The Federal Reserve and the Consumer Financial Protection Bureau have both failed to make needed updates to their information security programs, which are not effective, the Fed Office of Inspector General concluded in two recent reports.
The OIG evaluated the information security programs of the central bank and bureau as part of its annual audits. It gave both a maturity level of two out of five, meaning the programs were defined but not consistently implemented, and therefore not considered effective. Flaws included gaps in governance and datasets, outdated and incomplete policies, and a lack of coordination among IT groups. In the case of the CFPB, which has experienced significant cutbacks in staff and operations, hardware at vacated regional offices was not properly inventoried and potentially unsecured.
The OIG noted the Fed and CFPB had failed to implement most of its recommendations made after its previous audits. It had eight new recommendations for both agencies on steps they should take to better secure their information systems.
