HUD Handbook 4350.3 § 9-20
Security Training (HUD Occupancy Handbook 4350.3 REV-1 CHG-4)
Operative Text
A. EIV users are required to complete online security training annually. To meet
this requirement, EIV users must complete the online Cyber-Awareness
Challenge (for DoD and Federal Personnel) training program. At the end of the
training, EIV users must print and maintain the Certificate of Completion
provided. The training can be found at
http://iase.disa.mil/eta/index.html#onlinetraining.
EIV users authorized by owners to have access to EIV on their behalf may also
need to complete the applicable online Security Awareness Training
Questionnaire for Multifamily Housing Programs upon initial access to the system
and annually thereafter.
B. EIV users should:
1. Review Section 4 on Security contained in the Multifamily EIV User
Manual for Multifamily Housing Program Users posted at:
http://www.hud.gov/offices/hsg/mfh/rhiip/eiv/usermanual.pdf,
2. Review the EIV Security Administration Manual posted at:
http://www.hud.gov/offices/hsg/mfh/rhiip/eiv/securityadminmanual.pdf
3. View the Security training provided during the most recent EIV webcast,
posted at:
http://portal.hud.gov/hudportal/HUD?src=/webcasts/archives/multifamily
C. Owner and management agent staff who do not have access to EIV but who use
EIV reports to perform their job function must have security training annually.
9-21 Safeguarding EIV Data
A. Technical Safeguards
1. All individuals who have access to the EIV system must have a valid
WASS User ID and password and must use this ID and password for
accessing the EIV system. Upon receipt of the assigned WASS User ID,
an individual must then apply to be approved for access to the EIV
system.
2. To assist in ensuring that only those individuals who have a need to use
the EIV system to perform their job function have access to the EIV
system, users must be certified to use the system:
a. EIV Coordinators are certified at initial access and annually
thereafter.
b. EIV Users are certified at initial access and bi-annually thereafter.
If this certification is not made, the user’s EIV access is terminated.
3. A Security Awareness Training Questionnaire, which supplements
required annual security training, may be completed at the time of initial
access to the system and annually thereafter. The EIV system is
designed with the ability to block the entry of those individuals who have
not successfully completed the questionnaire (i.e., answered 90 percent
of the questions correctly).
B. Administrative Safeguards
1. Policies and procedures must be established to govern the use of the EIV
system. These procedures should address:
a. Authorized use of the EIV system;
b. How to handle security breaches; and
c. Destruction of EIV data.
2. EIV manuals and the instructions in this handbook should be reviewed
when implementing these administrative safeguards.
3. Posting of bulletins and flyers can assist in communicating how sensitive
EIV data is and how this data should be handled.
C. Physical Safeguards
Physical safeguarding of EIV data refers to steps that must be taken to help
ensure the data is safe when stored electronically or in hardcopy and when
transmitting data electronically.
1. Storing and Transmitting of Electronic EIV Data
a. EIV data stored electronically must be in a restricted access
directory or, if placed on portable media, labeled appropriately and
encrypted using a NIST compliant vendor. Similarly, all emails
containing EIV data must be encrypted using a NIST compliant
vendor. A list of compliant vendors can be found at:
http://csrc.nist.gov/groups/STM/cmvp/documents/140-
1/1401vend.htm.
b. The full nine-digit SSN for a tenant must not be included in emails
or other electronic communications.
NOTE: The downloading of EIV data to mobile devices is not allowed for
IPAs.
2. Hardcopy EIV Data
EIV data that is printed out must not be left unattended. The documents
should be retrieved as soon as they are printed and, if possible, use a
restricted printer, copier, or facsimile machine. When faxing EIV data,
ensure there is someone waiting and ready to retrieve the fax as soon as
it is received (printed). When mailing EIV data, the data must be sent to
an office of the owner/management agent. EIV data must not be mailed to
Independent Public Auditor offices.
3. Computer Security
The EIV system is set up to time out after 30 minutes of inactivity. This
automatic safeguard should not be the only security measure taken.
Individuals who use the EIV system should use a password protected
screensaver and lock their computer when leaving their workspace. A
user should not leave a computer unattended with EIV data displayed on
the screen. It is also recommended that the EIV system be exited using
the “X” at the top right of the screen which will remove the user from the
entire WASS system.
4. Destroying EIV data
EIV data must be destroyed as soon as it has served its purpose as
prescribed by HUD’s policies and procedures and in accordance with
HUD’s prescribed retention period. Shredding, burning or pulverizing are
all examples of acceptable ways to destroy EIV data.
9-22 Resource Materials
This section summarizes some of the resources available to EIV users. Owners should
visit the Multifamily EIV website often for updated documents and/or announcements.
Multifamily EIV website:
http://portal.hud.gov/hudportal/HUD?src=/program_offices/housing/mfh/rhiip/eiv/e
ivhome
EIV Multifamily Help Desk
Telephone: 1-800-767-7588
Email: Mf_Eiv@hud.gov
Enterprise Income Verification System User Manual for Multifamily Housing
Program Users http://www.hud.gov/offices/hsg/mfh/rhiip/eiv/usermanual.pdf
Rental Housing Integrity Improvement Project (RHIIP) website:
http://portal.hud.gov/hudportal/HUD?src=/program_offices/housing/mfh/rhiip/mfhr
hiip
Resolving Income Discrepancies Between Enterprise Income Verification (EIV)
System Data and Tenant-Provided Income Information”
http://www.hud.gov/offices/hsg/mfh/rhiip/eiv/reqnguide.cfm
EIV webcasts
http://portal.hud.gov/portal/page/portal/HUD/webcasts/archives/multifamily
EIV training provided to HUD RHIIP Help Desk Representatives and Contract
Administrators.
http://portal.hud.gov/hudportal/HUD?src=/program_offices/housing/mfh/rhiip/mfhr
hiip
A Guide to Interviewing for Owners of HUD Subsidized Multifamily Housing
Projects
http://www.hud.gov/offices/hsg/mfh/rhiip/interviewguide.pdf
Rent and Income Determination Quality Control Monitoring Guide for Multifamily
Housing Programs
http://www.hud.gov/offices/hsg/mfh/rhiip/qcguide.pdf
EIV & You brochure
http://www.hud.gov/offices/hsg/mfh/rhiip/eivbrochure.pdf
EIV Multifamily Housing Programs Security Administration Manual
http://www.hud.gov/offices/hsg/mfh/rhiip/eiv/eivapps.cfm
Mf_eiv_comments@hud.gov mailbox to provide suggestions on how to improve
the EIV systemHUD Handbook 4350.3 REV-1 CHG-4 § 9-20 establishes that anyone who accesses or uses the Enterprise Income Verification (EIV) system — including owner and management agent staff — must complete annual security training and follow a layered set of technical, administrative, and physical safeguards to protect sensitive tenant data. The provision requires annual online cyber-awareness training with a printed Certificate of Completion, certified user credentials, encrypted storage and transmission of EIV data, and proper destruction of records once they have served their purpose. Full nine-digit Social Security Numbers may not be included in emails or other electronic communications, and EIV data must never be left unattended in printed or on-screen form.
Plain English — not legal advice.
Under HUD Handbook 4350.3 REV-1 CHG-4 § 9-20, compliant owners and management agents ensure that all staff who access or use EIV reports complete the required annual security training and maintain their Certificates of Completion on file. Operators establish written policies and procedures covering authorized system use, security breach response, and data destruction, and they verify that EIV Coordinators and Users are recertified on the required schedule to avoid automatic termination of system access. Physical and technical controls — such as restricted-access directories, NIST-compliant encryption for stored and transmitted data, password-protected workstations, and cross-cut shredding of printed reports — are standard practices for properties operating in compliance with this section.
General guidance for property managers — not legal advice for your specific situation. Consult an attorney for advice on your case.
HUD Handbook 4350.3 REV-1 CHG-4 § 9-20 and its companion provisions are designed to protect the sensitive personal and income data — including Social Security Numbers — that HUD-assisted properties collect and verify through the EIV system. Tenants whose information is handled under these rules have an interest in knowing that the regulation prohibits transmitting full SSNs by email, requires encrypted storage, and mandates secure destruction of records once they are no longer needed. Tenants who believe their personal data has been mishandled at a HUD-assisted property may contact the EIV Multifamily Help Desk (1-800-767-7588) or reach out to HUD directly, and may also consult a tenant-rights organization for guidance on available options.
General guidance for tenants — not legal advice for your specific situation. Consult a tenant-rights organization or attorney for advice on your case.
Generated September 30, 2026 — auto-generated, not yet human-reviewed. See /transparency for methodology.
Effective Timeline
References Out
No outbound references recorded yet for this provision.
References In
No inbound references recorded yet for this provision.