The Department of Housing and Urban Development collects huge amounts of sensitive personal information for its housing, community investment, and mortgage loan programs. HUD often shares this information with affiliated agencies; contractors; and state, local, and tribal groups. HUD isn't taking enough action to protect information exchanged with others. The agency expects external entities to ha...

Federal agencies are increasingly using cloud computing services. Cloud computing offers benefits but also poses cybersecurity risks. OMB requires agencies to use the Federal Risk and Authorization Management Program to authorize their use of cloud services. Although agencies increased their program use—authorizations were up 137% from 2017 to 2019—15 of the 24 agencies we surveyed reported t...

As required by the Federal Cybersecurity Workforce Assessment Act of 2015 (act), the Office of Personnel Management (OPM) developed a cybersecurity coding structure under the National Initiative for Cybersecurity Education (NICE) as well as procedures for assigning codes to federal civilian cybersecurity positions. However, OPM issued the coding structure and procedures 5 and 4 months later than t...

The Federal Housing Finance Agency (FHFA) relies extensively on computerized systems to carry out its mission to provide effective supervision, regulation, and housing mission oversight of the Federal National Mortgage Association (Fannie Mae), the Federal Home Loan Mortgage Corporation (Freddie Mac), and the federal home loan banks. Effective information security controls are essential to ensure...

Pursuant to a congressional request, GAO reviewed the software change controls at the Department of Housing and Urban Development (HUD), focusing on: (1) whether key controls as described in agency policies and procedures regarding software change authorization, testing, and approval complied with federal guidance; and (2) the extent to which agencies contracted for year 2000 remediation of missio...

Pursuant to a congressional request, GAO reviewed computer security weaknesses within 22 federal agencies' operations.GAO noted that: (1) the Department of Agriculture's National Finance Center had serious access control weaknesses that affected its ability to prevent or detect unauthorized changes to payroll and other payment data or computer software; (2) the Department of Commerce Inspector Gen...

GAO reviewed the way the Department of Housing and Urban Development (HUD) organized and defined its systems of records to compare how HUD and two other selected agencies have organized their systems of records, provide a breakdown of the HUD accounting records system, identify the reasons HUD reported fewer systems than any other cabinet level department, and provide a breakdown of the changes in...