Watchdog Finds Fed and CFPB Information-Security Programs Ineffective

The Federal Reserve Board and the Consumer Financial Protection Bureau hold sensitive banking-supervision and consumer data and are subject to annual audits under the Federal Information Security Modernization Act of 2014. Failures in governance, system authorization and software updates could heighten the risk of data breaches and operational disruption across the financial system.

The Office of Inspector General on June 1, 2026, released its semiannual report covering October 1, 2025, through March 31, 2026. The Fed’s cybersecurity maturity rating fell to Level 3 from Level 4, while the CFPB’s dropped to Level 2 from Level 4, and both programs were deemed ineffective. The watchdog also found 677 unaccounted-for laptops worth more than $1.4 million and said processing times for some Fed bank applications lengthened from 2021 to 2024.