The inspector general for the Federal Reserve Board and the Consumer Financial Protection Bureau (CFPB) has rated the bureau's information security program "not effective" for a second straight year, Reuters reported in a story carried by Insurance Journal. The CFPB holds millions of consumer complaints and confidential supervisory records on banks and lenders, so weak controls there are a third-party risk for every institution it oversees.
What Happened
The audit, "CFPB: 2026 Information Security Program Audit," dated Oct. 27, measured the bureau against metrics required under the Federal Information Security Modernization Act, or FISMA, the law that mandates annual independent reviews of agency security. The bureau scored a maturity level of 2 out of 5, meaning its program is defined on paper but not consistently carried out. Level 4 is the bar for an effective program.
Auditors found several actively used datasets missing from the bureau's data inventory, with more than 50 others awaiting staff verification. The CFPB did not fix critical and high-severity software vulnerabilities within the required 30 days, and its risk strategy, security policies and impact analyses for nine newly authorized systems have gaps or are outdated. Hardware left at regional offices vacated in 2025 was not properly inventoried, echoing a separate report last month.
The inspector general made eight new recommendations, which the CFPB accepted. Ten of 14 unresolved recommendations from earlier audits remain open, though the office is reviewing evidence that could close nine of them.
Why It Matters
The 2025 audit found the program "no longer effective" after its maturity declined, so this is a persistent problem, not a one-year dip. The inspector general wrote that falling staff levels since 2024 hindered key work: data inventory management now rests with one person, and enterprise risk management activities were suspended from March 2025 until June 2026. The audit follows nearly two years of office closures, canceled contracts and staff cuts under the Trump administration, Reuters noted.
Christopher Chilbert, the bureau's chief information officer, said the agency had no major incidents involving personal information in the last fiscal year and has already addressed most of the recommendations, Reuters reported.
What to Watch
Watch whether the inspector general closes the nine older recommendations under review, how fast the bureau clears its vulnerability backlog, and whether next year's audit moves the program above level 2.
