Federal Reserve Security Audit Finds 13 Prior Fixes Unfinished and Eight New Recommendations

The US Federal Reserve Board's information-security program does not meet the federal government's effectiveness standard, according to an inspector-general audit dated 28 October 2026. The watchdog found that 13 of 17 recommendations from earlier annual security audits remained open and issued eight additional recommendations. The Board accepted the new recommendations.

The finding concerns the Board of Governors' information systems, not the separate Consumer Financial Protection Bureau, which was assessed in another report. It is also not a finding that a cyberattack succeeded, that sensitive data was stolen, or that the Federal Reserve's monetary-policy decisions were compromised.

What the rating measures

The Office of Inspector General assigned the Board a maturity rating of 2 on a five-level scale under the Federal Information Security Modernization Act. Level 2 means policies and procedures are defined but are not consistently implemented. Federal evaluators consider level 4, where controls are managed and measurable, the threshold for an effective program.

The Board's overall rating was 4 in fiscal 2024 and 3 in 2025, before falling to 2 in 2026. The audit cautions against treating that sequence as a simple measure of worsening technical security. Changes to the scoring method and the addition of governance criteria affected the comparison, alongside documented weaknesses in the Board's controls.

Missing inventory information and divided oversight

The audit says the Board's system inventory was missing 10 of 32 required information fields, including some relating to system ownership and cloud services. Auditors also found that systems were not always classified correctly for personal information or essential functions, and that some systems recorded in a separate risk-management tool were absent from the main inventory.

That matters because an agency cannot reliably assess its security obligations or allocate remediation work without a complete account of the systems it operates. The report also describes an embedded technology group with independent vulnerability-management and multifactor-authentication exception processes that were not fully aligned with enterprise oversight.

Other findings concerned outdated policies, incomplete cybersecurity risk registers, vulnerability escalation and contingency plans organized around divisions rather than individual systems. The auditors warned that these arrangements could limit the Board's ability to identify risks and recover critical systems consistently after disruptions. These are findings about governance and preparedness, not a quantified probability of a future breach.

Which corrective actions remain unresolved

Of 17 recommendations outstanding from earlier annual audits, the inspector general said 13 remained open. Four were being closed following corrective work related to risk and asset management and security training. The eight new recommendations are a separate group; adding them to the old backlog without distinguishing their dates would obscure the Board's progress.

The Board told auditors it had invested in security tools and improved coordination across technology functions. The report acknowledges those efforts while concluding that inconsistent enforcement and remaining decentralized operations limit the benefit of the investments. Management agreed to the eight new recommendations and outlined planned responses.

The next measurable test is not whether the Board announces another security initiative. It is whether the inspector general confirms that the specific outstanding controls have been implemented and formally closes the recommendations. The public audit withholds some technical details; this article is based on the published inspector-general report and independently written banking-industry coverage, not on TFNOS testing of Federal Reserve systems.