HUD OCIO should develop and implement monitoring and enforcement procedures to ensure that non-GFE devices (for example, BYOD), such as those owned by contractors or HUD employees, are either: (a) prohibited from connecting to the HUD network; or (b) properly authorized and configured before connection to the HUD network (IG FISMA metrics 2, 21, and 33).

HUD OCIO should develop and implement procedures and contract terms to enforce forfeiture of non-GFE devices (for example, BYOD), to allow for analysis when security incidents occur (IG FISMA metrics 33 and 55).

HUD’s Office of Administration, in coordination with OCIO, should update and communicate its PII minimization plan. The plan should include detailed procedures to regularly review and remove unnecessary PII collections in accordance with OMB Circular A-130 (IG FISMA metric 35).

HUD OCIO should develop and implement processes to monitor and analyze qualitative and quantitative performance measures for the effectiveness of its ISCM program (IG FISMA metric 47).

HUD OCIO should define a process and assign responsibility to evaluate the effectiveness of its incident response technologies and adjust configurations and toolsets to improve the incident response program (IG FISMA metric 58).

HUD OCIO should update its enterprisewide business impact prioritization analysis procedures to include system dependencies and the characterization of system components (IG FISMA metric 61).

Develop guidance for the program offices to identify the causes behind high attrition rates in governmentwide high-risk MCOs and field offices in large cities.

Develop guidance for program offices to develop program office-specific action plans to address any causes found for high attrition rates in governmentwide high-risk MCOs and field offices in large cities.

Create a single, unified agency-specific MCO list updated to reflect current progress toward closing skills gaps.

Implement a transparent process for reviewing open-ended exit survey results and sharing those results with ODEEO, as appropriate, and program offices while still protecting former employees’ confidentiality.

Assess what departing employees mean when they indicate that organizational culture is a motivation for leaving HUD.

Determine how to measure the impact of recruitment efforts related to individuals who identiy as Hispanic or Latino.

Implement a process to measure the impact of recruitment efforts related to individuals who identify as Hispanic or Latino.

Implement a process to collect and maintain information about recruitment efforts related to indiviuals who identify as Hispanic or Latino from all HUD program offices and their respective field offices.

Develop and implement adequate controls to ensure that HUD staff with the appropriate level of authority approves extensions to the notices of violation and default cure periods in writing and that documentation is maintained to support such approvals.

Modify the queries used to generate the schedules of properties that accompany the reports to Congress to consider a larger range of dates to ensure that properties that failed consecutive inspections are appropriately identified on all applicable schedules.

Assess and streamline the processes for preparing, reviewing, and approving the reports as appropriate to ensure that the reports are submitted to Congress on or before the required due date.

We recommend that HUD’s Deputy Assistant Secretary for Enforcement require the Commission to update its intake policy and procedure to clarify which inquiries are to be recorded in HEMS.

We recommend that HUD’s Deputy Assistant Secretary for Enforcement require the Commission to develop an internal agency intake training guide, distribute it to all agency housing staff members, and ensure that all intake staff members participate in HUD-approved training related to intake.

We recommend that HUD’s Deputy Assistant Secretary for Enforcement require the Commission to implement a record retention policy to ensure that decisions on inquiries are sufficiently supported.