HUD Handbook 4350.3 § 9-20

A.       EIV users are required to complete online security training annually. To meet
                  this requirement, EIV users must complete the online Cyber-Awareness
                  Challenge (for DoD and Federal Personnel) training program. At the end of the
                  training, EIV users must print and maintain the Certificate of Completion
                  provided. The training can be found at
                  http://iase.disa.mil/eta/index.html#onlinetraining.

                  EIV users authorized by owners to have access to EIV on their behalf may also
                  need to complete the applicable online Security Awareness Training
                  Questionnaire for Multifamily Housing Programs upon initial access to the system
                  and annually thereafter.

HUD Multifamily Occupancy Handbook                      9-35                                       8/13
Chapter 9: Enterprise Income Verification (EIV)

Penalties for Failure to Have Access to or Failure to Use EIV

B.       EIV users should:

                  1.       Review Section 4 on Security contained in the Multifamily EIV User
                           Manual for Multifamily Housing Program Users posted at:
                           http://www.hud.gov/offices/hsg/mfh/rhiip/eiv/usermanual.pdf,

                  2.       Review the EIV Security Administration Manual posted at:
                           http://www.hud.gov/offices/hsg/mfh/rhiip/eiv/securityadminmanual.pdf

                  3.       View the Security training provided during the most recent EIV webcast,
                           posted at:
                           http://portal.hud.gov/hudportal/HUD?src=/webcasts/archives/multifamily

         C.       Owner and management agent staff who do not have access to EIV but who use
                  EIV reports to perform their job function must have security training annually.

9-21 Safeguarding EIV Data

         A.       Technical Safeguards

                  1.       All individuals who have access to the EIV system must have a valid
                           WASS User ID and password and must use this ID and password for
                           accessing the EIV system. Upon receipt of the assigned WASS User ID,
                           an individual must then apply to be approved for access to the EIV
                           system.

                  2.       To assist in ensuring that only those individuals who have a need to use
                           the EIV system to perform their job function have access to the EIV
                           system, users must be certified to use the system:

                           a.       EIV Coordinators are certified at initial access and annually
                                    thereafter.

                           b.       EIV Users are certified at initial access and bi-annually thereafter.

                           If this certification is not made, the user’s EIV access is terminated.

                  3.       A Security Awareness Training Questionnaire, which supplements
                           required annual security training, may be completed at the time of initial
                           access to the system and annually thereafter. The EIV system is
                           designed with the ability to block the entry of those individuals who have
                           not successfully completed the questionnaire (i.e., answered 90 percent
                           of the questions correctly).

         B.       Administrative Safeguards

                  1.       Policies and procedures must be established to govern the use of the EIV
                           system. These procedures should address:

HUD Multifamily Occupancy Handbook                      9-36                                          8/13
Chapter 9: Enterprise Income Verification (EIV)

Penalties for Failure to Have Access to or Failure to Use EIV

a.       Authorized use of the EIV system;

                           b.       How to handle security breaches; and

                           c.       Destruction of EIV data.

                  2.       EIV manuals and the instructions in this handbook should be reviewed
                           when implementing these administrative safeguards.

                  3.       Posting of bulletins and flyers can assist in communicating how sensitive
                           EIV data is and how this data should be handled.

         C.       Physical Safeguards

                  Physical safeguarding of EIV data refers to steps that must be taken to help
                  ensure the data is safe when stored electronically or in hardcopy and when
                  transmitting data electronically.

                  1.       Storing and Transmitting of Electronic EIV Data

                           a.       EIV data stored electronically must be in a restricted access
                                    directory or, if placed on portable media, labeled appropriately and
                                    encrypted using a NIST compliant vendor. Similarly, all emails
                                    containing EIV data must be encrypted using a NIST compliant
                                    vendor. A list of compliant vendors can be found at:
                                    http://csrc.nist.gov/groups/STM/cmvp/documents/140-
                                    1/1401vend.htm.

                           b.       The full nine-digit SSN for a tenant must not be included in emails
                                    or other electronic communications.

                           NOTE: The downloading of EIV data to mobile devices is not allowed for
                           IPAs.

                  2.       Hardcopy EIV Data

                           EIV data that is printed out must not be left unattended. The documents
                           should be retrieved as soon as they are printed and, if possible, use a
                           restricted printer, copier, or facsimile machine. When faxing EIV data,
                           ensure there is someone waiting and ready to retrieve the fax as soon as
                           it is received (printed). When mailing EIV data, the data must be sent to
                           an office of the owner/management agent. EIV data must not be mailed to
                           Independent Public Auditor offices.

                  3.       Computer Security

                           The EIV system is set up to time out after 30 minutes of inactivity. This
                           automatic safeguard should not be the only security measure taken.
                           Individuals who use the EIV system should use a password protected
                           screensaver and lock their computer when leaving their workspace. A

HUD Multifamily Occupancy Handbook                      9-37                                        8/13
Chapter 9: Enterprise Income Verification (EIV)

user should not leave a computer unattended with EIV data displayed on
                          the screen. It is also recommended that the EIV system be exited using
                          the “X” at the top right of the screen which will remove the user from the
                          entire WASS system.

                 4.       Destroying EIV data

                          EIV data must be destroyed as soon as it has served its purpose as
                          prescribed by HUD’s policies and procedures and in accordance with
                          HUD’s prescribed retention period. Shredding, burning or pulverizing are
                          all examples of acceptable ways to destroy EIV data.

9-22 Resource Materials

        This section summarizes some of the resources available to EIV users. Owners should
        visit the Multifamily EIV website often for updated documents and/or announcements.

                Multifamily EIV website:
                 http://portal.hud.gov/hudportal/HUD?src=/program_offices/housing/mfh/rhiip/eiv/e
                 ivhome

                EIV Multifamily Help Desk
                 Telephone: 1-800-767-7588
                 Email: Mf_Eiv@hud.gov

                Enterprise Income Verification System User Manual for Multifamily Housing
                 Program Users http://www.hud.gov/offices/hsg/mfh/rhiip/eiv/usermanual.pdf

                Rental Housing Integrity Improvement Project (RHIIP) website:
                 http://portal.hud.gov/hudportal/HUD?src=/program_offices/housing/mfh/rhiip/mfhr
                 hiip

                Resolving Income Discrepancies Between Enterprise Income Verification (EIV)
                 System Data and Tenant-Provided Income Information”
                 http://www.hud.gov/offices/hsg/mfh/rhiip/eiv/reqnguide.cfm

                EIV webcasts
                 http://portal.hud.gov/portal/page/portal/HUD/webcasts/archives/multifamily

                EIV training provided to HUD RHIIP Help Desk Representatives and Contract
                 Administrators.
                 http://portal.hud.gov/hudportal/HUD?src=/program_offices/housing/mfh/rhiip/mfhr
                 hiip

                A Guide to Interviewing for Owners of HUD Subsidized Multifamily Housing
                 Projects

HUD Multifamily Occupancy Handbook                 9-38                                          8/13
Chapter 9: Enterprise Income Verification (EIV)

http://www.hud.gov/offices/hsg/mfh/rhiip/interviewguide.pdf

                Rent and Income Determination Quality Control Monitoring Guide for Multifamily
                 Housing Programs
                 http://www.hud.gov/offices/hsg/mfh/rhiip/qcguide.pdf

                EIV & You brochure
                 http://www.hud.gov/offices/hsg/mfh/rhiip/eivbrochure.pdf

                EIV Multifamily Housing Programs Security Administration Manual
                 http://www.hud.gov/offices/hsg/mfh/rhiip/eiv/eivapps.cfm

                Mf_eiv_comments@hud.gov mailbox to provide suggestions on how to improve
                 the EIV system

HUD Multifamily Occupancy Handbook                9-39                                       8/13
Chapter 9: Enterprise Income Verification (EIV)