Information Security and Privacy: HUD Needs a Major Effort to Protect Data Shared with External Entities
Fast Facts
The Department of Housing and Urban Development collects huge amounts of sensitive personal information for its housing, community investment, and mortgage loan programs. HUD often shares this information with affiliated agencies; contractors; and state, local, and tribal groups.
HUD isn't taking enough action to protect information exchanged with others. The agency expects external entities to have security and privacy controls for processing, storing, or sharing information outside of HUD systems but hasn't put policies in place to ensure that they protect data.
Our recommendations address the issue to better protect sensitive shared data.
Highlights
What GAO Found
The Department of Housing and Urban Development (HUD) is not effectively protecting sensitive information exchanged with external entities. Of four leading practices for such oversight, HUD did not address one practice and only minimally addressed the other three in its security and privacy policies and procedures (see table). For example, HUD minimally addressed the first leading practice because its policy required federal agencies and contractors with which it exchanges information to implement risk-based security controls; however, the department did not, among other things, establish a process or mechanism to ensure all external entities complied with security and privacy requirements when processing, storing, or sharing information outside of HUD systems. HUD's weaknesses in the four practices were due largely to a lack of priority given to updating its policies. Until HUD implements the leading practices, it is unlikely that the department will be able to mitigate risks to its programs and program participants.
Extent to Which the Department of Housing and Urban Development (HUD) Policies and Procedures Address Leading Practices for Overseeing the Protection of Sensitive Information
| Practice | Rating |
|---|---|
| Require risk-based security and privacy controls | ◔ |
| Independently assess implementation of controls | ◌ |
| Identify and track corrective actions needed | ◔ |
| Monitor progress implementing controls | ◔ |
Legend: ◔=Minimally addressed—leading practice was addressed to a limited extent; ◌=Not addressed—leading practice was not addressed.
Source: GAO analysis of HUD data. | GAO-20-431
HUD was not fully able to identify external entities that process, store, or share sensitive information with its systems used to support housing, community investment, or mortgage loan programs. HUD's data were incomplete and did not provide reliable information about external entities with access to sensitive information from these systems. For example, GAO identified additional external entities in system documentation beyond what HUD reported for 23 of 32 systems. HUD was further limited in its ability to protect sensitive information because it did not track the types of personally identifiable information or other sensitive information shared with external entities that required protection. This occurred, in part, because the department did not have a comprehensive inventory of systems, to include information on external entities. Its policies and procedures also focused primarily on security and privacy for internal systems and lacked specificity about how to ensure that all types of external entities protected information collected, processed, or shared with the department. Until HUD develops sufficient, reliable information about external entities with which program information is shared and the extent to which each entity has access to personally identifiable information and other sensitive information, the department will be limited in its ability to safeguard information about its housing, community investment, and mortgage loan programs.
Why GAO Did This Study
To administer housing, community investment, and mortgage loan programs, HUD collects a vast amount of sensitive personal information and shares it with external entities, including federal agencies, contractors, and state, local, and tribal organizations. In 2016, HUD reported two incidents that compromised sensitive information.
House Report 115-237, referenced by the Consolidated Appropriations Act, 2018, included a provision for GAO to evaluate HUD's information security framework for protecting information within these programs. The objectives were to (1) assess the effectiveness of HUD's policies and procedures for overseeing the security and privacy of sensitive information exchanged with external entities; and (2) determine the extent to which HUD was able to identify external entities that process, store, and share sensitive information with applicable systems. GAO compared HUD's policies and practices for systems' security and privacy to four leading practices identified in federal legislation and guidance. GAO also assessed HUD's practices for identifying external entities with access to sensitive information.
Recommendations
GAO is making five recommendations to HUD to fully implement the four leading practices and fully identify the extent to which sensitive information is shared with external entities.
HUD did not agree or disagree with the recommendations, but described actions intended to address them.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Housing and Urban Development | The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require the implementation of risk-based security and privacy controls for external entities that process, store, or share sensitive information with HUD. (Recommendation 1) |
While the agency did not agree or disagree with the recommendation, the agency took steps to implement it. Specifically, in December 2021, HUD provided evidence that it has reviewed and revised department-level security and privacy policies to ensure that they require the implementation of risk-based security and privacy controls for external entities that process, store, or share sensitive information with HUD. By completing these efforts, HUD may increase the protection of information for its programs.
|
| Department of Housing and Urban Development | The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require independent assessments of external entities that process, store, or share sensitive information with HUD to ensure controls are implemented. (Recommendation 2) |
While the agency did not agree or disagree with the recommendation, the agency took steps to implement it. Specifically, in December 2021, HUD provided evidence that it has reviewed and revised department-level security and privacy policies to ensure that they require independent assessments of external entities that process, store, or share sensitive information with HUD to ensure controls are implemented. By ensuring that security controls are implemented, HUD may improve the protection of information for its programs.
|
| Department of Housing and Urban Development | The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require identifying and tracking corrective action needed by external entities that process, store, or share sensitive information with HUD. (Recommendation 3) |
While the agency did not agree or disagree with the recommendation, the agency took steps to implement it. Specifically, in December 2021, HUD provided evidence that it has updated its (1) contract language and (2) templates for agreements with federal agencies to include a requirements for external entities to plan and manage corrective actions for weaknesses identified. By working with external entities to and taking these actions, HUD may strengthen the protection of information for its programs.
|
| Department of Housing and Urban Development | The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to review and revise department-level security and privacy policies to ensure that they require monitoring of progress in implementing controls/corrective actions by external entities that process, store, or share sensitive information with HUD. (Recommendation 4) |
While the agency did not agree or disagree with the recommendation, the agency took steps to implement it. Specifically, in December 2021, HUD provided evidence that it has reviewed and revised department-level security and privacy requirements to ensure that they require monitoring of progress in implementing controls/corrective actions by external entities that process, store, or share sensitive information with HUD. These actions taken by HUD may enhance the protection of information for its programs.
|
| Department of Housing and Urban Development | The Secretary of Housing and Urban Development should direct the Chief Information Officer, Senior Agency Official for Privacy, and Chief Privacy Officer to develop and maintain a comprehensive systems inventory that incorporates sufficient, reliable information about the external entities with which HUD program information is shared and the extent to which each external entity has access to PII and other sensitive information. (Recommendation 5) |
HUD did not agree or disagree with the recommendation. In February 2021, HUD reported on specific actions planned for addressing this recommendation. Specifically, the department intended to develop and maintain an inventory of systems that share information with external entities, including sufficient, reliable information about the entities, the information shared, and each entity's level of access. In addition, HUD intended to develop procedures for maintaining the inventory; ensuring that HUD IT officials collect comprehensive information about whether external entities are implementing leading practices and protecting sensitive information; and requiring program offices and system owners to ensure that all types of external entities protect information. In June 2022, HUD reported that the department had begun updating privacy artifacts and identifying relationships among systems sharing privacy data. As of April 2023, HUD reported that it had begun identifying all systems that contained PII in its Cyber Security Assessment and Management system. The department had established guidance and procedures designed to require that systems could not be authorized to operate without certification that any needed privacy impact assessments had been performed. By taking these actions, the department should be better positioned to maintain information about the external entities with which HUD shares data and the extent to which they have access to PII and other sensitive information.
|