implementing phishing-resistant MFA for all users in alignment with Federal requirements (IG FISMA metrics 30 and 31).