CFPB Cybersecurity Rated 'Not Effective'; Bureau Hadn't Verified Security of Equipment Left at Closed Offices, Inspector General Says

The Consumer Financial Protection Bureau's information security program is "not effective" under federal metrics, and the bureau had not verified whether computer equipment left behind at regional offices it vacated in 2025 was secure, the inspector general for the Federal Reserve Board and the CFPB said in an audit released Tuesday.

The annual audit, required by the Federal Information Security Modernization Act, rated the CFPB's program at maturity level 2 out of 5, meaning it is "defined but not consistently implemented." Level 4 or higher counts as effective. The report notes the bureau holds databases with "millions of consumer complaints, sensitive financial information, and confidential supervisory records on financial institutions."

Equipment Left at Closed Offices

CFPB officials told auditors the bureau left hardware at its former regional offices, which it vacated in 2025, and that it kept ownership of and responsibility for those IT assets while the General Services Administration handles the leases. Officials said in June 2026, and again in early September, that the bureau had not verified whether that equipment was appropriately secured, the report says.

The inspector general issued a management alert on Sept. 30 urging the CFPB's chief information officer to account for and secure the equipment. The CIO responded that the bureau had already begun a site-by-site IT decommissioning of the former offices, expected to be finished by Sept. 30, according to the report. Auditors said they are reviewing documents the CFPB provided in October.

CFPB Cybersecurity Gaps Tied to Staff Losses

The report links several problems to staff departures. The team responsible for the bureau's data inventory "has been reduced to one person," according to CFPB personnel, and multiple actively used datasets were missing from the inventory. More than 50 other datasets were awaiting staff confirmation that they were still in use, so neither the auditors nor the CFPB could verify whether they were, the report says.

Since March 2025, staff reductions on the information security standards team have delayed routine tracking of software vulnerabilities, officials told auditors. Internal scans in June 2026 found overdue vulnerabilities and end-of-life software, but the bureau did not open remediation plans until auditors asked for documentation, and it did not fix "a significant number of critical and high-severity vulnerabilities" within the required 30 days, the report says.

Enterprise risk management activities have been suspended since March 2025 "because of departures of key personnel," the auditors wrote. The bureau assigned a chief risk officer in June 2026.

The audit also found the asset management policy was last updated in 2021 and the data access policy in 2019, beyond a required two-year review cycle, and that nine new systems were approved to operate without system-level business impact analyses.

What Happens Next

The inspector general made eight new recommendations, and 10 of 14 recommendations from earlier annual audits remain open. The CFPB's chief information officer agreed with the findings and recommendations, the report says, and after fieldwork ended the bureau submitted evidence it says supports closing nine of the 10 open recommendations. The inspector general said it is reviewing that evidence and will follow up quarterly.

Sources: Office of Inspector General, Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau, "CFPB: 2026 Information Security Program Audit," Report 2026-IT-C-017 (Oct. 27, 2026), report page: https://oig.federalreserve.gov/reports/cfpb-information-security-program-oct2026.htm ; full report (PDF): https://oig.federalreserve.gov/reports/cfpb-information-security-program-oct2026.pdf ; management alert, "CFPB: Hardware Assets at Former Regional Offices May Not Be Appropriately Secured," Report 2026-IT-C-015 (Sept. 30, 2026): https://oig.federalreserve.gov/reports/cfpb-alert-hardware-assets-security-sep2026.htm ; Cover photo: Consumer Financial Protection Bureau headquarters, Washington, D.C. (Tony Webster, CC BY 2.0, via Wikimedia Commons)