Information Security and Privacy: HUD Needs a Major Effort to Protect Data Shared with External Entities, Report to Congressional Committees [open pdf - 908KB]
From the Highlights: "To administer housing, community investment, and mortgage loan programs, HUD [Department of Housing and Urban Development] collects a vast amount of sensitive personal information and shares it with external entities, including federal agencies, contractors, and state, local, and tribal organizations. In 2016, HUD reported two incidents that compromised sensitive information. House Report 115-237, referenced by the Consolidated Appropriations Act, 2018, included a provision for GAO [Government Accountability Office] to evaluate HUD's information security framework for protecting information within these programs. The objectives were to (1) assess the effectiveness of HUD's policies and procedures for overseeing the security and privacy of sensitive information exchanged with external entities; and (2) determine the extent to which HUD was able to identify external entities that process, store, and share sensitive information with applicable systems."
Government Accountability Office: https://www.gao.gov/