The 2025 EIV Cyber Awareness Challenge is the mandatory annual cybersecurity training required by the U.S. Department of Housing and Urban Development (HUD) for all Enterprise Income Verification (EIV) system users. It educates housing professionals on safeguarding sensitive income, tax, and personal identity data while fulfilling federal compliance mandates for system access.
Understanding HUD EIV and the Annual Cybersecurity Mandate
The Enterprise Income Verification (EIV) system is a web-based repository managed by HUD that provides Public Housing Authorities (PHAs), Multifamily Housing owners, and management agents (O/As) with automated access to employment and income data. Designed to confirm tenant eligibility and calculate subsidy amounts accurately, EIV aggregates highly confidential data feeds from the Social Security Administration (SSA) and the Department of Health and Human Services (HHS) National Directory of New Hires (NDNH).
Because EIV handles extensive Personally Identifiable Information (PII) and federal tax details, access to the portal is strictly regulated under the Privacy Act of 1974 and the Federal Information Security Modernization Act (FISMA). To protect federal network infrastructure and prevent unauthorized disclosure of sensitive tenant records, HUD requires every individual who requests or maintains active EIV user credentials to complete annual cybersecurity awareness training.
The standardized training curriculum used across federal agencies is the Cyber Awareness Challenge, developed by the Defense Information Systems Agency (DISA). The 2025 iteration of this course emphasizes evolving cybersecurity risks—such as sophisticated social engineering attacks, credential harvest schemes, and improper data destruction—ensuring that property managers and housing specialists remain equipped to mitigate digital threats.
Who Must Complete the 2025 Cyber Awareness Challenge?
Annual completion of the Cyber Awareness Challenge is mandatory for any individual whose job duties require logging into HUD's Secure Systems portal (formerly known as WASS, the Web Access Security System) to view, manage, or audit EIV data.
- HUD Secure Systems User / EIV User
- Step 1: Complete DoD Cyber Awareness Challenge (Annual)
- Step 2: Sign EIV Rules of Behavior (HUD-52671 / ROB)
- Step 3: Recertify Account in Secure Systems (Every 365 Days)
The requirement applies across multiple organizational roles within the assisted housing sector:
- EIV System Coordinators: Designated administrators responsible for granting, recertifying, or terminating EIV access rights for staff members within a housing organization.
- EIV Users: Site managers, occupancy specialists, reexamination clerks, and intake coordinators who access tenant income reports to perform annual or interim tenant recertifications.
- Public Housing Authority (PHA) Staff: Directors, housing managers, and compliance specialists overseeing Public Housing and Housing Choice Voucher (HCV) programs.
- Third-Party Contractors and Auditors: Independent public accountants (IPAs), management consultants, and contract administrators reviewing property files for Management and Occupancy Reviews (MORs).
Failure to maintain an active, unexpired training certificate results in the immediate suspension or permanent revocation of EIV system access. HUD guidelines require accounts to be locked if recertification does not occur within a strict 365-day window from the prior completion date.
Key Modules and Learning Objectives in the 2025 Challenge
The 2025 Cyber Awareness Challenge provides interactive, scenario-based learning modules designed to simulate real-world cybersecurity hazards. While broad enough to cover federal IT infrastructure, the course directly addresses operational risks faced daily in property management offices.
1. Phishing and Social Engineering Countermeasures
The 2025 training places heavy emphasis on recognizing sophisticated phishing attempts, spear-phishing tailored to housing administrators, and phone-based social engineering (vishing). Trainees learn to inspect email header data, recognize deceptive domain names impersonating HUD or software vendors, and report suspicious communications through appropriate organizational channels rather than clicking embedded links.
2. Safeguarding Personally Identifiable Information (PII)
Because EIV reports expose social security numbers, wage histories, and benefit distributions, PII protection remains a central focus. The course outlines legal parameters for storing, transmitting, and destroying physical and digital records containing sensitive data. Key protocols include prohibiting the emailing of unencrypted EIV reports and enforcing strict clean-desk policies for printed tenant files.
3. Identity, Credentials, and Access Management (ICAM)
Users receive instruction on robust authentication security. This includes configuring strong passphrases, leveraging multi-factor authentication (MFA) devices, avoiding password reuse across corporate and federal systems, and properly logging out of HUD Secure Systems sessions when leaving workstations unattended.
4. Mobile Device Security and Remote Work Risks
With remote property management and hybrid work environments widespread, the 2025 module updates guidelines for accessing corporate networks over public Wi-Fi networks. It highlights mandatory Virtual Private Network (VPN) usage, proper endpoint encryption, and physical security measures required when reviewing sensitive tenant information outside a secure office environment.
Step-by-Step Guide to Completing and Verifying the Course
To complete the 2025 EIV Cyber Awareness Challenge and submit verification to your housing organization or HUD coordinator, follow standard federal training workflow procedures:
- Access the Official Portal: Navigate to the official DoD Cyber Exchange Training Portal or your housing authority’s approved Learning Management System (LMS) host.
- Launch the Interactive Module: Select the public, non-CAC (Common Access Card) version of the Cyber Awareness Challenge course unless your agency provides dedicated single sign-on credentials.
- Work Through the Scenarios: Progress through all interactive vignettes, completing knowledge checks covering identity theft, insider threats, cloud security, and physical workstation security.
- Pass the Final Knowledge Assessment: Complete the comprehensive evaluation at the conclusion of the course to verify mastery of the material.
- Download and Print the Certificate: Upon successful completion, generate the PDF Certificate of Completion. Ensure that your full legal name matching your HUD Secure Systems account appears accurately on the document.
- Submit to the EIV Coordinator: Provide a copy of the unexpired certificate along with your signed EIV Rules of Behavior to your EIV System Coordinator for account activation or annual recertification.
EIV Access Security Package Checklist
Maintaining compliance with HUD security protocols requires assembling a complete EIV Access Security Package for every employee with system permissions. The table below outlines the core documentation items required during HUD Management and Occupancy Reviews (MORs) or Inspector General audits.
| Security Document | Required Action | Target Role | Renewal Frequency | Audit Retention Period |
|---|---|---|---|---|
| DoD Cyber Awareness Certificate | Complete online training and obtain official completion PDF | All EIV Users & Coordinators | Annually (Every 365 Days) | 3 years post-account termination |
| Form HUD-52671 | Complete and sign Access Authorization Request form | Multifamily Users & Coordinators | Initial setup & role change | 3 years post-account termination |
| Rules of Behavior (ROB) | Review and execute written acceptance of security protocols | All EIV Users & Coordinators | Annually | 3 years post-account termination |
| Written Authorization Letter | Official owner/agent authorization on property letterhead | External Coordinators & Agents | Annually | 3 years post-account termination |
| Secure Systems Recertification | Online administrative recertification inside Secure Systems | System Coordinators | Semi-annually / Annually | Kept in system log files |
Common Compliance Errors and Troubleshooting
Despite clear guidelines, housing organizations frequently encounter administrative hurdles when managing annual EIV security renewals. Addressing these common pitfalls ensures uninterrupted access to essential tenant verification records.
Name Discrepancies on Certificates
A common cause of audit non-compliance occurs when the name listed on the Cyber Awareness Challenge certificate does not match the user's official legal name registered in HUD Secure Systems (WASS). Coordinators must verify that usernames, middle initials, and surnames align precisely across HUD Form 52671, the training certificate, and internal personnel files.
The 365-Day Expiration Gap
HUD mandates that cybersecurity training remain current within a strict 365-day timeframe. If a staff member completed the challenge on March 1, 2024, their certification expires on March 1, 2025. Allowing training to lapse—even by a single day—requires the EIV Coordinator to disable the user's access rights immediately until a valid 2025 completion certificate is uploaded and verified.
Misplaced Audit Trail Documentation
During a Management and Occupancy Review (MOR), HUD reviewers or Performance-Based Contract Administrators (PBCAs) verify physical and digital security files. Property managers frequently fail audits not because staff lacked training, but because historical certificates were misplaced after an employee left the company. All training records and signed Rules of Behavior must be retained for a minimum of three years following the termination of access rights.
Frequently Asked Questions
How often must EIV users complete the Cyber Awareness Challenge?
EIV users and coordinators must complete the Cyber Awareness Challenge at least once every 365 days. Housing organizations often schedule group training sessions annually to align all staff renewal dates and avoid sudden account suspensions.
Can alternative corporate cybersecurity courses substitute for the DoD Challenge?
Alternative corporate security courses are generally not acceptable unless specifically approved in writing by HUD's Office of Housing or Public and Indian Housing (PIH). To guarantee compliance during federal audits, property management organizations should rely on the official DISA DoD Cyber Awareness Challenge.
What happens if an EIV user's certificate expires?
If a user's annual training certificate expires, their EIV System Coordinator must terminate or suspend their active access permissions in HUD Secure Systems. The account cannot be reactivated until the user completes the updated 2025 course and submits proof of completion.
Is there a fee to take the 2025 Cyber Awareness Challenge?
No. The Cyber Awareness Challenge provided via the DoD Cyber Exchange training portal is a free public resource provided by the U.S. federal government for official users, contractors, and agency-regulated partner organizations.
What are the file retention rules for EIV cybersecurity certificates?
Training certificates, signed EIV Rules of Behavior (ROB), and Form HUD-52671 documents must be retained in the property’s secure EIV Security File for the duration of the user's employment plus a minimum of three years after EIV access has been revoked.
Recommended Next Actions for Housing Managers
To ensure continuous compliance and protect sensitive tenant records throughout 2026, property owners, management agents, and PHA directors should take the following steps:
- Audit Existing User Files: Review all active EIV user profiles in HUD Secure Systems to confirm that every assigned user has a valid 2025 Cyber Awareness Challenge certificate on file.
- Establish Recertification Reminders: Implement an automated tracking schedule 30 to 60 days in advance of each employee’s 365-day training expiration date to prevent access lapses.
- Enforce Storage Hygiene: Maintain centralized, encrypted digital folders and hard-copy compliance binders containing signed Rules of Behavior and completion certificates for immediate presentation during MOR evaluations.
- Review Security Policies: Periodically update internal Standard Operating Procedures (SOPs) regarding password policies, clean-desk standards, and the secure disposal of printed EIV income reports.
