prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: While HUD has primary responsibility for addressing lead paint hazards in federally-assisted housing, EPA also has responsibilities related to setting federal lead standards for housing  EPA sets federal standards for lead hazards in paint, soil, and dust  Additionally, EPA regulates the training and certification of workers who remediate lead paint hazards  CDC sets a health guideline known as the “blood lead reference value” to identify children exposed to more lead than most other children  As of 2012, CDC began using a blood lead reference value of 5 micrograms of lead per deciliter of blood  For children whose blood lead level is at or above CDC’s blood lead reference value, health care providers and public health agencies can identify those children who may benefit the most from early intervention  CDC’s blood lead reference value is based on the 97 5th percentile of the blood lead distribution in U S  children (ages 1 to 5), using data from the National Health and Nutrition Examination Survey  Children with blood lead levels above CDC’s blood lead reference value have blood lead levels in the highest 2 5 percent of all U S  children (ages 1 to 5)  HUD, EPA, and the Department of Health and Human Services (HHS) are members of the President’s Task Force on Environmental Health Risks and Safety Risks to Children  HUD co- chairs the lead subcommittee of this task force with EPA and HHS  The task force published the last national lead strategy in 2000  The primary federal legislation to address lead paint hazards and the related requirements for HUD is the Residential Lead-Based Paint Hazard Reduction Act (Title X of the Housing and Community Development Act of 1992)  We refer to this law as Title X throughout this report  Title X required HUD to, among other things, promulgate lead paint regulations, implement the lead hazard control grant programs, and conduct research and reporting, as discussed throughout this report  The two key regulations that HUD has issued under Title X are the Lead Disclosure Rule and the Lead Safe Housing Rule: Lead Disclosure Rule  In 1996, HUD and EPA jointly issued the Lead Disclosure Rule  The rule applies to most housing built before 1978 and requires sellers and lessors to disclose any known information, available records, and reports on the presence of lead paint and lead paint hazards and provide an EPA-approved information pamphlet prior to sale or lease  Lead Safe Housing Rule  In 1999, HUD first issued the Lead Safe Housing Rule, which applies only to housing receiving federal assistance or federally-owned housing being sold  The rule established procedures for evaluating whether a lead paint hazard exists, controlling or eliminating the hazard, and notifying occupants of any lead paint hazards identified and related remediation efforts  The rule established an “elevated blood lead level” as a threshold that requires landlords and PHAs to take certain actions if a child’s blood test shows lead levels meeting or exceeding this threshold  In 2017, HUD amended the rule to align its definition of an “elevated blood lead level” with CDC’s blood lead reference value  This change lowered the threshold that generally required landlords and PHAs to act from 20 micrograms to 5 micrograms of lead per deciliter of blood  According to the rule, when a child under age 6 living in HUD-assisted housing has an elevated blood lead level, the housing provider must take several steps  These generally include testing the home and other potential sources of the child’s lead exposure within 15 days, ensuring that identified lead paint hazards are addressed within 30 days of receiving a report detailing the results of that testing, and reporting the case to HUD  Office of Lead Hazard Control and Healthy Homes (Lead Office)  HUD’s Lead Office is primarily responsible for administering HUD’s two lead hazard control grant programs, providing guidance on HUD’s lead paint regulations, and tracking HUD’s efforts to make housing lead-safe  The Lead Office collaborates with HUD program offices on its oversight and enforcement of lead paint regulations  For instance, the Lead Office issues guidance, responds to questions about requirements of lead paint regulations, and provides training and technical assistance to HUD program staff, PHA staff, and property owners  The Lead Office’s oversight efforts also include maintaining email and telephone hotlines to receive complaints and tips from tenants or homeowners, among others, as they pertain to lead paint regulations  Additionally, the Lead Office, in collaboration with EPA, contributes to the operation of the National Lead Information Center––a resource that provides the general public and professionals with information about lead, lead hazards, and their prevention  Office of Public and Indian Housing (PIH)  HUD’s PIH oversees and enforces HUD’s lead paint regulations for the rental assistance programs  As discussed earlier, this report focuses on the two largest rental assistance programs serving the most families with children––the Housing Choice Voucher and public housing programs  Housing Choice Voucher program  In the voucher program, eligible families and individuals are given vouchers as rental assistance to use in the private housing market  Generally, eligible families with vouchers live in the housing of their choice in the private market  The voucher generally pays the difference between the family’s contribution toward rent and the actual rent for the unit  Vouchers are portable; once a family receives one, it can take the voucher and move to other areas where the voucher program is administered  In 2017, there were roughly 2 5 million vouchers available  Public housing program  Public housing is reduced-rent developments owned and operated by the local PHA and subsidized by the federal government  PHAs receive several streams of funding from HUD to help make up the difference between what tenants pay in rent and what it costs to maintain public housing  For example, PHAs receive operating and capital funds through a formula allocation process  PHAs use operating funds to pay for management, administration, and day-to-day costs of running a housing development  Capital funds are used for modernization needs, such as replacing roofs or remediating lead paint hazards  According to HUD rules, generally families that are income-eligible to live in public housing pay 30 percent of their adjusted income toward rent  In 2017, there were roughly 1 million public housing units available  For both of these rental assistance programs, the Office of Field Operations (OFO) within PIH oversees PHAs’ compliance with lead paint regulations, in conjunction with HUD field office staff  The office has a risk-based approach to overseeing PHAs and performs quarterly risk assessments  Also within PIH, staff from the Real Estate Assessment Center are responsible for inspecting the physical condition of public housing properties  Office of Policy Development and Research (PD&R)  HUD’s PD&R is the primary office responsible for data analysis, research, and program evaluations to inform the development and implementation of programs and policies across HUD offices  of the total grant amount, while the Lead Hazard Reduction Demonstration grant program has required at least a 25 percent match  For fiscal years 2013–2017, HUD awarded $527 million for its lead hazard control grants, which included 186 grants to state and local jurisdictions (see fig  1)  In these 5 years, about 40 percent of grants awarded went to jurisdictions in the Northeast and 31 percent to jurisdictions in the Midwest––regions of the country known to have a high prevalence of lead paint hazards  Additionally, in these 5 years, 90 percent of grant awards went to grantees at the local jurisdiction level (cities, counties, and the District of Columbia)  The other 10 percent of grant awards went to state governments  During this time period, HUD awarded the most grants to jurisdictions in Ohio (17 grants), Massachusetts and New York (15 grants each), and Connecticut (14 grants)  HUD’s Lead-Based Paint Hazard Control grant and the Lead Hazard Reduction Demonstration grant programs have incorporated Title X statutory requirements through recent annual funding notices and their grant processes  Title X contains applicant eligibility requirements and selection criteria HUD should use to award lead grants  To be eligible to receive a grant, applicants need to be a state or local jurisdiction, contribute matching funds to supplement the grant award, have an approved comprehensive affordable housing strategy, and have a certified lead abatement program (if the applicant is a state government)  HUD has incorporated these eligibility requirements in its grant programs’ 2017 funding notices, which require applicants to demonstrate that they meet these requirements when they apply for a lead grant  According to the 2017 funding notices, applicants must detail the sources and amounts of their matching contributions in their applications  Similarly, applicants must submit a form certifying that the proposed grant activities are consistent with their local affordable housing strategy  HUD’s 2017 funding notices state that if applicants did not meet these eligibility requirements, HUD would not consider their applications  Additionally, Title X requires HUD to award lead grants according to the following applicant selection criteria: the extent to which an applicant’s proposed activities will reduce the risk of lead poisoning for children under the age of 6; the degree of severity and extent of lead paint hazards in the applicant’s jurisdiction; the applicant’s ability to supplement the grant award with state, local, or private funds; the applicant’s ability to carry out the proposed grant activities; and other factors determined by the HUD Secretary to ensure that the grants are used effectively  In its 2017 funding notices, HUD incorporated the Title X applicant selection criteria through five scoring factors that it used to assess lead grant applications  HUD allocated a certain number of points to each scoring factor  Applicants are required to develop their grant proposals in response to the scoring factors  When reviewing applications, HUD staff evaluated an applicant’s response to the factors and assigned points for each factor  See table 1 for a description of the 2017 lead grant programs’ scoring factors and points  As shown in table 1, HUD awarded the most points (46 out of 100) to the “soundness of approach” scoring factor, according to HUD’s 2017 funding notices  Through this factor, HUD incorporated Title X selection criteria on an applicant’s ability to carry out the proposed grant activities and supplement a grant award with state, local, or private funds  For example, HUD’s 2017 funding notices required applicants to describe their detailed plans to implement grant activities, including how the applicants will establish partnerships to make housing lead-safe  Specifically, HUD began awarding 2 of the 100 points to applicants who demonstrated partnerships with local public health agencies to identify families with children for enrollment in the lead grant programs  Additionally, HUD asked applicants to identify partners that can help provide assistance to complete the lead hazard control work for high-cost housing units  Furthermore, HUD required applicants to identify any nonfederal funding, including funding from the applicants’ partners  Appendix I includes examples of state, local, and nongovernmental funds that selected grantees planned to use to supplement their lead grants  In its lead grant programs, HUD has taken actions that were consistent with OMB’s requirements for competitively awarded grants  OMB generally requires federal agencies to: (1) establish a merit-review process for competitive grants that includes the criteria and process to evaluate applications; and (2) develop a framework to assess the risks posed by applicants for competitive grants, among other things  Through a merit-review process, an agency establishes and applies criteria to evaluate the merit of competitive grant applications  Such a process helps to ensure that the agency reviews grant applications in a fair, competitive, and transparent manner  Consistent with the OMB requirement to establish a merit review process, HUD has issued annual funding notices that communicate clear and explicit evaluative criteria  In addition, HUD has established processes for reviewing and scoring grant applications using these evaluative criteria, and selects grant recipients based on the review scores (see fig  2)  For example, applicants that score at or above 75 points are qualified to receive awards from HUD  Also, HUD awards funds beginning with the highest scoring applicant and proceeds by awarding funds to applicants in a descending order until funds are exhausted  Furthermore, consistent with the OMB requirement to develop a framework to assess applicant risks, HUD has developed a framework to assess the risk posed by lead grant applicants by, among other things, deeming ineligible those applicants with past performance deficiencies or those that do not have a financial management system that meets federal standards  However, HUD has not fully documented or evaluated its lead grant processes in reviewing and scoring the grants and making award decisions: Documenting grant processes and award decisions  While HUD has established processes for its lead grant programs, it lacks documentation, including detailed guidance to help ensure that staff carry out processes consistently and appropriately  Federal internal control standards state that agency management should develop and maintain documentation of its internal control system  Such documentation assists agency management by establishing and communicating the processes to staff  Additionally, documentation of processes can provide a means to retain organizational knowledge and communicate that knowledge as needed to external parties  The Lead Office’s Application Review Guide describes its grant application review and award processes at a high level but does not provide detailed guidance for staff as to how tasks should be performed  For example, the Guide notes that reviewers score eligible applications according to factors contained in the funding notices but does not describe how the reviewers should allocate points to the subfactors that make up each factor  Lead Office staff told us that creating detailed scoring guidance would be challenging because applicants’ proposed grant activities differ widely, and they said that scoring grant applications is a subjective process  While scoring grant applications may involve subjective judgments, improved documentation of grant review and scoring processes, including additional direction to staff, can help staff apply their professional judgment more consistently in evaluating applications  By better documenting processes, HUD can better ensure that staff evaluate applications consistently  Additionally, HUD has not fully documented its rationale for deciding which applicants receive lead grant awards and for deciding the dollar amounts of grant awards to successful applicants  In prior work examining federal grant programs, one recommended practice we identified is that agencies should document the rationale for award decisions, including the reasons individual applicants were selected or not and how award funding amounts were determined  While HUD’s internal memorandums listed the applicants selected and the award amounts, these memorandums did not document the rationale for these decisions or provide information sufficient to help applicants understand award outcomes  Lead Office staff told us that most grantees have received the amount of funding they requested in their applications, which was generally based on HUD’s maximum grant award amount  Lead Office staff said they could use their professional judgment to adjust award amounts to extend funding to more applicants when applicants received similar scores  However, the Lead Office’s documentation we reviewed did not explain this type of decision making  For example, in 2017, when two applicants received identical scores on their applications, HUD awarded each applicant 50 percent of the remaining available funds rather than awarding either applicant the amount they requested  Representatives of one of the two grantees told us they did not know why the Lead Office had not provided them the full amount they had requested  Lead Office staff told us that, to date, HUD has not considered alternative ways to award grant funding amounts  By fully documenting grant award processes, including the rationale for award decisions and amounts, HUD could provide greater transparency to grant applicants about its grant award decisions  Evaluating processes  HUD lacks a formal process for reviewing and updating its lead grant funding notices, including the factors and point allocations used to score applications  Federal internal control standards state that agencies should implement control activities through policies and that periodic review of policies and procedures can provide assurance of their effectiveness in achieving the agency’s objectives  Lead Office staff told us that previous changes to the factors and point allocation used to score applicants have been made based on informal discussions among staff  However, the Lead Office does not have a formal process to review and evaluate the relevance and appropriateness of the factors or points used to score applicants  Lead Office staff told us that they have never analyzed the scores applicants received for the factors to identify areas where applicants may be performing well or poorly or to help inform decisions about whether changes may be needed to the factors or points  Additionally, HUD has not changed the threshold criteria used to make award decisions since the threshold was established in 2003  As previously shown in figure 2, applicants who received at least 75 points (out of 100) have been qualified to receive a grant award  However, HUD grant documentation, including the funding notices and the Application Review Guide, does not explain the significance of this 75-point threshold  Lead Office staff stated that this threshold was first established in 2003 by HUD based on OMB guidance  A formal review of this 75-point threshold can help HUD determine whether it remains appropriate for achieving the grant programs’ objectives  Furthermore, by periodically evaluating processes for reviewing and scoring grant applications, HUD can better determine whether these processes continue to help ensure that lead grants reach areas of the country at greater risk for lead paint hazards  HUD has begun to develop analyses and tools to inform its efforts to target outreach and ensure that grant awards go to areas of the country that are at risk for lead paint hazards  However, HUD has not developed time frames for incorporating the results of the analyses into its lead grant programs’ processes  HUD has required jurisdictions applying for lead grants to include data on the need or extent of the problem in their jurisdiction (i e , scoring factor 2)  Additionally, Lead Office staff told us that HUD uses information from the American Healthy Homes Survey to obtain information on lead paint hazards across the country  However, the staff explained that the survey was designed to provide meaningful results at the regional level and did not include enough homes in its sample to provide information about housing conditions, such as lead paint hazards, at the state or local level  Because HUD awards lead grants to state and local jurisdictions, it cannot effectively use the survey results to help the agency make award decisions or inform decisions about areas for potential outreach  In early 2017, the Lead Office began working with PD&R to develop a model to identify local jurisdictions (at the census-tract level) that may be at heightened risk for lead paint hazards  Lead Office staff said that they hope to use results of this model to develop geographic tools to help target HUD funding to areas of the country at risk for lead paint hazards but not currently receiving a HUD lead grant  Lead Office staff said that they could reach out to these at-risk areas, help them build the capacity needed to administer a grant, and encourage them to apply  For example, HUD has identified that Mississippi and two major metropolitan areas in Florida (Miami and Tampa) had not applied for a lead grant  HUD has conducted outreach to these areas to encourage them to apply for a lead grant  In 2016, the City of Jackson, Mississippi, applied for and received a lead grant  Though the Lead Office has collaborated with PD&R on the model, HUD has not developed specific time frames to operationalize the model and incorporate the results of the model for using local-level data to help better identify areas at risk for lead paint hazards  Federal internal control standards require agencies to define objectives clearly to enable the identification of risks  This includes clearly defining time frames for achieving the objectives  Setting specific time frames could help to ensure that HUD operationalizes this model in a timely manner  By operationalizing a model that incorporates local data on lead paint hazard risk, HUD can better target its limited grant resources towards areas of the country with significant potential for lead hazard control needs  We performed a county-level analysis using HUD and Census Bureau data and found that most lead grants from 2013 through 2017 have gone to counties with at least one indicator of lead paint hazard risk  Information we reviewed, such as relevant literature, suggests that the two common indicators of lead paint hazard risk are the prevalence of housing built before the 1978 lead paint ban and the prevalence of individuals living below the poverty line  We defined areas with lead paint hazard risk as counties that had percentages higher than the corresponding national percentages for both of these indicators  The estimated average percentage nationwide of total U S  housing stock constructed before 1980 was 56 9 percent and the estimated average percentage nationwide of individuals living below the poverty line was 17 5 percent  As shown in figure 3, our analysis estimated that 18 percent of lead grants from 2013 through 2017 have gone to counties with both indicators above the estimated national percentages, 59 percent of grants have gone to counties with estimated percentages of old housing above the estimated national percentage, and 7 percent of grants have gone to counties that had estimated poverty rates above the estimated national percentage  (For an interactive version of this map, click here ) When HUD finalizes its model and incorporates information into its lead grant processes, HUD will be able to better target its grant resources to areas that may be at heightened risk for lead paint hazards  In 2016, HUD began to incorporate new steps to monitor PHAs’ compliance with lead paint regulations for nearly 4,000 PHAs  Previously, according to PIH staff, HUD required only that PHAs annually self-certify their compliance with lead paint laws and regulations, and HUD’s Real Estate Assessment Center inspectors check for lead paint inspection reports and disclosure forms at public housing properties during physical inspections  Starting in June 2016, PIH began using new tools for HUD field staff to track PHAs’ compliance with lead paint requirements in the voucher and public housing programs  As shown in figure 4, PIH’s compliance oversight processes for the voucher and public housing programs include various monitoring tools for overseeing PHAs  Key components of PIH’s lead paint oversight processes include the following: Tools for tracking lead hazards and cases of elevated blood levels in children  HUD uses two databases to monitor PHAs’ compliance with lead paint regulations: (1) the Lead-Based Paint Response Tracker, which PIH uses to collect and monitor information on the status of lead paint-related documents, including lead inspection reports and disclosure forms, in public housing properties but not in units with voucher assisted households; and (2) the Elevated Blood Lead Level Tracker, which PIH uses to collect and monitor information reported by PHAs on cases of elevated blood levels in children living in voucher and public housing units  In June 2016, OFO began using the Lead-Based Paint Response Tracker database to store information on public housing units and to help HUD field office staff to follow up with PHAs that have properties missing required lead documentation  In July 2017, OFO began using information recorded in the Elevated Blood Lead Level Tracker to track whether PHAs started lead remediation activities in HUD- assisted housing within the time frames required by the Lead Safe Housing Rule  Lead paint hazards included in PHAs’ risk assessment scores  OFO assigns scores to PHAs based on their relative risk in four categories: physical condition, financial condition, management capacity, and governance  OFO uses these scores to identify high- and very high-risk PHAs that will receive on-site full compliance reviews  In July 2017, OFO incorporated data from the Real Estate Assessment Center into the physical condition category of its Risk Assessment Protocol to help account for potential lead paint hazards at public housing properties  Questions about lead paint included as part of on-site full compliance reviews  In fiscal year 2016, HUD field offices began conducting on-site full compliance reviews at high- and very high-risk PHAs as part of HUD’s compliance monitoring program to enhance oversight and accountability of PHAs  In fiscal year 2017, as part of the reviews, HUD field office staff started using a compliance monitoring checklist to determine if PHAs comply with major HUD rules and to gather additional information on the PHAs  This checklist included lead-related questions that PIH field office staff use to determine whether PHAs meet the requirements in lead paint regulations for both the voucher and public housing programs  In 2016, OFO and HUD field offices began using information from the new monitoring efforts to identify potential noncompliance by PHAs with lead paint regulations and help the PHAs resolve the identified issues  According to HUD data, as of November 2017, the Lead-Based Paint Response Tracker indicated that 9 percent (357) of PHAs were missing both lead inspection reports and lead disclosure forms for one or more properties  There were 973 PHAs missing one of the two required documents  OFO staff told us that they prioritized following up with PHAs that were missing both documents  According to OFO staff, PHAs can resolve potential noncompliance by submitting adequate lead documentation to HUD  OFO staff told us the agency considers missing lead documentation as “potential” noncompliance because PHAs may provide the required documentation or they may be exempt from certain requirements (e g , HUD-designated elderly housing)  While HUD has taken steps to strengthen compliance monitoring processes, it does not have a plan to identify and address the risks of noncompliance by PHAs with lead paint regulations  Federal internal control standards state that agencies should identify, analyze, and respond to risks related to achieving the defined objectives  Furthermore, when an agency has made significant changes to its processes—as HUD has done with its compliance monitoring processes—management review of changes to these processes can help the agency determine that its control activities are designed appropriately  Our review found that HUD does not have a plan to help mitigate and address risks related to noncompliance with lead paint regulations by PHAs (i e , ensuring lead safety in assisted housing)  Additionally, our review found several limitations with HUD’s new compliance monitoring approach, which include the following: Reliance on PHA self-certifications  HUD’s compliance monitoring processes rely in part on PHAs self-certifying that they are in compliance with lead paint regulations, but recent investigations have found that some PHAs may have falsely certified that they were in compliance  In November 2017, HUD filed a fraud complaint against two former officials of the Alexander County (Illinois) Housing Authority, alleging that the former official, among other things, falsely certified to HUD that the Housing Authority was in compliance with lead paint regulations  Further, PIH staff told us there are ongoing investigations related to potential noncompliance with lead paint regulations and false certifications at two other housing authorities  Lack of comprehensive data for the public housing program  OFO started to collect data for the public housing program in the Lead-Based Paint Response Tracker in June 2016 and the inventory of all public housing properties includes units inspected since 2012  In addition, HUD primarily relies on the presence of lead inspection reports but does not record in the database when inspections and remediation activities occurred and does not determine whether they are still effective  Because of this, the information contained in the lead inspection reports may no longer be up-to-date  For example, a lead inspection report from the 1990s may provide evidence that abatement work was conducted at that time, but according to PIH staff, the housing may no longer be lead-safe  Lack of readily available data for the voucher program  The voucher program does not have readily available data on housing units’ physical condition and compliance with lead paint regulations because data on the roughly 2 5 million units in the program are kept at the PHA level  According to PIH staff, HUD plans to adopt a new system for the voucher program that will include standardized, electronic data for voucher units  PIH staff said the new system (Uniform Physical Condition Standards for Vouchers Protocol) will allow greater oversight and provide HUD the ability to conduct data analysis for voucher units  Challenges identifying children with elevated blood lead levels  For several reasons, PHAs face ongoing challenges receiving information from state and local public health departments on the number of children identified with elevated blood lead levels  First, children across the U S  are not consistently screened and tested for exposure to lead  Second, according to CDC data, many states use a less stringent health guideline to identify children compared to the health standard that HUD uses (i e , CDC’s current blood lead reference value)  PIH staff told us that some public health departments may not report children with elevated blood levels to PHAs because they do not know that a child is living in a HUD- assisted unit and needs to be identified using the more stringent HUD standard  Lastly, Lead Office staff told us that privacy laws in some states may impose restrictions on public health departments’ ability to share information with PHAs  Limited coverage of on-site compliance reviews  While full on-site compliance reviews can be used to determine if PHAs are in compliance with lead paint regulations, OFO conducts a limited number of these reviews annually  For example, in Fiscal Year 2017, OFO conducted 72 reviews of the roughly 4,000 total PHAs  Based on OFO information, there are 973 PHAs that are missing either lead inspection reports or lead disclosure forms indicating some level of potential noncompliance  HUD’s steps since June 2016 to enhance monitoring of PHAs’ compliance with lead paint regulations have some limitations that create risks in its new compliance monitoring approach  By developing a plan to help mitigate and address the various limitations associated with the new compliance monitoring approach, HUD could further strengthen its oversight and help ensure that PHAs maintain lead-safe housing units  HUD does not have detailed procedures to address PHA noncompliance with lead paint regulations or to determine when enforcement decisions may be needed  Lead Office staff told us that their enforcement program aims to ensure that PHAs have the information necessary to remain in compliance with lead paint regulations  According to federal internal control standards, agencies should implement control activities through policies and procedures  Effective design of procedures to address noncompliance would include documenting specific actions to be performed by agency staff when deficiencies are identified and related time frames for these actions  While HUD staff stated that they address PHA noncompliance through ongoing communication and technical assistance to PHAs, HUD has not documented specific actions to be performed by staff when deficiencies are identified  OFO staff told us that in general, PIH has not needed to take many enforcement actions because field offices are able to resolve most lead paint regulation compliance concerns with PHAs through ongoing communication and technical assistance  For example, HUD field offices sent letters to PHAs when Real Estate Assessment Center inspectors could not locate required lead inspection reports and lead disclosure forms, and requested that the PHA send the missing documentation within 30 days  However, OFO’s fiscal years 2015–2017 internal memorandums on monitoring and oversight guidance for HUD field offices did not contain detailed procedures, including time frames or criteria HUD staff would use to determine when to consider whether a more formal enforcement action might be warranted  Additionally, Lead Office staff said if efforts to bring a PHA into compliance are unsuccessful, the Lead Office would work in conjunction with PIH and HUD’s Office of General Counsel’s Departmental Enforcement Center to determine if an enforcement action is needed, such as withholding or delaying funds from a PHA or imposing civil money penalties on a PHA  Lead Office staff also told us that instead of imposing a fine on a PHA, HUD would rather work with the PHA to resolve the lead paint hazard  However, the Lead Office provided no documentation detailing the specific steps or time frames HUD staff would follow to determine when a noncompliance case is escalated to the Office of General Counsel  In a March 2018 report to Congress, HUD noted that children continued to test positive for lead in HUD-assisted housing in 2017  In the same report, HUD notes PIH and the Lead Office will continue to work with PHAs to ensure compliance with lead paint regulations  By adopting procedures that clearly describe when lead paint hazard compliance efforts are no longer sufficient and enforcement decisions are needed, HUD can better keep PHAs accountable in a consistent and timely manner  The standard HUD uses to identify children with elevated blood lead levels and initiate lead hazard control activities in its rental assistance aligns with the health guideline set by CDC in 2012  HUD also uses CDC’s health guideline in its lead grant programs  In HUD’s January 2017 amendment to the Lead Safe Housing Rule, HUD made its standard for lead in a child’s blood more stringent by lowering it from 20 micrograms to 5 micrograms of lead per deciliter of blood, matching CDC’s health guideline (i e , blood lead reference value)  Specifically, HUD’s stronger standard allows the agency to respond more quickly when children under 6 years old are exposed to lead paint hazards in voucher and public housing units
Report 2:  Consequently, developers may be unable to provide meaningful input, and GSA could miss swap exchange opportunities  In 2014, we recommended that GSA develop criteria for determining when to solicit market interest in a swap exchange  GSA agreed with the recommendation and has since updated its guidance to include these criteria  In January 2017, GSA agreed to a swap exchange for the U S  Department of Transportation Volpe Center in Cambridge, Massachusetts  After a competitive process, GSA selected the Massachusetts Institute of Technology (MIT) as its exchange partner for the existing Department of Transportation (DOT) facility  Per the agreement, MIT will construct a new DOT facility on a portion of a 14 acre site to which DOT has title and, in exchange, will receive title to the remaining portion of the site that will not be used by DOT, which is located near its main campus  GSA indicated that, once completed, the project will provide $750 million in value to the federal government in the form of the design and construction services and value-equalization funds from MIT  Our prior work has identified a number of alternative approaches to funding real property projects  In March 2014, we reported that upfront funding is the best way to ensure recognition of commitments made in budgeting decisions and to maintain fiscal controls  However, obtaining upfront funding for large acquisitions such as the Hoover Building replacement can be challenging  Congress has provided some agencies with specific authorities to use alternative funding mechanisms for the acquisition, renovation, or disposal of federal real property without full, upfront funding  Table 1 outlines selected funding mechanisms, and considerations for each mechanism we identified in our 2014 report  Some of these alternative mechanisms allow selected agencies to meet their real property needs by leveraging other authorized resources, such as retained fees or land swaps with a private sector partner  Funding mechanisms leverage both monetary resources, such as retained fees, and non-monetary resources, such as property exchanged in a land swap or space offered in an enhanced use lease  In some cases, the funding mechanism may function as a public-private partnership intended to further an agency’s mission by working with a partner to leverage resources  Some of these mechanisms allow the private sector to provide the project’s capital—at their cost of borrowing  The U S  federal government’s cost of borrowing is lower than the private sector’s  When the private sector provides the project capital, the federal government later repays these higher private sector borrowing costs (e g , in the form of lease payments)  In some cases, factors such as lower labor costs or fewer requirements could potentially help balance the higher cost of borrowing, making partner financing less expensive  Our 2014 report also identifies budgetary options—within the bounds of the current unified budget—to meet real property needs while helping Congress and agencies make more prudent long-term decisions  In 2014, we reported that projects with alternative funding mechanisms present multiple forms of risk that are shared between the agency and any partner or stakeholder  Further, we noted project decisions should reflect both the likely risk and the organization’s tolerance for risk  Incorporating risk assessment and management practices into decisions can help organizations recognize and prepare to manage explicit risks (e g  financial and physical) and implicit risks (e g  reputational)  For example, clearly defined lease terms may help agencies manage risks of costs for unexpected building repairs  Further considerations we noted in our 2014 report include the availability of an appropriate partner—and that partners should bring complementary resources, skills, and financial capacities to the relationship—and management of the relationship with that partner  While different funding mechanisms have been used as an alternative to obtaining upfront funding for federal real property projects, changes to the budgetary structure itself—within the bounds of the unified budget that encompasses the full scope of federal programs and transactions—may also help agencies meet their real property needs  Such alternatives may include changing existing or introducing new account structures to fund real property projects  Our previous work identified options for changes within the current discretionary budget structure and options on the mandatory side of the budget  Alternative budgetary structures may change budgetary incentives for agencies and therefore help Congress and agencies make more prudent long-term fiscal decisions  Chairman Barrasso, Ranking Member Carper, and Members of the Committee, this concludes my prepared statement  I am happy to answer any questions you may have at this time  If you or your staff members have any questions concerning this testimony, please contact me at (202) 512-2834 or wised@gao gov  In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement  Individuals who made key contributions to this testimony are Mike Armes (Assistant Director), Colin Ashwood, Matt Cook, Joseph Cruz, Keith Cunningham, Alexandra Edwards, Carol Henn, Susan Irving, Hannah Laufe, Diana Maurer, John Mortin, Monique Nasrallah, Matt Voit, Michelle Weathers, and Elizabeth Wood  This is a work of the U S  government and is not subject to copyright protection in the United States  The published product may be reproduced and distributed in its entirety without further permission from GAO  However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately 

ground_truth: CDC is responsible for detecting and responding to emerging health threats and controlling dangerous substances. In carrying out its mission, CDC relies on information technology systems to receive, process, and maintain sensitive data. Accordingly, effective information security controls are essential to ensure that the agency's systems and information are protected from misuse and modification. GAO was asked to examine information security at CDC. In June 2018, GAO issued a limited official use only report on the extent to which CDC had effectively implemented technical controls and an information security program to protect the confidentiality, integrity, and availability of its information on selected information systems. This current report is a public version of the June 2018 report. In addition, for this public report, GAO determined the extent to which CDC has taken corrective actions to address the previously identified security program and technical control deficiencies and related recommendations for improvement. For this report, GAO reviewed supporting documents regarding CDC's actions on previously identified recommendations and interviewed personnel at CDC. As GAO reported in June 2018, the Centers for Disease Control and Prevention (CDC) implemented technical controls and an information security program that were intended to safeguard the confidentiality, integrity, and availability of its information systems and information. However, GAO identified control and program deficiencies in the core security functions related to identifying risk, protecting systems from threats and vulnerabilities, detecting and responding to cyber security events, and recovering system operations (see table below). GAO made 195 recommendations to address these deficiencies. As of August 2018, CDC had made significant progress in resolving many of the security deficiencies by implementing 102 of 184 (about 55 percent) technical control recommendations, and partially implementing 1 of 11 information security program recommendations made in the June 2018 report. The figure shows the status of CDC's efforts to implement the 195 recommendations. Additionally, CDC has created remedial action plans to implement the majority of the remaining open recommendations by September 2019. Until CDC implements these recommendations and resolves the associated deficiencies, its information systems and information will remain at increased risk of misuse, improper disclosure or modification, and destruction.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: CDC—an operating division of the Department of Health and Human Services (HHS)—serves as the national focal point for disease prevention and control, environmental health, and promotion and education activities designed to improve the health of Americans  The agency is also responsible for leading national efforts to detect, respond to, and prevent illnesses and injuries that result from natural causes or the release of biological, chemical, or radiological agents  To achieve its mission and goals, the agency relies on an array of partners, including public health associations and state and local public health agencies  It collaborates with these partners on initiatives such as monitoring the public’s health, investigating disease outbreaks, and implementing prevention strategies  The agency also uses its staff located in foreign countries to aid in international efforts, such as guarding against global diseases  Table 1 describes the organization of CDC  CDC is staffed by approximately 20,000 employees across the United States and around the world  For fiscal year 2017, according to agency officials, the agency’s total appropriation was approximately $12 billion, of which it reported spending approximately $424 million on information technology  In addition, the officials stated that approximately $31 million (or about 7 3 percent of the amount spent on information technology) was for information security across all CDC information technology investments  CDC relies extensively on information technology to fulfill its mission and support related administrative needs  Among the approximately 750 systems reported in its inventory, the agency has systems dedicated to supporting public health science, practice, and administration  All of these systems rely on an information technology infrastructure that includes network components, critical servers, and data centers  At CDC, the chief information officer (CIO) is responsible for establishing and enforcing policies and procedures protecting information resources  The CIO is to lead the efforts to protect the confidentiality, integrity, and availability of the information and systems that support the agency and its operations, and is to report quarterly to the HHS CIO on the overall effectiveness of CDC’s information security and privacy program, including the progress of remedial actions  The CIO designated a chief information security officer (CISO), who is to oversee compliance with applicable information security and privacy requirements of the agency  The CISO, among other things, is responsible for providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, and disruption of information and information systems that support the operations and assets of the agency  To further ensure information security compliance, information systems security officers (ISSO) are responsible for managing the information security program within their respective organizations and report on security program matters to the CISO, including computer security-related incidents  ISSO responsibilities include ensuring that vendor-issued security patches are expeditiously installed and that system owners establish processes for timely removal of access privileges when a user’s system access is no longer necessary  In addition, security stewards are to perform operational security analyses supporting the efforts of the ISSO  Further, business stewards serve as program managers, accepting full accountability for the operations of the systems and ensuring that security is planned, documented, and properly resourced for each aspect of the information security program  The Federal Information Security Modernization Act (FISMA) of 2014 provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets  FISMA assigns responsibility to the head of each agency for providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency  The law also delegates to the agency CIO (or comparable official) the authority to ensure compliance with FISMA requirements  The CIO is responsible for designating a senior agency information security officer whose primary duty is information security  The law also requires each agency to develop, document, and implement an agency-wide information security program to provide risk-based protections for the information and information systems that support the operations and assets of the agency  In addition, FISMA requires agencies to comply with National Institute of Standards and Technology (NIST) standards, and the Office of Management and Budget (OMB) requires agencies to comply with NIST guidelines  NIST Federal Information Processing Standards (FIPS) Publication 199 requires agencies to categorize systems based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on organizational operations, organizational assets, individuals, other organizations, and the nation  NIST FIPS 200 requires agencies to meet minimum security requirements by selecting the appropriate security controls, as described in NIST Special Publication (SP) 800-53  This NIST publication provides a catalog of security and privacy controls for federal information systems and a process for selecting controls to protect organizational operations and assets  The publication provides baseline security controls for low-, moderate-, and high-impact systems, and agencies have the ability to tailor or supplement their security requirements and policies based on agency mission, business requirements, and operating environment  Further, in May 2017, the President issued an executive order requiring agencies to immediately begin using NIST’s Cybersecurity Framework for managing their cybersecurity risks  The framework, which provides guidance for cybersecurity activities, is based on five core security functions: Identify: Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities  Protect: Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services  Detect: Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event  Respond: Develop and implement the appropriate activities to take action regarding a detected cybersecurity event  Recover: Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event  According to NIST, these 5 functions occur concurrently and continuously, and provide a strategic view of the life cycle of an organization’s management of cybersecurity risk  Within the 5 functions are 23 categories and 108 subcategories that include controls for achieving the intent of each function  Appendix II provides a description of the framework categories and subcategories of controls  We reported in June 2018 that CDC had implemented numerous controls over the 24 systems we reviewed, but had not always effectively implemented controls to protect the confidentiality, integrity, and availability of these systems and the information maintained on them  Deficiencies existed in the technical controls and agency-wide information security program that were intended to (1) identify risk, (2) protect systems from threats and vulnerabilities, (3) detect cybersecurity events, (4) respond to these events, and (5) recover system operations  These deficiencies increased the risk that sensitive personally identifiable and health-related information, including information regarding the transfer of biological agents and toxins dangerous to public health, could be disclosed or modified without authorization  As shown in table 2, deficiencies existed in all 5 core security function areas for the selected systems we reviewed  Controls associated with the identify core security function are intended to help an agency develop an understanding of its resources and related cybersecurity risks to its systems, assets, data, and capabilities  These controls include identifying and assessing cybersecurity risk and establishing information security policies, procedures, and plans  We reported in June 2018 that, although CDC had taken steps to implement these controls, it had not (1) categorized the risk-related impact of a key system, identified threats, or reassessed risk for systems or facilities when needed; (2) sufficiently documented technical requirements in policies, procedures, and standards; and (3) described intended controls in facility security plans  CDC Categorized Systems Based on Potential Impact of Compromise, but Did Not Appropriately Categorize a Key General Support System As discussed earlier, FIPS Publication 199 requires agencies to categorize systems based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on organizational operations, organizational assets, individuals, other organizations, and the nation  For networks and other general support systems, NIST SP 800-60 notes that the categorization should be based on the high water mark of supported information systems, and on the information types processed, transmitted across the network, or stored on the network or support system  Further, CDC’s architecture design principles state that high- impact systems are to be maintained on dedicated machinery and be physically and logically secured from lower-risk systems  CDC had categorized the 24 systems we reviewed, but the assigned impact level was not always appropriate  In this regard, the agency did not ensure that high-impact systems were logically secured from a lower- risk system  Specifically, seven selected high-impact systems relied on a general support system that the agency had categorized as a moderate- impact system (i e , a lower-risk system)  As a result, the high-impact systems were relying on controls in a less secure environment  Officials from the Office of the Chief Information Officer (OCIO) explained that the categorization of the supporting system was outdated based on changes to the agency’s operating environment and that they planned to re- evaluate the assigned impact level  CDC Assessed Risk at the System Level, but Did Not Assess Threats, Document Risk-based Decisions, or Reassess Risk When Needed According to NIST SP 800-30, risk is determined by identifying potential threats to an organization and vulnerabilities in its systems, determining the likelihood that a particular threat may exploit vulnerabilities, and assessing the resulting impact on the organization’s mission, including the effect on sensitive and critical systems and data  NIST also states that assessments should be monitored on an ongoing basis to keep current on risk-impacting changes to the operating environment  CDC had developed system-level risk assessments for the 8 selected mission-essential systems, and had summarized its risks in a risk assessment report  However, only two of the eight risk assessments had identified potential threats, and only one of these assessments determined the likelihood and impact of threats to that system  Further, CDC had not always documented risks associated with less secure configuration settings or monitored its assessments to address changes to the operating environment  For example, among the 94 technical control deficiencies that we identified for the 24 systems we reviewed, OCIO officials stated that the agency had not implemented controls for 20 deficiencies due to technical constraints  However, CDC did not address risks associated with decisions not to implement controls for these reasons in the system risk assessments  OCIO officials also partially attributed 5 of the 94 technical control deficiencies to new cybersecurity threats and to threat vectors that turned initially sound architecture decisions into vulnerabilities  However, CDC had not addressed such changes in the risk assessments for the affected systems  By not assessing threats or the likelihood of their occurrence and impact and by not documenting the risks, CDC cannot have assurance that appropriate controls are in place commensurate with the level of risk  CDC Had a Process in Place to Assess Risk to Systems from an Entity-wide Perspective Beyond the system level, newly discovered threats or vulnerabilities may require an agency to make risk decisions from an entity-wide perspective  An entity-wide perspective is needed because the threats and vulnerabilities may affect more than specific systems  CDC had a process in place to assess risk from an entity-wide perspective  This process included regular meetings among OCIO and program office staff to discuss policy, threats, and incidents  Specifically, ISSOs held monthly meetings as a continuous monitoring working group to discuss policy updates  In addition, an OCIO official held quarterly briefings that included presentations on incident response tools, incident statistics, and potential threats  OCIO officials also held ad hoc meetings, as necessary, regarding vulnerability and threat concerns when the agency received email alerts from the Federal Bureau of Investigation, the Department of Homeland Security (DHS), or HHS  CDC Had Not Updated Facility Risk Assessments In addition to assessing risks for systems, agencies are to assess the risk to their facilities  The Interagency Security Committee (ISC) requires agencies to determine the security level for federal facilities, and to conduct risk assessments at least once every 5 years for Level I and Level II facilities and at least once every 3 years for Level III, Level IV, and Level V facilities  However, the two facility risk assessments that we reviewed had not been updated in a timely manner  Specifically, the risk assessments, covering Level III and Level IV facilities that house the 24 reviewed systems, had been last updated in January 2009 and March 2014—8 years earlier and just over 3 years earlier, at the time of our review in July 2017  According to a CDC physical security official, the agency had previously relied on a third-party assessor to perform the assessments  The official also said that the agency planned to conduct its own facility risk assessments and had recently developed procedures for conducting these assessments  Until it performs these assessments, CDC may not be aware of new risks to its facilities or the controls needed to mitigate the risks  FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes policies and procedures that (1) are based on a risk assessment, (2) cost- effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements  According to NIST SP 800-53, an agency should develop policies and procedures for each of the 18 NIST families of security controls to facilitate the implementation of the controls  CDC had documented numerous policies, procedures, and standards that addressed each of the 18 control families identified in NIST SP 800-53  For example, the agency had developed policies and procedures governing physical access to CDC facilities, role-based training of personnel with significant security responsibilities, security assessment and authorization of systems, and continuity of operations, in addition to standard operating procedures that covered numerous other controls  The agency had also developed the CDC IT Security Program Implementation Standards, which describes the agency’s security program requirements and minimum mandatory standards for the implementation of information security and privacy controls  In addition, the agency had documented configuration standards, which specified minimum configuration settings, for devices such as firewalls, routers, switches, as well as Unix and Windows servers  However, these policies and standards sometimes lacked the technical specificity needed to ensure controls were in place  To illustrate, the agency had not sufficiently documented detailed guidance or instructions to address numerous technical control deficiencies we identified, such as insecure network devices, insecure database configurations, not blocking certain email attachments, and not deploying a data loss prevention capability  According to OCIO officials, the agency’s periodic reviews and updates to existing cybersecurity policies and standards did not reveal and address these issues  Nevertheless, without clear and specific guidance or instructions for implementing technical controls, the agency had less assurance that controls were in place and operating as intended  FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes subordinate plans for providing adequate information security for networks, facilities, and systems or a group of information systems, as appropriate  NIST states that plans should be reviewed and updated to ensure that they continue to reflect the correct information about the systems, such as changes in system owners, interconnections, and authorization status, among other things  HHS and CDC policies require that such plans be reviewed annually  In addition, the ISC requires that agencies develop and implement an operable and effective facility security plan  CDC standards require the organization to prepare a facility security plan (or similar document)  CDC had developed security plans for the 8 selected mission-essential systems  With a few exceptions, the plans addressed the applicable security controls for those systems  The agency also had reviewed and updated the plans annually  However, CDC had not developed security plans for the facilities housing resources for the selected systems  Physical security officials stated that they had not developed security plans because they did not have a sufficient number of staff to develop them  Without comprehensive security plans for the facilities, CDC’s information and systems would be at an increased risk that controls to address emergency situations would not be in place and personnel at the facilities would not be aware of their roles and responsibilities for implementing sound security practices to protect systems housed at these CDC locations  The protect core security function is intended to help agencies develop and implement the appropriate safeguards for their systems to ensure achieving the agency’s mission and to support the ability to limit or contain the impact of a potential cybersecurity event  Controls associated with this function include implementing controls to limit access to authorized users, processes or devices; encrypting data to protect its confidentiality and integrity; configuring devices securely and updating software to protect systems from known vulnerabilities; and providing training for cybersecurity awareness and performing security-related duties  Although CDC had implemented controls that were intended to protect its operating environment, we reported in June 2018 that the agency did not consistently (1) implement access controls effectively, (2) encrypt sensitive data, (3) configure devices securely or apply patches in a timely manner, or (4) ensure staff with significant security responsibilities received role-based training  A basic management objective for any agency is to protect the resources that support its critical operations from unauthorized access  Agencies accomplish this objective by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities  Access controls include those related to identifying and authenticating users, authorizing access needed to perform job duties, protecting system boundaries, and physically protecting information system assets  However, CDC had not consistently implemented these controls  CDC Implemented Enterprise-wide Identification and Authentication Controls, but Did Not Consistently and Securely Configure Password Controls for Certain Accounts on Devices and Systems NIST SP 800-53 states that agencies should implement multi-factor authentication for their users of information systems  Multi-factor authentication involves using two or more factors to achieve authentication  A factor is something you know (password or personal identification number), something you have (token and personal identity verification (PIV) card), or something you are (biometric)  Also, NIST and CDC policy state that information systems shall have password management controls established to include minimum password complexity requirements, password lifetime restrictions, prohibitions on password reuse, and user accounts temporarily locked out after a certain number of failed login attempts during a specified period of time  CDC had applied enterprise-wide solutions to ensure appropriate identification and multi-factor authentication of its general user community through, for example, the use of PIV cards  However, instances of weak password management controls existed for certain accounts on network devices, servers, and database systems  According to OCIO officials, password control deficiencies existed primarily due to technical constraints, administrators not being aware of technical requirements, or administrators not adequately monitoring configuration settings  Without more secure password settings, CDC’s information and systems are at an increased risk that unauthorized individuals could have guessed passwords and used them to obtain unauthorized access to agency systems and databases  CDC Authorized Users More Access than Needed to Perform Their Jobs NIST SP 800-53 states that agencies should employ the principle of least privilege, allowing only authorized access for users (or processes acting on behalf of users) that are necessary to accomplish assigned tasks  It also states that privileged accounts—those with elevated access permissions—should be strictly controlled and used only for their intended administrative purposes  CDC had implemented controls intended to ensure that users were granted the minimum level of access permissions necessary to perform their legitimate job-related functions  However, the agency had granted certain users more access than needed for their job functions, including excessive access permissions on a key server  According to OCIO officials, CDC systems had deficiencies related to restricting access primarily due to technical constraints or administrators not adequately monitoring configuration settings  By not appropriately restricting access, CDC’s information and systems are at an increased risk that individuals could deliberately or inadvertently compromise database systems or gain inappropriate access to information resources  CDC Did Not Effectively Implement Boundary Controls to Ensure Network Integrity NIST SP 800-53 states that agencies should control communications at information systems’ external boundaries  It states that, to manage risks, agencies should use boundary protection mechanisms to separate or partition computing systems and network infrastructures containing higher-risk systems from lower-risk systems  Although CDC had implemented multiple controls that were designed to protect system boundaries, the agency had not sufficiently separated higher-risk systems from lower-risk systems  According to OCIO officials, deficiencies in boundary protection controls existed due to new cybersecurity threats turning initially sound architecture decisions into vulnerabilities, technical constraints, and administrators not being aware of technical requirements or adequately monitoring configuration settings  Without stronger boundary controls, CDC’s information and systems are at an increased risk that an attacker could have exploited these boundary deficiencies and leveraged them to compromise CDC’s internal network  CDC Physically Protected Information System Assets, but Did Not Consistently Ensure Access Remained Appropriate NIST SP 800-53 states that agencies should implement physical access controls to protect employees and visitors, information systems, and the facilities in which they are located  In addition, NIST states that agencies should review access lists detailing authorized facility access by individuals at the agency-defined frequency  In its standards, CDC requires implementation of the NIST special publication and requires that access lists detailing authorized facility access by individuals be reviewed at least every 365 days  CDC had implemented physical security controls  The agency had implemented physical security measures to control access to certain areas and to ensure the safety and security of its employees, contractors, and visitors to CDC facilities  For example, CDC had issued PIV cards and Cardkey Proximity Cards to its employees and contractors, and had limited physical access to restricted areas based on the permissions it granted via these cards  However, the agency had not consistently reviewed authorized access lists  In this regard, CDC did not have a process in place for periodically reviewing the lists of individuals with access to rooms containing sensitive resources to ensure that such access remained appropriate  Without reviewing authorized access lists, CDC has reduced assurance that individual access to its computing resources and sensitive information is appropriate  NIST SP 800-53 states that agencies should encrypt passwords both while stored and transmitted, and configure information systems to establish a trusted communication path between the user and the system  Additionally, NIST requires that, when agencies use encryption, they use an encryption algorithm that complies with FIPS 140-2  CDC had used FIPS-compliant encryption for its PIV card implementation, but had not effectively implemented encryption controls in other areas  According to OCIO officials, encryption control deficiencies existed primarily due to technical constraints, administrators not being aware of a technical solution, or configuration settings not being adequately monitored  By not using encryption effectively, CDC limits its ability to protect the confidentiality of sensitive information, such as passwords  NIST SP 800-53 states that agencies should disable certain services with known security vulnerabilities  This includes configuring security control settings on operating systems in accordance with publicly available security checklists (or benchmarks) promulgated by NIST’s National Checklist Program repository  This repository contains, for example, the security configuration benchmarks established by the Center for Internet Security (CIS) for Windows servers  NIST also states that agencies should test and install newly-released security patches, service packs, and hot fixes in a timely manner  In addition, CDC policy required that software patches for remediating vulnerabilities designated as critical or high risk be applied to servers within 45 days of being notified that a patch is available or within 7 days of when an exploit is known to exist  Further, agency policy specified that administrators configure Windows servers in accordance with the CDC- approved security benchmarks  CDC had documented security configuration baselines, but had not always securely configured its systems or applied patches  In addition, the agency had not consistently configured security settings in accordance with prescribed security benchmarks or applied patches in a timely manner  For example: CDC had configured Windows servers to run unnecessary services  CDC had configured only about 62 percent of the security settings in accordance with prescribed benchmark criteria on the Windows and infrastructure servers supporting five systems that we reviewed  During our site visit in April 2017, CDC had not installed 21 updates on about 20 percent of the network devices, including 17 updates that the vendor considered to be critical or high-risk  The oldest of the missing updates dated back to January 2015  CDC had not updated database software supporting two selected systems to a more recent version that addressed vulnerabilities with a medium severity rating  According to OCIO officials, CDC had deficiencies in configuration and patching primarily due to administrators not being aware that there was a technical solution or did not adequately monitor configuration settings  By not securely configuring devices and installing updates and patches in a timely manner, the agency is at increased risk that individuals could have exploited known vulnerabilities to gain unauthorized access to agency computing resources  According to NIST SP 800-53, agencies should provide adequate security training to individuals in a role such as system/network administrator and to personnel conducting configuration management and auditing activities, tailoring the training to their specific roles  In addition, one of the cybersecurity cross-agency priority goals requires that agencies implement training that reduces the risk that individuals will introduce malware through email and malicious or compromised web sites  Consistent with NIST SP 800-53, CDC policy required network users to receive annual security awareness training  Accordingly, for fiscal year 2017, all CDC staff completed the required annual security awareness training  CDC policy also required that those staff identified as having significant security responsibilities receive role-based training every 3 years  However, not all staff with significant security responsibilities received role-based training within the defined time frames  The agency used a tracking system to monitor the status of role-based training for 377 individuals who had been identified as having significant security responsibilities  As of May 2017, 56 (about 15 percent) of the 377 individuals had not completed the training within the last 3 years, and 246 (about 65 percent) of them had not taken training within the last year  In addition, CDC had not identified at least 30 other staff with significant security responsibilities who required role-based training  Specifically, none of the 18 security and database administrators for four selected systems were included among the individuals being tracked, although these administrators had significant security responsibilities  Further, the agency provided us with a list of 42 individuals whose job series indicated that they required role-based training  However, 12 of the 42 were not included among the tracked individuals  Furthermore, given the number of deficiencies identified and the rapidly evolving nature of cyber threats, CDC’s requirement that staff take role-based training only once every 3 years is not sufficient for individuals with significant cybersecurity responsibilities  According to OCIO officials, managers are responsible for identifying those individuals with significant security responsibilities  The process used to track training was manual and required an individual’s manager to specify training requirements  The officials noted that the agency plans to implement a new HHS annual role-based training requirement in fiscal year 2018 and that they intend to work to enhance oversight as the new requirement is implemented  The officials also stated that at least 10 of the 94 technical control-related deficiencies identified in our June 2018 report had resulted, at least in part, from staff not being aware of control requirements or solutions to address the deficiencies  As a result, CDC’s information and systems are at increased risk that staff may not have the knowledge or skills needed to appropriately protect them  The detect core security function is intended to allow for the timely discovery of cybersecurity events  Controls associated with this function include logging and monitoring system activities and configurations, assessing security controls in place, and implementing continuous monitoring  In June 2018, we reported that, although CDC had implemented controls intended to detect the occurrence of a cybersecurity event, it had not sufficiently implemented logging and monitoring capabilities or effectively assessed security controls  NIST SP 800-53 states that agencies should enable system logging features and retain sufficient audit logs to support the investigations of security incidents and the monitoring of select activities for significant security-related events  In addition, National Archives and Records Administration records retention guidance states that system files containing information requiring special accountability that may be needed for audit or investigative purposes should be retained for 6 years after user accounts have been terminated or passwords altered, or when an account is no longer needed for investigative or security purposes, whichever is later  NIST also states that agencies should monitor physical access to facilities where their information systems reside to detect physical security incidents  Further, NIST SP 800-53 states that agencies should monitor and control changes to configuration settings  Although CDC had implemented centralized logging and network traffic monitoring capabilities, the capabilities were limited  For example, the agency’s centralized logging system used for security monitoring had a limited storage capacity and did not meet the National Archives and Records Administration requirements  In addition, CDC had not centrally collected and monitored security event data for many key assets connected to the network  As a result, increased risk existed that CDC would not have been able to detect anomalous activities that may have occurred from malware attacks over time  OCIO officials stated that, as a compensating measure, the agency prevents direct communications between workstations  However, such a measure does not allow the agency to detect potentially inconsistent activities that may have occurred from malware attacks within the same data center  CDC also had not consistently reviewed physical access logs to detect suspicious physical access activities, such as access outside of normal work hours and repeated access to areas not normally accessed  Program offices responsible for 7 of the 8 selected mission-essential systems did not conduct such a review  According to OCIO officials, the offices were not aware of the need for a review  However, without reviewing physical access logs, CDC has reduced assurance that the agency would detect suspicious physical access activities  Further, CDC had not routinely monitored the configuration settings of its systems to ensure that the configurations were securely set  For example, for at least 41 of 94 technical control deficiencies we identified, OCIO officials cited quality control gaps where the change management process or system administrators had not discovered deficiencies resulting from insecure configuration settings  Without an effective monitoring process in place for system configurations, the agency was not aware of insecure system configurations  FISMA requires each agency to periodically test and evaluate the effectiveness of its information security policies, procedures, and practices  The law also requires agencies to test the management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems at a frequency depending on risk, but no less than annually  In addition, NIST SP 800- 53A identifies three assessment methods—interview, examine, and test— and describes the potential depth and coverage for each  Assessing a control’s effectiveness based on an interview is likely less rigorous than examining a control; similarly, examining a control is likely less rigorous than testing the control’s functionality  CDC had not sufficiently tested or assessed the effectiveness of the security controls for the 8 mission-essential systems that we reviewed  Although CDC annually assessed security controls of selected systems, the agency had only examined control descriptions in security plans to ensure accuracy  At least once every 3 years, the agency selected controls for a more in-depth assessment of the 8 mission-essential systems we reviewed  However, CDC had assessed only 191 (about 7 percent) of 2,818 controls described in the security plans for the selected systems  In addition, the agency used methods for assessing controls that were often not rigorous enough to identify the control deficiencies that we identified  For example, as depicted in figure 1, CDC relied exclusively on interviews—a less rigorous method—to assess 20 percent of the 191 controls it assessed for the selected systems  The security control tests and assessments were insufficient in part because CDC had not developed comprehensive security assessment plans or had not consistently implemented the plans for the 8 selected mission-essential systems we reviewed  For example, one system’s assessment plan indicated that five controls should be assessed using a testing methodology; instead, however, the assessor conducted interviews to determine whether controls were effective or not  OCIO officials stated that the security control test and assessment process is manual and staffing is limited  They stated that the agency intends to rely increasingly on automated tools—such as the tools implemented by the Continuous Diagnostics and Mitigation program—for performing the assessments  Nevertheless, by not assessing controls in an in-depth and comprehensive manner, CDC has limited assurance that the security controls are in place and operating as intended  Further, without developing and implementing comprehensive assessment plans, assessments may not be performed with sufficient rigor to identify control deficiencies  The respond core security function is intended to support the ability to contain the impact of a potential cybersecurity event  Controls associated with this function include implementing an incident response capability and remediating newly-identified deficiencies  Although CDC had implemented controls for incident response to detect cybersecurity events, we reported in June 2018 that the agency had not maintained adequate information to support its incident response capability or taken timely corrective actions to remediate identified control deficiencies  NIST SP 800-53 and SP 800-61 state that agencies should develop and document an incident response policy with corresponding implementation procedures and an incident response plan, and keep them updated according to agency requirements  NIST also states that agencies should implement an incident handling capability, including an incident response team that consists of forensic/malicious code analysts  In addition, agencies are to provide incident response training for the team and test the incident response capability to determine the effectiveness of the response  Further, NIST states that agencies are to monitor incidents by tracking and documenting them and maintain records about each incident, including forensic analysis  Finally, National Archives and Records Administration guidance states that records and data relevant to security incident investigations should be retained for 3 years  CDC had implemented an incident response capability  The agency had developed policy, procedures, and a plan that addressed incident response, and updated them annually  CDC had an incident response team that managed all of the incident handling and response efforts for the agency, and conducted forensic analyses for reported security incidents  Team members had undergone training, such as an advanced network forensic and analysis course offered by a private firm  In addition, the agency had periodically tested its incident handling capability by conducting penetration testing exercises  These exercises allowed the team to test its real-time response capabilities  CDC’s incident response procedures state that incident tickets should include a description of actions taken, response time, and whether actions have been completed or not  The agency’s procedures also require that computers affected by an incident be removed from the network immediately  Nevertheless, CDC had shortcomings in implementing its incident response capability and monitoring procedures  For the 11 security incidents CDC considered most significant over a 19-month period ending in March 2017, the agency had not consistently described the actions taken, the response times, or whether remedial actions had been completed  The agency also had not maintained audit log records for its security incidents  For example, the agency described recommended actions for 10 of the 11 incidents, but did not describe the actions that had been taken  In addition, although incident response team officials told us that all incident ticket records had been saved, CDC had not retained system log data that supported incident resolution for at least five of the incidents  The agency’s policy did not address record retention in accordance with National Archives and Records Administration guidance  Further, for two of the security incidents, the security incident tickets did not clearly indicate when two compromised workstations had been removed from the network  According to OCIO officials, shortcomings in fully documenting incidents resulted from the organization being understaffed, primarily due to budget limitations and the inability to hire qualified personnel  Without effectively tracking and documenting information system security incidents, CDC’s systems are at increased risk that the impact of security incidents would not be fully addressed  FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in information security policies, procedures, or practices  NIST SP 800-53 states that agencies are to develop a plan of action and milestones (POA&M) for an information system to document the agency’s planned remedial actions to correct identified deficiencies  CDC policy was consistent with the NIST guidelines  CDC had developed POA&Ms for deficiencies identified by its security control assessments, but had not remediated the deficiencies in a timely manner  For each of the 8 selected mission-essential systems, the agency had created plans for correcting control deficiencies  However, the agency did not implement several remedial actions by their due date  For example, expected completion dates had passed for correcting deficiencies associated with 4 of the 8 selected mission-essential systems  For these 4 systems, the completion dates were 1 to 8 months beyond the due dates at the time of our review in September 2017  According to Office of the Chief Information Security Officer officials, program offices that own the systems did not always communicate updates on the status of remedial actions for their respective systems, noting that deficiencies may have been corrected  Without effective communication to update its POA&Ms, CDC was not in a position to effectively manage its remedial actions and correct known deficiencies in a timely manner  The recover core security function is intended to support timely recovery of normal operations to reduce the impact from a cybersecurity event  Controls associated with this function include developing and testing contingency plans to ensure that, when unexpected events occur, critical operations can continue without interruption or can be promptly resumed, and that information resources are protected  Losing the capability to process, retrieve, and protect electronically maintained information can significantly affect an agency’s ability to accomplish its mission  If contingency planning is inadequate, even relatively minor interruptions can result in lost or incorrectly processed data, which can cause financial losses, expensive recovery efforts, and inaccurate or incomplete information  NIST SP 800-53 states that agency systems should have a contingency plan that includes the identification of key personnel and the systems’ essential mission functions and addresses full information system restoration  For high-impact systems, NIST specifies that agencies test contingency plans at an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats  In addition, NIST states that organizations should initiate corrective actions based on testing if they are needed  As we reported in June 2018, CDC had developed and fully tested contingency plans for each of the 8 selected mission-essential systems that we reviewed  Each plan identified key personnel and their contact information, essential mission functions of the systems, and instructions on how to fully restore the systems in the event of a disruption  Additionally, between January 2015 and May 2017, CDC had tested whether the 8 systems could be recovered at their respective alternate sites, and had initiated corrective actions based on the results of the tests  However, the alternate site for 6 of the 8 selected mission-essential systems was located in relatively close proximity to the main processing site  Although 2 systems had alternate sites located in another state, the alternate site for the other 6 systems was within the same metropolitan area  As a result, an event such as a natural disaster or substantial power outage could affect both the main and alternate sites for these systems, potentially rendering CDC unable to complete functions associated with its mission  Prompt restoration of service is necessary because the required recovery time for these systems ranged from 4 to 24 hours  Security plans for 3 of the systems recognized the hazards of having the sites within the same geographical region, but stated that CDC had accepted this risk  According to OCIO officials, having a site further away was cost prohibitive; however, the officials had not documented this analysis or the associated risk of having the agency’s processing sites located within the same geographical area  Without documenting the analysis and associated risk, CDC had less assurance that senior leadership was aware of the risk of agency systems being unavailable  As a consequence, senior leadership may not agree whether acceptance of the risk was warranted  An underlying reason for the information security deficiencies in selected systems was that, although the agency had developed and documented an agency-wide information security program, it had not consistently or effectively implemented elements of the program  FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes the following elements: periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency; policies and procedures that (1) are based on risk assessments, (2) cost-effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; plans for providing adequate information security for networks, facilities, and systems or group of information systems, as appropriate; security awareness training to inform personnel of information security risks and of their responsibilities in complying with agency policies and procedures, as well as training personnel with significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, or practices of the agency; and plans and procedures to ensure continuity of operations for information systems  As discussed previously in this report, CDC had implemented aspects of each of these elements  For example, the agency had conducted risk assessments, developed security plans, assessed security controls, developed remedial action plans, and developed and tested contingency plans for each of the 8 selected mission-essential systems  In addition, the agency had documented numerous policies and procedures and ensured that staff had completed annual security awareness training  However, CDC’s program had shortcomings  For example, as discussed earlier in this report, CDC had not consistently or effectively: addressed threats, technical constraints, and the changing threat environment in its system risk assessments, or assessed the risk of having alternate processing sites within close proximity to each other; documented detailed technical requirements in policies and procedures, or facility controls in facility security plans; tracked and trained staff with significant security responsibilities; monitored configuration settings and comprehensively assessed remediated deficiencies in a timely manner; or documented its cost analysis and associated risk of having an alternate processing site within the same geographical region as its primary processing site  Until CDC addresses these shortcomings and consistently and effectively implements all elements of its information security program, the agency will lack reasonable assurance that its computing resources are protected from inadvertent or deliberate misuse  In our June 2018 report, we made 195 recommendations to CDC to strengthen its technical security controls and bolster its agency-wide information security program  Specifically, we recommended that the agency take 184 actions to resolve technical control deficiencies by implementing stronger access controls, encrypting sensitive data, configuring devices securely, applying patches in a timely manner, strengthening firewall rules, and implementing logging and monitoring controls more effectively, among other actions  We also made 11 recommendations for CDC to improve its information security program by, among other things, assessing risks as needed, documenting more detailed technical requirements, monitoring and assessing controls more comprehensively, and remediating deficiencies in a timely manner  Since the issuance of our June 2018 report, CDC has made significant progress in implementing the recommendations we made to resolve the technical security control deficiencies in the information systems we reviewed and to improve its information security program  In this regard, the agency has implemented many of the recommendations for improving technical security controls for the systems we reviewed and has developed plans to implement recommendations for enhancing its information security program  Specifically, as of August 3, 2018, CDC had fully implemented 102 (55 percent) of the 184 recommendations we made to fortify the technical security controls over the systems we reviewed  In addition, the agency had partially implemented 20 (11 percent) of the 184 recommendations  In these instances, CDC had made progress toward implementing the recommendations, but had not completed all of the necessary corrective actions for us to close the recommendations  Therefore, these recommendations remain open  Further, CDC did not provide any evidence that it had implemented the remaining 62 technical control- related recommendations  Table 3 summarizes the status of CDC’s efforts to implement the 184 recommendations that we made to resolve the technical control deficiencies, as of August 3, 2018  By implementing 102 recommendations, CDC (as of August 3, 2018) reduced some of the risks associated with certain key activities  Specifically, these efforts included protecting network boundaries and logging and monitoring security events for indications of inappropriate or unusual activity on systems—that we highlighted in our June 2018 report as being particularly vulnerable and requiring the agency’s greater priority and attention  In addition, the agency had implemented several of our recommendations to rectify a number of the security control deficiencies  These efforts included strengthening firewall rules, implementing stronger access controls, configuring devices securely, and expanding its audit monitoring capabilities  In addition, CDC had developed a plan of action and milestones (POA&M) for each of the identified technical control deficiencies and related recommendations that remained open as of August 3, 2018  The POA&Ms assigned organization responsibilities, identified estimated costs, identified points of contact, and established time frames for resolving the deficiencies and closing the related recommendations  The agency’s plans called for it to implement the majority of the remaining open technical control-related recommendations by September 2019, and all recommendations by September 2020, as shown in figure 2  Our June 2018 report also included 11 recommendations to CDC to improve its information security program  In particular, we recommended that the agency, among other things, evaluate system impact level categorizations to ensure they reflect the current operating environment; update risk assessments to identify threats and the likelihood of impact of the threat on the environment; and update the facility risk assessments  In addition, we recommended that the agency take the necessary steps to make sure staff with significant security roles and responsibilities are appropriately identified and receive role-based training; monitor the configuration settings of agency systems to ensure the settings are set as intended; update security control assessments to include an assessment of controls using an appropriate level of rigor; and remediate POA&Ms in a timely manner  Further, we recommended that the agency document the cost-benefit analysis with associated risk of having an alternate site within the same geographical region as the main site  As of August 3, 2018, the agency had partially implemented 1 of the 11 information security program-related recommendations, but had not provided any evidence that it had implemented the remaining 10 recommendations  Regarding the partially implemented recommendation, CDC had provided role-based training to all personnel performing significant security responsibilities  However, the agency still needed to establish and automate the identification process and the tracking of training records for individuals needing specialized security role-based training  CDC had developed plans to fully implement this recommendation and each of the remaining 10 information security program-related recommendations by July 2019  Fully implementing the open recommendations is essential to ensuring that the agency’s systems and sensitive information are not at increased and unnecessary risk of unauthorized use, disclosure, modification, or disruption  We received written comments on a draft of this report from CDC  In its comments, which are reprinted in appendix III, the agency stated that it recognizes the risks associated with operating a large, global information technology enterprise and has implemented processes, procedures, and tools to better ensure the prevention, detection, and correction of potential incidents  CDC also said cybersecurity remains a high priority and that it takes the responsibilities for protecting public health information and data entrusted to it seriously  To strengthen its cybersecurity program, the agency stated that it is restructuring and streamlining the cyber program and IT infrastructure of its Office of the Chief Information Officer  Further, CDC stated that it has leveraged GAO’s limited official use only report, issued in June 2018, to accelerate its implementation, infrastructure, and software deployments to complete phrases one and two of DHS’s Continuous Diagnostics and Mitigation program  The agency also said it concurred with, and highlighted a number of actions that it had planned or begun taking to remediate, the 11 security program recommendations that we made to CDC in our June 2018 report  We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, and the department’s Office of the Inspector General, the Director of CDC, and interested congressional parties  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Gregory C  Wilshusen at (202) 512-6244 or wilshuseng@gao gov, or Dr  Nabajyoti Barkakati at (202) 512-4499 or barkakatin@gao gov  GAO staff who made key contributions to this report are listed in appendix IV  Our objective was to assess the extent to which CDC had effectively implemented an information security program and controls to protect the confidentiality, integrity, and availability of its information on selected information systems  In June 2018, we issued a report which detailed the findings from our work in response to this objective  In the report, we made 184 recommendations to CDC to resolve the technical security control deficiencies in the information systems we reviewed and 11 additional recommendations to improve its information security program  We designated that report as “limited official use only” (LOUO) and did not release it to the general public because of the sensitive information it contained  This report publishes the findings discussed in our June 2018 report, but we have removed all references to the sensitive information  Specifically, we deleted the names of the information systems and computer networks that we examined, disassociated identified control deficiencies from named systems, deleted certain details about information security controls and control deficiencies, and omitted an appendix that was contained in the LOUO report  The appendix contained sensitive details about the technical security control deficiencies in the CDC’s information systems and computer networks that we reviewed, and the 184 recommendations we made to mitigate those deficiencies  We also provided a draft of this report to CDC officials to review and comment on the sensitivity of the information contained herein and to affirm that the report can be made available to the public without jeopardizing the security of CDC’s information systems and networks  In addition, this report addresses a second objective that was not included in the June 2018 report  Specifically, this objective was to determine the extent to which CDC had taken corrective actions to address the previously identified security program and technical control deficiencies and related recommendations for improvement that we identified in the earlier report  As noted in our June 2018 report, we determined the extent to which CDC had effectively implemented an information security program and controls to protect the confidentiality, integrity, and availability of its information on selected information systems  To do this, we initially gained an understanding of the overall network environment, identified interconnectivity and control points, and examined controls for the agency’s networks and facilities  We conducted site visits at two CDC facilities in Atlanta, Georgia  To evaluate CDC’s controls over its information systems, we used our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized information  We based our assessment of controls on requirements identified by the Federal Information Security Modernization Act of 2014 (FISMA), which establishes key elements for an effective agency-wide information security program; NIST guidelines and standards; Department of Health and Human Services and CDC policies, procedures, and standards; and standards and guidelines from relevant security organizations, such as the National Security Agency, the Center for Internet Security, and the Interagency Security Committee  We had reviewed a non-generalizable sample of the agency’s information systems, focusing on those systems that (1) collect, process, and maintain private or potentially-sensitive proprietary business, medical, and personally identifiable information; (2) are essential to CDC’s mission; and (3) were assigned a Federal Information Processing Standard rating of moderate or high impact  Based on these criteria, we had selected eight mission-essential systems for our review  Of these systems, the agency had categorized 7 as high-impact systems and 1 as a moderate-impact system  For these 8 selected mission- essential systems, we had reviewed information security program-related controls associated with risk assessments, security plans, security control assessments, remedial action plans, and contingency plans  To assess the safeguards CDC implemented for its systems, we had examined technical security controls for 24 CDC systems, including systems the agency designated as high-value assets  These included 10 key systems, 8 of which were high- and moderate-impact mission- essential systems just described, 1 additional high-impact system, 1 additional moderate-impact system, and 14 general support systems  We selected the additional high-impact system because the agency re- categorized it as a high-impact system during our review  We selected the additional moderate-impact system because the agency used it to control physical access to highly sensitive CDC biologic lab facilities, including facilities that handle dangerous and exotic substances that cause incurable and deadly diseases  We selected 10 key systems, 8 of which were mission-essential systems, for review that (1) collect, process, and maintain private or potentially sensitive proprietary business, medical, and personally identifiable information; (2) are essential to CDC’s mission; (3) could have a catastrophic or severe impact on operations if compromised; or (4) could be of particular interest to potential adversaries  We also selected 14 general support systems that were part of the agency’s network infrastructure supporting the 10 key systems  To review controls over the 10 key systems and 14 general support systems, we had examined the agency’s network infrastructure and assessed the controls associated with system access, encryption, configuration management, and logging and monitoring  For reporting purposes, we had categorized the security controls that we assessed into the five core security functions described in the National Institute of Standards and Technology’s (NIST) cybersecurity framework  The five core security functions are: Identify: Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities  Protect: Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services  Detect: Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event  Respond: Develop and implement the appropriate activities to take action regarding a detected cybersecurity event  Recover: Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event  These core security functions are described in more detail in appendix II  For the identify core security function, we had examined CDC’s reporting for its hardware and software assets; analyzed risk assessments for the eight selected mission-essential systems to determine whether threats and vulnerabilities were being identified; reviewed risk assessments for two facilities; analyzed CDC policies, procedures, and practices to determine their effectiveness in providing guidance to personnel responsible for securing information and information systems; and analyzed security plans for the eight selected systems to determine if those plans had been documented and updated according to federal guidance  We also evaluated the risk assessments for two facilities that housed the 8 mission-essential selected systems  For the protect core security function, we had examined access controls for the 24 systems  These controls included the complexity and expiration of password settings to determine if password management was being enforced; administrative users’ system access permissions to determine whether their authorizations exceeded the access necessary to perform their assigned duties; firewall configurations, among other things, to determine whether system boundaries had been adequately protected; and physical security controls to determine if computer facilities and resources were being protected from espionage, sabotage, damage, and theft  We also had examined configurations for providing secure data transmissions across the network to determine whether sensitive data were being encrypted  In addition, we had examined configuration settings for routers, network management servers, switches, firewalls, and workstations to determine if settings adhered to configuration standards, and inspected key servers and workstations to determine if critical patches had been installed and/or were up-to-date  Further, we had examined training records to determine if employees and contractors had received security awareness training according to federal requirements, and whether personnel who have significant security responsibilities had received training commensurate with those responsibilities  For the detect core security function, we had analyzed centralized logging and network traffic monitoring capabilities for key assets connected to the network; analyzed CDC’s procedures and results for assessing security controls to determine whether controls for the eight selected mission- essential systems had been sufficiently tested at least annually and based on risk  We also had reviewed the agency’s implementation of continuous monitoring practices to determine whether the agency had developed and implemented a continuous monitoring strategy to manage its information technology assets and monitor the security configurations and vulnerabilities for those assets  For the respond core security function, we had reviewed CDC’s implementation of incident response practices, including an examination of incident tickets for 11 incidents; and had examined the agency’s process for correcting identified deficiencies for the eight selected mission-essential systems  For the recover core security function, we had examined contingency plans for eight selected mission-essential systems to determine whether those plans had been developed and tested  In assessing CDC’s controls associated with this function, as well as the other four core functions, we had interviewed Office of the Chief Information Officer officials, as needed  Within the core security functions, as appropriate, we had evaluated the elements of CDC’s information security program based on elements required by FISMA  For example, we analyzed risk assessments, security plans, security control assessments, and remedial action plans for each of the 8 selected mission-essential systems  In addition, we had assessed whether the agency had ensured staff had completed security awareness training and whether those with significant security responsibilities received commensurate training  We also had evaluated CDC’s security policies and procedures  To determine the reliability of CDC’s computer-processed data for training and incident response records, we had evaluated the materiality of the data to our audit objective and assessed the data by various means, including reviewing related documents, interviewing knowledgeable agency officials, and reviewing internal controls  Through a combination of methods, we concluded that the data were sufficiently reliable for the purposes of our work  To accomplish our second objective—on CDC’s actions to address the previously identified security program and technical control deficiencies and related recommendations—we requested that the agency provide a status report of its actions to implement each of the recommendations  For each recommendation that CDC indicated it had implemented as of August 3, 2018, we examined supporting documents, observed or tested the associated security control or procedure, and/or interviewed the responsible agency officials to assess the effectiveness of the actions taken to implement the recommendation or otherwise resolve the underlying control deficiency  Based on this assessment and CDC status reports, we defined the status of each recommendation into the following 3 categories: closed-implemented—CDC had implemented the recommendation; open-partially implemented—CDC had made progress toward, but had not completed, implementing the recommendation; and open-not implemented—CDC had not provided evidence that it had acted to implement the recommendation  We conducted this performance audit from December 2016 to December 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The National Institute of Standards and Technology’s cybersecurity framework consists of five core functions: identify, protect, detect, respond, and recover  Within the five functions are 23 categories and 108 subcategories, as described in the table  In addition to the individuals named above, Gary Austin, Jennifer R  Franks, Jeffrey Knott, and Chris Warweg (assistant directors); Chibuikem Ajulu-Okeke, Angela Bell, Sa’ar Dagani, Nancy Glover, Chaz Hubbard, George Kovachick, Sean Mays, Kevin Metcalf, Brandon Sanders, Michael Stevens, Daniel Swartz, and Angela Watson made key contributions to this report  Edward Alexander, Jr  and Duc Ngo (assistant directors); David Blanding, and Christopher Businsky also provided assistance 


Report 2:  The January 2017 rule also established more comprehensive testing for children and evaluation procedures for HUD assisted housing  According to HUD’s press release that accompanied the rule, by aligning HUD’s standard with CDC’s guidance, HUD can respond more quickly in cases when a child who lives in HUD assisted housing shows early signs of lead in their blood  The 2017 rule notes HUD will revise the agency’s elevated blood lead level to align with future changes HHS may make to its recommended environmental intervention level  HUD’s standards for lead dust levels align with EPA standards for its rental assistance programs and exceed EPA standards for the lead grant programs  In 2001, EPA published a final rule on lead paint hazard standards, including lead dust clearance standards  The rule established standards to help property owners, contractors, and government agencies identify lead hazards in residential paint, dust, and soil and address these hazards in and around homes  Under these standards, lead is considered a hazard when equal to or exceeding 40 micrograms of lead in dust per square foot sampled on floors and 250 micrograms of lead in dust per square foot sampled on interior window sills  In 2004, HUD amended the Lead Safe Housing Rule to incorporate the 2001 EPA lead dust standards as HUD’s standards  Since this time, HUD has used EPA’s 2001 lead hazard standards in its rental assistance programs  In February 2017, HUD released policy guidance for its lead grantees requiring them to meet new and more protective requirements for identifying and addressing lead paint hazards in the lead grant programs than those imposed by EPA’s 2001 standards that HUD uses in the rental assistance programs  For example, the policy guidance requires grantees to consider lead dust a hazard on floors at 10 micrograms per square foot sampled (down from 40) and on window sills at 100 micrograms per square foot sampled (down from 250)  The policy guidance noted that the new requirements are supported by scientific evidence on the adverse effects of lead exposure at low blood lead levels in children  Further, the policy guidance established a standard for porch floors––an area that EPA has not covered––because porch floors can be both a direct exposure source for children and a source of lead dust that can be tracked into the home  On December 27, 2017, the United States Court of Appeals for the Ninth Circuit ordered EPA to issue a proposed rule updating its lead dust hazard standard and the definition of lead-based paint within 90 days of the decision becoming final and a final rule within 1 year of the proposed rule  Because HUD’s Lead Safe Housing Rule generally defines lead paint hazards and lead dust hazards to mean the levels promulgated by EPA, if EPA changes its 2001 standards those new standards would be used in HUD’s rental assistance programs  On March 16, 2018, EPA filed a request to the court asking for clarification for when EPA is required to issue the proposed rule and followed up with a motion seeking clarification or an extension  In response to EPA’s motion, on March 26, 2018, the court issued an order clarifying time frames and ordered that the proposed rule be issued within 90 days from March 26, 2018  HUD’s Lead Safe Housing Rule requires a stricter lead inspection standard for public housing than for voucher units  According to HUD staff, HUD does not have the authority to require the more stringent inspection in the voucher program  While HUD has acknowledged that moving to a stricter inspection standard for voucher units would provide greater assurance that these units are lead-safe and expressed its plan to support legislative change to authorize it to impose a more stringent inspection standard, HUD has not requested authority from Congress to amend its inspection standard for the voucher program  For voucher units, HUD requires PHAs to ensure that trained inspectors conduct visual assessments to identify deteriorated paint for housing units inhabited by a child under 6 years old  In a visual assessment, an inspector looks for deteriorated paint and visible surface dust but does not conduct any testing of paint chips or dust samples from surfaces to determine the presence of lead in the home’s paint  By contrast, for public housing units, HUD requires a stronger inspection process  Lead- based paint inspections are required for pre-1978 public housing units  If that inspection identifies lead-based paint, PHAs must then perform a risk assessment  In a risk assessment, in addition to conducting a visual inspection, an inspector tests for the presence of lead paint by collecting and testing samples of paint chips and surface dust, and typically using a specialized device (an X-ray fluorescence analyzer) to measure the amount of lead in the paint on a surface, such as a wall, door, or window sill  Staff from HUD’s Lead Office and the Office of General Counsel told us that Title X did not include specific risk assessment requirements for voucher units, and HUD does not believe, therefore, that it has the statutory authority to require an assessment more thorough than a visual assessment of voucher units  As of May 2018, HUD had not requested statutory authority to change the visual assessment standard used in the voucher program  However, HUD previously acknowledged the limitation of the weaker inspection standard in a June 2016 publication titled Lead- Safe Homes, Lead-Free Kids Toolkit  In this publication, HUD noted its plans to support legislative change to strengthen lead safety in voucher units by eliminating reliance on visual-only inspections  Staff from HUD’s Lead Office and Office of General Counsel told us the agency recognizes that risk assessments are more comprehensive than visual assessments  The staff noted that, by definition, a risk assessment is a stronger inspection standard than a visual-only assessment because it includes additional identification and testing  In responding to a draft of this report, HUD cited the need to conduct and evaluate the results of a statistically rigorous study on the impacts of requiring a lead risk assessment versus a visual assessment, such as the impact on leasing times and the availability of housing for low-income families  HUD further noted that such a study could explore whether alternative options to the full risk assessment standard (such as targeted dust sampling) could achieve similar levels of protection for children in the voucher program  Requesting and obtaining authority to amend the standard for the voucher program would not preclude HUD from doing such a study  Such analysis might support a range of options based on consideration of health effects for children, housing availability, and other relevant factors  Because HUD’s Lead Safe Housing Rule contains a weaker lead inspection standard for the voucher program children living in voucher units may be less protected from lead paint hazards than children living in public housing  By requesting and obtaining statutory authority to amend the voucher program inspection standard, HUD would be positioned to take steps to ensure that children in the voucher program are provided better protection as indicated by analysis of the benefits and costs from amending the standard  HUD has taken limited steps to measure, evaluate, and report on the performance of its programmatic efforts to ensure that housing is lead- safe  First, HUD has tracked one performance measure for its lead grant programs but lacks comprehensive performance goals and measures  Second, while HUD has evaluated the effectiveness of its Lead-Based Paint Hazard Control grant program, it has not formalized plans and does not have a time frame for evaluating its lead paint regulations  Third, HUD has not issued an annual report on the results of its lead efforts since 1997  A key aspect to promoting improved federal management and greater efficiency and effectiveness is that agencies set goals and report on performance  We have previously reported that a program performance assessment contains three key elements––program goals, performance measures, and program evaluations (see fig  5)  In our prior work, we have noted that both the executive branch and congressional committees need evaluative information to help them make decisions about the programs they oversee––information that tells them whether, and why, a program is working well or not  Program goals and performance measures  HUD has tracked one performance measure for making private housing units lead-safe as part of its lead grant programs but lacks goals and performance measures that more fully cover the range of its lead efforts  In addition to our prior work on program goals and performance measures, federal internal control standards state that management should define objectives clearly and that defining objectives in measurable terms allows agency management to assess performance toward achieving objectives  According to Lead Office staff, HUD provides information on its goals and performance measures related to its lead efforts in the agency’s annual performance reports  For example, the fiscal year 2016 report contains information about the number of private housing units made lead-safe as part of HUD’s lead grant programs but does not include any performance measures on HUD’s lead efforts for the voucher and public housing programs  Lead Office staff told us HUD does not have systems to count the number of housing units made lead-safe in these two housing programs  The staff said the Lead Office and PIH recently began discussing whether data from an existing HUD database could be used to count units made lead-safe within these programs  However, they could not provide additional details on the status of all these efforts  Without comprehensive goals and performance measures, HUD does not know the results it is achieving with all its lead paint hazard reduction efforts  Moreover, HUD may be missing opportunities to use performance information to improve the results of its lead efforts  Program evaluations  HUD has evaluated the effectiveness of its Lead- Based Paint Hazard Control grant program but has not taken similar steps to evaluate the Lead Safe Housing Rule or Lead Disclosure Rule  As previously stated, our prior work on program performance assessment has noted the importance of program evaluations to know how well a program is working relative to its objectives  Additionally, Title X required HUD to conduct research to evaluate the long-term cost-effectiveness of interim lead hazard control and abatement strategies  For its Lead-Based Paint Hazard Control Grant program, HUD has contracted with outside experts to conduct evaluations  For example, the National Center for Healthy Housing and the University of Cincinnati’s Department of Environmental Health evaluated whether the lead hazard control methods used by grantees continued to be effective 1, 3, 6, and 12 years later  The evaluations concluded that the lead hazard control activities used by grantees substantially reduced lead dust levels and the original evaluation and those completed 1 and 3 years later were also associated with substantial declines in the blood lead levels of children living in the housing remediated using lead grant program funds  HUD has general plans to conduct evaluations of the Lead Safe Housing Rule and the Lead Disclosure Rule, but Lead Office and PD&R staff said they did not know when or if the studies will begin  In a 2016 publication, HUD noted its plans to evaluate the Lead Safe Housing Rule requirements and noted that such an evaluation would contribute toward policy recommendations and program improvements  Additionally, in its 2017 Research Roadmap, PD&R outlined HUD’s plans for two studies to evaluate the effectiveness of requirements within the Lead Safe Housing and Lead Disclosure Rules  However, PD&R and Lead Office staff were not able to provide a time frame for when the studies would begin  PD&R staff told us that the plans noted within the Research Roadmap were HUD’s first step in research planning and prioritization but that appropriations for research have been prescriptive in recent years (i e , tied to specific research topics) and fell short of the agency’s research needs  By studying the effectiveness of requirements included within the Lead Safe Housing and Lead Disclosure Rules, including the cost- effectiveness of the various lead hazard control methods, HUD could have more complete information to assess how effectively it uses federal dollars to make housing units lead-safe  Reporting  HUD has not reported on its lead efforts as required since 1997  Title X includes annual and biennial reporting requirements for HUD  Staff from HUD’s Lead Office and General Counsel told us that in 1998 the agency agreed with the congressional committees of jurisdiction that HUD could satisfy this reporting requirement by including the required information in its annual performance reports  Lead Office staff told us HUD’s recent annual performance reports do not contain specific information required by law and that HUD has not issued other publicly available reports that contain the Title X reporting requirements  Title X requires HUD to annually provide Congress information on its progress in implementing the lead grant programs; a summary of studies looking at the incidence of lead poisoning in children living in HUD-assisted housing; the results of any required lead technical studies; and estimates of federal funds spent on lead hazard evaluation and reduction in HUD-assisted housing  As previously stated, the annual performance reports have provided information on the number of housing units made lead-safe through the agency’s lead grant programs, but not through the voucher or public housing programs  In March 2018, Lead Office staff told us HUD plans to submit separate reports on the agency’s lead effort, covering the Title X reporting requirements, starting in fiscal year 2019  By HUD complying with Title X statutory reporting requirements, Congress and the public will be in a position to better know the progress HUD is making toward ensuring that housing is lead-safe  Lead exposure can cause serious, irreversible cognitive damage that can impair a child for life  Through its lead grant programs and oversight of lead paint regulations, HUD is helping to address lead paint hazards in housing  However, our review identified specific areas where HUD could improve the effectiveness of its efforts to identify and address lead paint hazards and protect children in low-income housing from lifelong health problems: Documenting and evaluating grant processes  HUD could improve documentation for its lead grant programs’ processes by providing more specific direction to staff and documenting grant award rationale  In doing so, HUD could better ensure that grant program staff score grant applications consistently and appropriately and provide greater transparency about its award decisions  Additionally, periodically evaluating its grant processes and procedures could help HUD better ensure that its lead grants reach areas most at risk for lead paint hazards  Identifying areas at risk for lead hazards  By developing specific time frames to finalize and incorporate the results of its model to more fully identify areas at risk for lead paint hazards, HUD can better identify and conduct outreach to at-risk localities that its lead grant programs have not yet reached  Overseeing compliance with lead paint regulations  False self- certifications of compliance by some PHAs and other limitations in HUD’s compliance monitoring approach make it essential for HUD to develop a plan to mitigate and address limitations, as well as establish procedures to determine when enforcement decisions are needed  These actions could further strengthen HUD’s oversight and keep PHAs accountable for ensuring that housing units are lead-safe  Amending inspection standard in the voucher program  Children living in voucher units may receive less protection from lead paint hazards than children living in public housing units because HUD applies different lead inspection standards to the two programs  HUD could ensure that children in the voucher program are provided better protection from lead by requesting and obtaining statutory authority to amend the voucher program inspection standard as indicated by analysis of the benefits and costs of amending the standard  Assessing and reporting on performance  Fully incorporating key elements of performance assessment—by developing comprehensive goals, improving performance measures, and adhering to reporting requirements—could better enable HUD to assess its own progress and target its resources toward lead efforts that maximize impact  Additionally, HUD may be missing opportunities to inform the Congress and the public about how HUD’s lead efforts have helped reduce lead poisoning in children  We are making the following nine recommendations to HUD: The Director of HUD’s Lead Office should ensure that the office more fully documents its processes for scoring and awarding lead grants and its rationale for award decisions  (Recommendation 1) The Director of HUD’s Lead Office should ensure that the office periodically evaluates its processes for scoring and awarding lead grants  (Recommendation 2) The Director of HUD’s Lead Office, in collaboration with PD&R, should set time frames for incorporating relevant data on lead paint hazard risks into the lead grant programs’ processes  (Recommendation 3) The Director of HUD’s Lead Office and the Assistant Secretary for PIH should collaborate to establish a plan to mitigate and address risks within HUD’s lead paint compliance monitoring processes  (Recommendation 4) The Director of HUD’s Lead Office and the Assistant Secretary for PIH should collaborate to develop and document procedures to ensure that HUD staff take consistent and timely steps to address issues of PHA noncompliance with lead paint regulations  (Recommendation 5) The Secretary of HUD should request authority from Congress to amend the inspection standard to identify lead paint hazards in the Housing Choice Voucher program as indicated by analysis of health effects for children, the impact on landlord participation in the program, and other relevant factors  (Recommendation 6) The Director of the Lead Office should develop performance goals and measures to cover the full range of HUD’s lead efforts, including its efforts to ensure that housing units in its rental assistance programs are lead-safe  (Recommendation 7) The Director of the Lead Office, in conjunction with PD&R, should finalize plans and develop a time frame for evaluating the effectiveness of the Lead Safe Housing and Lead Disclosure Rules, including an evaluation of the long-term cost effectiveness of the lead remediation methods required by the Lead Safe Housing Rule  (Recommendation 8) The Director of the Lead Office should complete statutory reporting requirements, including but not limited to its efforts to make housing lead-safe through its lead grant programs and rental-assistance programs, and make the report publicly available  (Recommendation 9) We provided a draft of this report to HUD for review and comment  We also provided the relevant excerpts of the draft report to CDC and EPA for their review and technical comments  In written comments, reproduced in appendix III, HUD disagreed with one of our recommendations and generally agreed with the remaining eight  HUD and CDC also provided technical comments, which we incorporated as appropriate  EPA did not have any comments on the relevant excerpts of the draft report provided to them  In its general comments, HUD noted that the lead grant programs and HUD’s compliance assistance and enforcement of lead paint regulations have contributed significantly to, among other things, the low prevalence of lead-based paint hazards in HUD-assisted housing  Further, HUD said the lead grant programs and compliance assistance and enforcement of lead paint regulations have played a critical part in developing and maintaining the national lead-based paint safety infrastructure  HUD asked that this contextual information be included in the background of the report  The draft report included detailed information on the purpose and scope of HUD’s lead grant programs, two key regulations related to lead paint hazards, and efforts to make housing lead-safe  Furthermore, the draft report provided context on other federal agencies’ role in establishing relevant standards and guidelines for lead paint hazards  We made no changes in response to this comment because we did not think it was necessary for background purposes  HUD disagreed with the draft report’s sixth recommendation to request authority from Congress to use the risk assessment inspection standard to identify lead paint hazards in the Housing Choice Voucher program  As discussed in the report, HUD’s Lead Safe Housing Rule requires a more stringent lead inspection standard (risk assessments) for public housing than for Housing Choice Voucher units, for which a weaker inspection standard is used (visual assessments)  In its written comments, HUD said that before deciding whether to request the statutory authority to implement risk assessments for voucher units, it would need to conduct and evaluate the results of a statistically rigorous study on the impacts of requiring a lead risk assessment versus a visual assessment, such as the impact on leasing times and the availability of housing for low-income families  HUD further noted that such a study could explore whether alternative options to the full risk assessment standard (such as targeted dust sampling) could achieve similar levels of protection for children in the voucher program  We note that requesting and obtaining authority to amend the standard for the Housing Choice Voucher program would not preclude HUD from doing such a study  We acknowledge that the results of such a study might support a range of options  Therefore, we revised our recommendation to provide HUD with greater flexibility in how it might amend the lead inspection standard for the voucher program based on consideration of not only leasing time and availability of housing, as HUD emphasized in its written comments, but also based on the health effects on children  The need for HUD to review the lead inspection standard for the voucher program is underscored by the greater number of households with children served by the voucher program compared to public housing, as well as recent information indicating that more children with elevated blood lead levels are living in voucher units than in public housing  HUD generally agreed with our remaining eight recommendations and provided specific information about planned steps and other considerations related to implementing them  For example, in response to our first three recommendations on the lead grant programs, HUD outlined specific steps it plans to take, such as updating its guidance for scoring grant applications and reviewing its grant application scoring methods to identify potential improvements  In response to our fourth and fifth recommendations to the Director of HUD’s Lead Office on compliance monitoring and enforcement of lead paint regulations, HUD noted that PIH should be the primary office for these recommendations with the Lead Office providing support  While these recommendations had already recognized the need for the Lead Office to collaborate with PIH, we reworded them to clarify that it is not necessary for the Lead Office to have primary responsibility for their implementation  HUD generally agreed with our seventh and eighth recommendations, but noted some considerations for implementing them  For our seventh recommendation about performance goals and measures, HUD noted that it will re-examine the availability of information from the current housing databases to determine whether data on housing unit production can be added to the existing data collected  HUD noted if that information is not sufficient, it would need to obtain Office of Management and Budget approval and have sufficient funds for such an information technology project  For our eighth recommendation about evaluating the Lead Safe Housing and Lead Disclosure Rules, HUD noted if its own resources are insufficient, the time frame for implementing this recommendation may depend on the availability of funding for contracted resources  Finally, in response to our ninth recommendation, HUD said that it will draft and submit annual and biennial reports to the congressional authorizing and appropriations committees and then post the reports on the Lead Office’s public website  We are sending copies of this report to the appropriate congressional committees, the Secretary of the Department of Housing and Urban Development, the Administrator of the Environmental Protection Agency, and the Secretary of Health and Human Services, and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-8678 or garciadiazd@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix IV  Under the Department of Housing and Urban Development’s (HUD) Lead-Based Paint Hazard Control and the Lead Hazard Reduction Demonstration grant programs, HUD competitively awards grants to state and local jurisdictions, as authorized by the Residential Lead-Based Paint Hazard Reduction Act (Title X of the Housing and Community Development Act of 1992)  Title X requires each grant recipient to make matching contributions with state, local, and private funds (i e , nonfederal) toward the total cost of activities  For the Lead-Based Paint Hazard Control grant and the Lead Hazard Reduction Demonstration grant programs, the matching contribution has been set at no less than 10 percent and 25 percent, respectively, of the total grant amount  For example, if the total grant amount is $3 million, then state or local jurisdictions must provide at least $300,000 and $750,000, respectively, for each grant program, in additional funding toward the cost of activities  HUD requires lead grant applicants to include information on the sources and amounts of grantees’ matching contributions as part of their grant applications  Additionally, Title X requires HUD to award grants in part based on an applicant’s ability to leverage state, local, and private funds to supplement the federal grant funds  To identify the nonfederal funding sources grantees used in the lead hazard control grants, we selected and reviewed the lead grant applications of 20 HUD grantees and interviewed representatives from 10 of these  We selected these grantees based on their geographic locations; the number of HUD lead grants they had previously received; experience with HUD’s lead hazard control grants; and whether they have received both grants from 2013 through 2017  Grantees we selected included entities at the state, municipality, and county levels  Information from our grant application reviews and interviews of grantees cannot be generalized to all HUD grantees  Based on our review of the selected grant applications and interviews of selected grantees, we found that grantees planned to use the following types of nonfederal funding sources as their matching contributions to support their lead grants activities: State and local funds  Eighteen of the 20 grantees we selected noted that they planned to use state or local funding sources to supplement HUD’s grant funds  The state and local funding sources included state or local general funds and local property taxes or fees  For example, grantees in Connecticut, Baltimore, and Philadelphia used state or local general funds to cover personnel and operating costs  Additionally, grantees in Alameda County (California), Hennepin County (Minnesota), Malden, St  Louis, and Winnebago County (Illinois) planned to use local taxes, including property taxes or fees, such as real estate recording and building permit fees, to cover some costs associated with their lead hazard control grants activities  Community Development Block Grant funds  Ten of the 20 grantees we selected indicated that they planned to use Community Development Block Grant (CDBG) program funds to cover part of the costs of their lead hazard control grants  CDBG program funds can be used by states and local communities for housing; economic development; neighborhood revitalization; and other community development activities  For example, grantees in Baltimore and Memphis noted in their grant applications that they planned to use the funds to cover costs related to personnel, operations, and training  Nongovernmental contributions or discounts  Eight of 20 grantees we selected stated that they anticipated some forms of nongovernmental contributions from nonprofit organizations or discounts from contractors to supplement the lead grants  For example, all eight grantees stated that they expected to receive matching contributions from nonprofit organizations  Table 2 summarizes the nonfederal funds by source that the 20 selected grantees planned to use, based on our review of these grantees’ applications  Furthermore, almost all of the selected grantees stated in their grant applications or told us that they expected to receive or have received other nonfederal funds in excess of their matching contributions  For example, 15 grantees stated that they generally required or encouraged property owners or landlords to contribute toward the lead hazard remediation costs  Also, grantees in Baltimore, District of Columbia, Lewiston, and Providence indicated that they expected to receive monetary or in-kind donations from organizations to help carry out lead hazard remediation, blood lead-level testing, or training  Additionally, the grantee in Alameda County (California) told us that they have received nonfederal funds from a litigation settlement with a private paint manufacturer  This report examines the Department of Housing and Urban Development’s (HUD) efforts to (1) incorporate statutory requirements and other relevant federal standards in its lead grant programs; (2) monitor and enforce compliance with lead paint regulations for its rental assistance programs; (3) adopt federal health guidelines and environmental standards for lead hazards in its lead grant and rental assistance programs; and (4) measure and report on its performance related to making housing lead-safe  In this report, we examine lead paint hazards in housing, and we focus on HUD’s lead hazard control grant programs and its two largest rental assistance programs that serve the most families with children: the Housing Choice Voucher (voucher) and public housing programs  To address all four objectives, we reviewed relevant laws, such as the Residential Lead-Based Paint Hazard Reduction Act (Title X of the Housing and Community Development Act of 1992, referred to as Title X throughout this appendix) and relevant HUD regulations, such as the Lead Safe Housing Rule and a January 2017 amendment to this rule  To examine trends in funding for HUD’s lead grant programs for the past 10 years, we also reviewed HUD’s budget information for fiscal years 2008 through 2017  We interviewed HUD staff from the Office of Lead Hazard Control and Healthy Homes (Lead Office), Office of Public and Indian Housing (PIH), Office of Policy Development and Research (PD&R), and other relevant HUD program and field offices  Finally, we reviewed our prior work and those of HUD’s Office of Inspector General  To address the first objective, we reviewed HUD’s Notices of Funding Availability (funding notices), policies, and procedures to identify HUD’s grant award processes for the Lead-Based Paint Hazard Control grant and Lead Hazard Reduction Demonstration grant programs  For example, we reviewed HUD’s annual notices of funding availability from 2013 through 2017 to identify HUD’s scoring factors for evaluating grant applications  We compared HUD’s grant award processes in 2017 with Title X statutory requirements, the Office of Management and Budget (OMB) requirements for awarding federal grants, and relevant federal internal control standards  We also interviewed HUD staff about the agency’s grant application review and award processes  To determine the extent to which HUD’s grants have gone to counties in the United States potentially at high risk for lead paint hazards, we compared grantee locations from HUD’s lead grant data for grants awarded from 2013 through 2017 with county-level data on two indicators of lead paint hazard risk from the 2011–2015 American Community Survey—a continuous survey of households conducted by the U S  Census Bureau  We analyzed HUD’s grant data to determine the number and dollar amount of grants received by each grantee, and the grantees’ addresses  We then conducted a geographic analysis to determine whether each HUD lead grant went to a county that met at least one, both, or neither of the two commonly known indicators of lead paint hazard risk—the age of housing and poverty level  We identified these two indicators through a review of relevant academic literature, agency research, and state lead modelling methodologies  We used data from the 2011–2015 American Community Survey because the data covered a time frame that best aligned with the 5 years of lead grant data (2013 through 2017)  Using its county-level data, we calculated an estimated average percentage nationwide of housing units built before 1980 (56 9 percent) and an estimated average percentage nationwide of individuals living below the poverty level (17 5 percent)  We used 1980 as a benchmark for age of housing because the American Community Survey data for age of housing is separated by the decade of construction and 1980 was closest in time to the 1978 federal lead paint ban  We categorized counties based on whether their levels of pre-1980 housing and poverty were above one, both, or neither of the respective national average percentage for each indicator  The estimated average nationwide and county-level percentages of the two indicators (e g , older housing and poverty rate) are expressed as a range of values  For the lower and upper ends of the range, we generated a 95 percent confidence interval that was within plus or minus 20 percentage points  We classified a county as above the estimated average percentages nationwide if the county’s confidence interval was higher and did not overlap with the nationwide estimate’s confidence interval  We omitted the data for 12 counties that we determined were unreliable for our purposes  We analyzed data starting in 2013 because that was the first year for which these grant data were available electronically  We also interviewed HUD staff to understand their efforts and plans to perform similar analyses using indicators of lead paint hazard risk  To assess the reliability of HUD’s grant data, we reviewed documentation of HUD’s grant database, interviewed Lead Office staff on the processes HUD used to collect and ensure the reliability of the data, and tested the data for missing values, outliers, and obvious errors  To assess the reliability of the American Community Survey data, we reviewed statistical information from the Census Bureau and other publicly available documentation on the survey and conducted electronic testing of the data  We determined that the HUD grant data and American Community Survey county-level data on age of housing and poverty were sufficiently reliable for identifying areas at risk of lead paint hazards and determining the extent to which lead grants from 2013 through 2017 have gone to at-risk areas  Furthermore, to obtain information about how HUD works with grantees to achieve program objectives, we conducted in-person site visits to five grantees located in five localities (Alameda County, California; Atlanta, Georgia; Baltimore, Maryland; District of Columbia; and San Francisco, California); and interviewed an additional five grantees on the telephone (Hennepin County, Minnesota; Lewiston, Maine; Malden, Massachusetts; Providence, Rhode Island; and Winnebago County, Illinois)  In addition, we reviewed the grant applications of the 10 grantees we spoke to and an additional 10 grantees from 10 additional jurisdictions (State of Connecticut; Cuyahoga County, Ohio; Denver, Colorado; Monroe County, New York; Philadelphia, Pennsylvania; Memphis, Tennessee; San Antonio, Texas; St  Louis, Missouri; Tucson, Arizona; and State of Vermont)  We selected the 10 grantees for site visits or interviews based on the following criteria: geographic variation, number of years the grantees had HUD’s lead grants, and grantees that have received both types of lead grants from 2013 through 2017  We selected the 10 additional grantees’ applications for review based on geographic diversity and to achieve a total of two applications for each year during our 5-year time frame, with at least one application from each of the two HUD lead grant programs  As part of our review of selected grant applications, we identified nonfederal funding sources used by grantees, such as local tax revenues, contractor discounts, and property owner contributions  Information from the selected grantees and grant applications review cannot be generalized to those grantees we did not include in our review  Additionally, we interviewed representatives from housing organizations to obtain additional examples of any nonfederal funding sources, such as state or local bond measures, or low-interest loans to homeowners  To address the second objective, we also reviewed HUD guidance and internal memorandums related to its efforts to monitor and enforce compliance with lead paint regulations for public housing agencies (PHA), the entities that manage HUD’s voucher and public housing rental assistance programs  In addition, we reviewed HUD’s documentation of databases it uses to monitor compliance, including the Lead-Based Paint Response Tracker and the Elevated Blood Lead Level Tracker, and observed HUD staff’s demonstrations of these databases  HUD staff also provided a demonstration of the Record and Process Inspection Data database (known as “RAPID”) used by HUD’s Real Estate Assessment Center to collect physical inspection data for public housing units  We obtained and reviewed information from HUD about instances of potential noncompliance with lead paint regulations by PHAs as of November 2017 and enforcement actions HUD has taken  We compared HUD’s regulatory compliance monitoring and enforcement approach to federal internal control standards  We interviewed staff from HUD’s Lead Office, Office of General Counsel, Office of Field Operations, and field staff, including four HUD regional directors in areas of the country known to have a high prevalence of lead paint hazards, about internal procedures for monitoring and enforcing compliance with lead paint regulations by the PHAs within their respective regions  To address the third objective on HUD’s adoption of federal health guidelines and environmental standards for lead paint hazards in its lead grant and rental assistance programs, we reviewed relevant rules and HUD documentation  To identify relevant federal health guidelines and environmental standards, we reviewed guidelines and regulations from the Centers for Disease Control and Prevention (CDC) and the Environmental Protection Agency (EPA) and interviewed staff from each agency  To identify state and local laws with different requirements than these federal guidelines and standards, we obtained information from and interviewed staff from CDC’s Public Health Law Program and the National Conference of State Legislatures  We compared HUD’s requirements to CDC’s health guideline known as the “blood lead reference value” and EPA’s standards for lead-based paint hazards and lead-dust clearance standards  Finally, we reviewed information in HUD’s 2017 funding notices and lead grant programs’ policy guidance about requirements for grantees as they pertain to health guidelines and environmental standards  We also interviewed HUD staff about how HUD has used the findings from lead technical study grants to consider changes to HUD’s requirements and processes regarding identifying and addressing lead paint hazards for the grant programs  To address the fourth objective, we reviewed HUD documentation related to performance goals and measures, program evaluations, and reporting  For example, we reviewed HUD’s recent annual performance reports to identify goals and performance measures related to HUD’s efforts to make housing lead-safe  Further, we reviewed Title X to identify requirements related to evaluating and reporting on HUD’s lead efforts  We reviewed program evaluations and related studies completed by outside experts for the lead grant programs and interviewed staff from one of the organizations that conducted the evaluations  In addition, we interviewed Lead Office and PD&R staff about the agency’s plans to evaluate the requirements in the Lead Safe Housing Rule and reviewed corresponding agency documentation about these plans  Additionally, we reviewed the Lead Office’s most recent strategic plan (2009) and annual report (1997) on the agency’s lead efforts  We compared HUD’s use of performance goals and measures, program evaluations, and reporting against leading practices for assessing program performance and federal internal control standards  Finally, we interviewed staff from HUD to understand goals and performance measures used by the agency to assess their lead efforts  We conducted this performance audit from March 2017 to June 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  In addition to the contact named above, John Fisher (Assistant Director), Beth Faraguna (Analyst in Charge), Enyinnaya David Aja, Farah Angersola, Carol Bray, William R  Chatlos, Anna Chung, Melinda Cordero, Elizabeth Dretsch, Christopher Lee, Marc Molino, Rebecca Parkhurst, Tovah Rom, Tyler Spunaugle, and Sonya Vartivarian made key contributions to this report 

ground_truth: Lead paint in housing is the most common source of lead exposure for U.S. children. HUD awards grants to state and local governments to reduce lead paint hazards in housing and oversees compliance with lead paint regulations in its rental assistance programs. The 2017 Consolidated Appropriations Act, Joint Explanatory Statement, includes a provision that GAO review HUD’s efforts to address lead paint hazards. This report examines HUD’s efforts to (1) incorporate statutory requirements and other relevant federal standards in its lead grant programs, (2) monitor and enforce compliance with lead paint regulations in its rental assistance programs, (3) adopt federal health guidelines and environmental standards for its lead grant and rental assistance programs, and (4) measure and report on the performance of its lead efforts. GAO reviewed HUD documents and data related to its grant programs, compliance efforts, performance measures, and reporting. GAO also interviewed HUD staff and some grantees. The Department of Housing and Urban Development’s (HUD) lead grant and rental assistance programs have taken steps to address lead paint hazards, but opportunities exist for improvement. For example, in 2016, HUD began using new tools to monitor how public housing agencies comply with lead paint regulations. However, HUD could further improve efforts in the following areas: Lead grant programs. While its recent grant award processes incorporate statutory requirements on applicant eligibility and selection criteria, HUD has not fully documented or evaluated these processes. For example, HUD’s guidance is not sufficiently detailed to ensure consistent and appropriate grant award decisions. Better documentation and evaluation of HUD’s grant program processes could help ensure that lead grants reach areas at risk of lead paint hazards. Further, HUD has not developed specific time frames for using available local-level data to better identify areas of the country at risk for lead paint hazards, which could help HUD target its limited resources. Oversight. HUD does not have a plan to mitigate and address risks related to noncompliance with lead paint regulations by public housing agencies. We identified several limitations with HUD’s monitoring efforts, including reliance on public housing agencies’ self-certifying compliance with lead paint regulations and challenges identifying children with elevated blood lead levels. Additionally, HUD lacks detailed procedures for addressing noncompliance consistently and in a timely manner. Developing a plan and detailed procedures to address noncompliance with lead paint regulations could strengthen HUD’s oversight of public housing agencies. Inspections. The lead inspection standard for the Housing Choice Voucher program is less strict than that of the public housing program. By requesting and obtaining statutory authority to amend the standard for the voucher program, HUD would be positioned to take steps to better protect children in voucher units from lead exposure as indicated by analysis of benefits and costs. Performance assessment and reporting. HUD lacks comprehensive goals and performance measures for its lead reduction efforts. In addition, it has not complied with annual statutory reporting requirements, last reporting as required on its lead efforts in 1997. Without better performance assessment and reporting, HUD cannot fully assess the effectiveness of its lead efforts. GAO makes nine recommendations to HUD including to improve lead grant program and compliance monitoring processes, request authority to amend its lead inspection standard in the voucher program, and take additional steps to report on progress. HUD generally agreed with eight of the recommendations. HUD disagreed that it should request authority to use a specific, stricter inspection standard. GAO revised this recommendation to allow HUD greater flexibility to amend its current inspection standard as indicated by analysis of the benefits and costs.