Understaffed CFPB’s security program has foundational ‘weaknesses,’ OIG says
The Consumer Financial Protection Bureau’s information security program is ineffective and filled with “weaknesses,” according to a new watchdog report that found nearly a dozen unaddressed recommendations.
The agency, which has lost nearly 30% of its staff since September 2024 after being targeted early and often by the Trump administration and DOGE, has a maturity level of 2 out of a possible 5, the Federal Reserve’s Office of Inspector General found.
That figure means the CFPB’s security policies, procedures and strategies are formalized and documented, but not consistently implemented under the Federal Information Security Modernization Act model.
Without fully adopting the proper cybersecurity controls, the CFPB will struggle to protect its databases — containing sensitive financial information, consumer complaint data and confidential financial institution supervisory records — “from increasingly sophisticated cyber threats that could jeopardize the confidentiality and integrity of data crucial to the agency’s mission,” the report stated.
Some of the issues OIG flagged for the CFPB were inconsistent tracking of data assets, potentially unsecured hardware left behind at closed-down regional offices, and vulnerabilities not being efficiently dealt with.
OIG appeared to lay at least some of the blame for the CFPB’s security shortcomings on the “decreased staffing levels” it has dealt with since late 2024 — personnel cuts that have “hindered the agency’s ability to perform key activities.”
A handful of enterprise risk management efforts were suspended in March 2025, just as the agency was reeling from the cuts. Those responsibilities had been reassigned as of this June, the report noted, but departures have led to some employees taking on more responsibilities.
A delayed vulnerability plan of action and milestones review was one instance noted by the watchdog of staff reductions having a direct impact on worsening security. So, too, was the CFPB’s move to assign data inventory management to just one person, a transition that limited “the agency’s ability to maintain comprehensive visibility into the data assets it is responsible for protecting,” it said.
Staffing woes could be connected to the unresolved status of 10 of 14 security recommendations from previous OIG audits. And the watchdog is in the process of examining evidence that the CFPB submitted after it finished its fieldwork. That information will determine whether nine of the 10 open recommendations can be closed.
In addition to the outstanding recommendations from past audits, the watchdog delivered another eight suggestions to the CFPB. Christopher Chilbert, the agency’s chief information officer, said in a response letter that the CFPB “has already done the work of addressing most of the OIG’s recommendations.” It also plans to close all open findings by the end of this year.
Overall, Chilbert said the OIG’s report “lacks important context” and doesn’t fully recognize the “significant improvements” the bureau has made to its cybersecurity program. The CFPB did not experience any major security incidents or breaches of personally identifiable information in fiscal 2026, he noted.
“Additionally, the Bureau made many improvements to its information security program that were not reflected in FISMA audit testing but meaningfully strengthened our cybersecurity posture,” Chilbert wrote, pointing to a 55% reduction in vulnerabilities and the decommissioning of 46 systems, among other highlights.
“Although these actions do not affect the Bureau’s FISMA score,” he continued, “they have materially hardened CFPB’s infrastructure and demonstrate the Bureau’s efforts to continuously improve the security and privacy of CFPB systems and data.”
