Fast Facts

The Department of Housing and Urban Development collects huge amounts of sensitive personal information for its housing, community investment, and mortgage loan programs. HUD often shares this information with affiliated agencies; contractors; and state, local, and tribal groups.

HUD isn't taking enough action to protect information exchanged with others. The agency expects external entities to have security and privacy controls for processing, storing, or sharing information outside of HUD systems but hasn't put policies in place to ensure that they protect data.

Our recommendations address the issue to better protect sensitive shared data.

entrance sign at HUD

Skip to Highlights
Highlights

What GAO Found

The Department of Housing and Urban Development (HUD) is not effectively protecting sensitive information exchanged with external entities. Of four leading practices for such oversight, HUD did not address one practice and only minimally addressed the other three in its security and privacy policies and procedures (see table). For example, HUD minimally addressed the first leading practice because its policy required federal agencies and contractors with which it exchanges information to implement risk-based security controls; however, the department did not, among other things, establish a process or mechanism to ensure all external entities complied with security and privacy requirements when processing, storing, or sharing information outside of HUD systems. HUD's weaknesses in the four practices were due largely to a lack of priority given to updating its policies. Until HUD implements the leading practices, it is unlikely that the department will be able to mitigate risks to its programs and program participants.

Extent to Which the Department of Housing and Urban Development (HUD) Policies and Procedures Address Leading Practices for Overseeing the Protection of Sensitive Information

Practice Rating
Require risk-based security and privacy controls
Independently assess implementation of controls
Identify and track corrective actions needed
Monitor progress implementing controls

Legend: ◔=Minimally addressed—leading practice was addressed to a limited extent; ◌=Not addressed—leading practice was not addressed.

Source: GAO analysis of HUD data. | GAO-20-431

HUD was not fully able to identify external entities that process, store, or share sensitive information with its systems used to support housing, community investment, or mortgage loan programs. HUD's data were incomplete and did not provide reliable information about external entities with access to sensitive information from these systems. For example, GAO identified additional external entities in system documentation beyond what HUD reported for 23 of 32 systems. HUD was further limited in its ability to protect sensitive information because it did not track the types of personally identifiable information or other sensitive information shared with external entities that required protection. This occurred, in part, because the department did not have a comprehensive inventory of systems, to include information on external entities. Its policies and procedures also focused primarily on security and privacy for internal systems and lacked specificity about how to ensure that all types of external entities protected information collected, processed, or shared with the department. Until HUD develops sufficient, reliable information about external entities with which program information is shared and the extent to which each entity has access to personally identifiable information and other sensitive information, the department will be limited in its ability to safeguard information about its housing, community investment, and mortgage loan programs.

Why GAO Did This Study

To administer housing, community investment, and mortgage loan programs, HUD collects a vast amount of sensitive personal information and shares it with external entities, including federal agencies, contractors, and state, local, and tribal organizations. In 2016, HUD reported two incidents that compromised sensitive information.

House Report 115-237, referenced by the Consolidated Appropriations Act, 2018, included a provision for GAO to evaluate HUD's information security framework for protecting information within these programs. The objectives were to (1) assess the effectiveness of HUD's policies and procedures for overseeing the security and privacy of sensitive information exchanged with external entities; and (2) determine the extent to which HUD was able to identify external entities that process, store, and share sensitive information with applicable systems. GAO compared HUD's policies and practices for systems' security and privacy to four leading practices identified in federal legislation and guidance. GAO also assessed HUD's practices for identifying external entities with access to sensitive information.

Skip to Recommendations

Recommendations

GAO is making five recommendations to HUD to fully implement the four leading practices and fully identify the extent to which sensitive information is shared with external entities.

HUD did not agree or disagree with the recommendations, but described actions intended to address them.

Recommendations for Executive Action

Agency Affected Recommendation Status
Department of Housing and Urban Development The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require the implementation of risk-based security and privacy controls for external entities that process, store, or share sensitive information with HUD. (Recommendation 1)
Open
HUD did not agree or disagree with the recommendation. In February 2021, HUD reported specific actions planned to address this recommendation. Specifically, the department plans to update policies and procedures, templates for agreements, and contract language in new or updated contracts regarding requirements for implementation of risk-based security and privacy controls for external entities that process, store, or share sensitive information with HUD. In addition, the department intends to develop additional procedures focused on oversight of external entities' compliance with security and privacy requirements. We will continue to monitor the implementation of this recommendation.
Department of Housing and Urban Development The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require independent assessments of external entities that process, store, or share sensitive information with HUD to ensure controls are implemented. (Recommendation 2)
Open
HUD did not agree or disagree with the recommendation. In February 2021, HUD reported plans to address this recommendation by updating its security and privacy policies and templates for agreements to address requirements for independent assessments of external entities that process, store, or share sensitive information with HUD, including requiring approval of agreements by the Chief Information Office, Chief Information Security Office, and system owners. In addition, the department intends to develop additional procedures for overseeing compliance with these requirements. We will continue to monitor the implementation of this recommendation.
Department of Housing and Urban Development The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require identifying and tracking corrective action needed by external entities that process, store, or share sensitive information with HUD. (Recommendation 3)
Open
HUD did not agree or disagree with the recommendation. In February 2021, HUD reported specific plans for addressing this recommendation. Specifically, the department intends to update its templates for agreements and language in new and revised contracts to address requirements for identifying and tracking corrective action needed by external entities that process, store, or share sensitive information with HUD. In addition, the department plans to update its security procedures with requirements for other government, for-profit or nonprofit organizations to plan and manage corrective actions. We will continue to monitor the implementation of this recommendation.
Department of Housing and Urban Development The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require monitoring of progress in implementing controls/corrective actions by external entities that process, store, or share sensitive information with HUD. (Recommendation 4)
Open
HUD did not agree or disagree with the recommendation. In February 2021, HUD reported specific actions planned to address this recommendation. Specifically, the department intends to update the templates for its agreements and establish new procedures to require monitoring of progress in implementing controls/corrective actions by external entities that process, store, or share sensitive information with HUD. We will continue to monitor the implementation of this recommendation.
Department of Housing and Urban Development The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to develop and maintain a comprehensive systems inventory that incorporates sufficient, reliable information about the external entities with which HUD program information is shared and the extent to which each external entity has access to PII and other sensitive information. (Recommendation 5)
Open
HUD did not agree or disagree with the recommendation. In February 2021, HUD reported on specific actions planned for addressing this recommendation. Specifically, the department intends to develop and maintain an inventory of systems that share information with external entities, including sufficient, reliable information about the entities, the information shared, and each entity's level of access. In addition, HUD intends to develop procedures for maintaining the inventory; ensuring that HUD IT officials collect comprehensive information about whether external entities are implementing leading practices and protecting sensitive information; and requiring program offices and system owners to ensure that all types of external entities protect information. We will continue to monitor the implementation of this recommendation.

Full Report

GAO Contacts