The Federal Information Security Modernization Act of 2014 (FISMA) directs Inspectors General to conduct an annual evaluation of the agency information security program.  FISMA, Department of Homeland Security (DHS), Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) establish information technology (IT) security guidance and standards for Federal agencies. We conducted this evaluation to…

The Federal Information Security Modernization Act of 2014 (FISMA) requires all federal agencies to conduct independent security technical verification testing on a sampling of information systems annually.  In conjunction with our fiscal year 2021 FISMA evaluation (2021-OE-0001), we conducted a targeted security testing assessment of sample systems that resulted in a Topic Brief.  The objective of this application vulnerability…

We reviewed the U.S. Department of Housing and Urban Development’s (HUD) ability to effectively complete information technology (IT) acquisitions.  HUD’s IT systems and its modernization plans depend heavily on contractors, yet HUD has historically faced significant challenges with implementing effective acquisition processes. Therefore, HUD’s acquisition capacity represents a key potential risk within HUD’s IT environment. We found…

HUD does not have a departmentwide policy for dealing with radon contamination.  Instead, HUD relies on each program office to develop radon policies that align with HUD’s environmental regulations.  The three program offices reviewed do not have consistent radon policies.  Only Multifamily’s radon policy includes radon testing and mitigation requirements.  PIH’s policy strongly encourages but does not require public housing agencies (…

In violation of the housing assistance payment contract’s conflict-of-interest requirements, the former executive director of the Housing Authority of the City of Beeville, TX, executed housing assistance payment contracts on behalf of the Authority with her brother and sister.  The former executive director did not fully disclose the conflicts-of-interest and had not sought a waiver from HUD’s Office of Public and Indian Housing until…

We reviewed the Malakoff Housing Authority, Malakoff, TX. The review was part of a joint initiative between the HUD Office of Inspector General’s Office of Audit and Office of Investigation. We completed the review and referred the former executive director’s improper use of Authority funds by hiring and contracting with family members to HUD’s Office of Program Enforcement for action under the Program Civil Fraud Remedies Act of 1986…