On October 27, the Fed’s Office of Inspector General (OIG) released its 2026 audit of the CFPB’s information security program under the Federal Information Security Modernization Act of 2014, concluding that the program is not effective. The OIG rated the program at a level-2 (“defined”) maturity, the same rating it assigned in 2025 (previously covered by InfoBytes here), short of the level-4 (“managed and measurable”) rating that the Office of Management and Budget considers effective. The OIG identified weaknesses in three areas: (i) asset inventories, including datasets missing from the CFPB’s data inventory and hardware at vacated regional offices that may not be secure (covered here); (ii) risk management framework processes, including system security plans in the CFPB’s governance, risk, and compliance tool that reflect outdated National Institute of Standards and Technology control baselines, and the CFPB’s failure to remediate a significant number of critical and high-severity vulnerabilities; and (iii) policies and guidelines that are outdated or contain gaps. The OIG also reported that 10 of 14 unresolved recommendations from prior audits remain open. According to the OIG, the CFPB submitted evidence after fieldwork to close nine of them, which the OIG is reviewing. The OIG noted that reduced staffing since 2024 has hindered the CFPB’s ability to perform key activities.

To address these issues, the OIG issued eight new recommendations: seven directed to the CFPB’s chief information officer (CIO) and one to the chief risk officer in conjunction with the CIO. The recommendations focus on strengthening asset inventory management, implementing an effective risk management framework, and aligning security policies with current federal standards. The CIO concurred with the findings and recommendations, and the CFPB’s response described steps taken after fieldwork to strengthen its cybersecurity posture, which the OIG stated “appear to be responsive” to its recommendations.