The federal office charged with overseeing the Consumer Financial Protection Bureau's technology practices concluded in a recent audit that the agency's information security program is "not effective," leaving large collections of sensitive consumer and business data potentially exposed to theft or hacking.
The review, carried out by the Federal Reserve-CFPB Inspector General's office, identified several shortcomings. Auditors found that the bureau had not maintained inventories for several datasets that were actively in use, a lapse that could hinder protections for sensitive information. The audit also said the agency failed to address "critical and high-severity" vulnerabilities within the required 30-day remediation window and that its policies governing cybersecurity risk and impact analyses were either outdated or insufficient.
Those findings come after nearly two years of internal upheaval at the bureau. Last year, the Trump administration initially sought to abolish the agency and subsequently closed regional offices, halted workstreams, canceled contracts and pursued broad staffing cuts, moves that the audit indicates may have compounded operational challenges.
CFPB officials did not immediately respond to a request for comment on the audit's release. In a written reply to the inspector general, agency leaders said they accepted the report's recommendations and described progress made since the audit was completed.
Christopher Chilbert, the bureau's chief information officer, told auditors in writing that the agency had not experienced any major security incidents or breaches involving individuals' personal information during the government fiscal year referenced by the audit and that it was addressing other identified deficiencies. "In summary... the Bureau has already done the work of addressing most of the... recommendations and the Bureau will continue to focus" on further improvements, Chilbert wrote.
The latest assessment follows a separate inspector general report issued last month that said the bureau could not confirm the security of computer hardware located in its former regional offices, which had been shuttered under the earlier administration's actions.
Context and implications
The audit frames the bureau's information security program as needing substantial remediation to meet federal standards for protecting large volumes of sensitive records. Agency leaders say they have accepted the inspector general's findings and have already taken steps to implement recommendations, while noting there were no major personal-data breaches during the fiscal year cited.