HUD Addressed Multifamily Mortgage Application Processing Delays, but Additional Action Is Needed To Better Manage Future Backlogs
Update policies and procedures to include methods that will be used when applications exceed underwriter capacity, align intake and screening processes, and explain when timeframes will be enforced, including in PLUS.
HUD Addressed Multifamily Mortgage Application Processing Delays, but Additional Action Is Needed To Better Manage Future Backlogs
Issue an industry wide letter to reinforce how intake, screening, and enforcement of timeframes will be handled.
The Housing Authority of the City of Los Angeles, Los Angeles, CA, Did Not Adequately Manage Lead-Based Paint in Its Public Housing Units
Implement procedures and controls to ensure that visual assessments for lead-based paint are completed at least every 12 months.
The Housing Authority of the City of Los Angeles, Los Angeles, CA, Did Not Adequately Manage Lead-Based Paint in Its Public Housing Units
Implement procedures and controls to ensure that risk assessments and reevaluations are conducted in accordance with HUD’s requirements.
The Housing Authority of the City of Los Angeles, Los Angeles, CA, Did Not Adequately Manage Lead-Based Paint in Its Public Housing Units
Obtain lead-based paint risk assessments for the five developments for which hazard reduction work was completed and perform the required reevaluations.
The Housing Authority of the City of Los Angeles, Los Angeles, CA, Did Not Adequately Manage Lead-Based Paint in Its Public Housing Units
Determine whether the remaining five developments (Imperial Courts, Mar Vista Gardens, Nickerson Gardens, Ramona Gardens, and Rancho San Pedro) have deteriorated paint and if so, obtain lead-based paint risk assessments and reevaluations when applicable.
The Housing Authority of the City of Los Angeles, Los Angeles, CA, Did Not Adequately Manage Lead-Based Paint in Its Public Housing Units
Coordinate with HUD’s Office of Lead Hazard Control and Healthy Homes to obtain training for the Authority’s employees responsible for managing lead-based paint on the management of lead-based paint, including the requirements for visual assessments, risk assessments, reevaluations, and hazard reduction.
FY 2023 FISMA
HUD OCIO should implement a process to consistently update and maintain its inventory of hardware assets and ensure that the inventory is consistent with the automated discovery scans used to perform vulnerability, configurations, and continuous diagnostics and mitigation scans and use this inventory to consistently remove unauthorized hardware assets from the HUD network (IG FISMA metrics 2, 20, and 21).
FY 2023 FISMA
HUD OCIO should report at least 80 percent of its government-furnished equipment through the DHS CDM program (IG FISMA metric 2).
FY 2023 FISMA
HUD OCIO should implement a process to consistently update and maintain its inventory of software assets and ensure that the inventory is consistent with the automated discovery scans used to perform vulnerability, configurations, and continuous diagnostics and mitigation scans and use this inventory to consistently remove unauthorized software assets from the HUD network (IG FISMA metrics 2, 20, and 21).
FY 2023 FISMA
HUD OCIO should update its software inventory policies and procedures to account for critical software as defined by EO 14028 (IG FISMA metrics 3 and 21).
FY 2023 FISMA
HUD OCIO should implement policies and procedures to maintain inventories of critical software and software licenses, critical software platforms, and all software installed on critical software platforms (both critical software and noncritical software) and use the inventory of critical software platforms and all software installed on them to ensure that only supported versions of software are used on those critical software platforms (IG…
FY 2023 FISMA
HUD OCIO should in coordination with the Chief Risk Officer (CRO), document cybersecurity risk management roles and responsibilities in a consolidated list and; define procedures to hold personnel accountable to their assigned roles in the consolidated list (IG FISMA metric 7)
FY 2023 FISMA
HUD OCIO should consistently implement personnel accountability procedures to ensure that assigned cybersecurity risk management roles are being performed in an effective manner (IG FISMA metric 7).
FY 2023 FISMA
HUD’s Office of the Chief Financial Officer (OCFO), in coordination with other appropriate program offices, should define and implement a risk-based process to assess and document IT risk management personnel resourcing needs and that those personnel are allocated effectively to support HUD’s risk management program (IG FISMA metric 7).
FY 2023 FISMA
HUD OCFO, in coordination with other appropriate program offices, should define and implement a process to document and allocate non-personnel risk management resources in a risk-based manner, to include but not limited to funding, processes, and technology (IG FISMA metric 7).
FY 2023 FISMA
HUD OCIO should ensure that external systems, such as cloud systems and cloud service providers, have and maintain configuration management plans that are consistent with HUD’s defined configuration management requirements (IG FISMA metric 19).
FY 2023 FISMA
HUD OCIO should define and implement metrics to monitor the effectiveness of ICAM program activities and assist in identifying areas for improvement (IG FISMA metric 26).
FY 2023 FISMA
HUD OCIO should develop a comprehensive ICAM policy, strategy, process, and technology solution roadmap, including milestones, budget estimates, and appropriate technology solution details (IG FISMA metric 27). This recommendation replaces FY 2020 FISMA recommendation 11.
FY 2023 FISMA
HUD OCIO should define policies and guidance for the use of system-specific access agreements (IG FISMA metric 29).