US Consumer Bureau’s Cybersecurity Rated Ineffective, Eight Fixes Urged

The US Consumer Financial Protection Bureau’s information-security programme was rated ineffective under federal standards in an inspector-general report released on October 27, with eight new recommendations for the agency to address gaps in its cybersecurity controls.

The Office of Inspector General for the Federal Reserve Board and the CFPB assigned the bureau a maturity rating of two on a five-level scale. That means policies and procedures have been defined but are not consistently implemented. Federal guidance treats level four, where controls are managed and measured, as the threshold for an effective programme.

The finding concerns the security controls protecting databases of consumer complaints, sensitive financial information and confidential supervisory records. It does not establish that the agency was hacked or that consumer data was stolen.

**Missing records and overdue security fixes**

In report 2026-IT-C-017, inspectors identified incomplete inventories of data and hardware, outdated security documentation and delays in tracking and fixing software vulnerabilities. Multiple actively used datasets were missing from the agency’s inventory, and more than 50 additional datasets were awaiting confirmation of whether they were in use during the audit period.

The bureau also had not verified whether IT hardware left at regional offices vacated in 2025 was appropriately secured, according to the inspectors’ account of agency officials’ statements in June and early September 2026. The CFPB subsequently supplied further documentation about those assets, which the inspector general said it was reviewing. The report does not conclude that the equipment was accessed or stolen.

The audit found that critical and high-severity vulnerabilities had not always been remediated within required 30-day periods. It also found inconsistencies in the agency’s documentation of risk assessments for changes to selected systems. In some cases, the CFPB provided evidence that the assessments had taken place even though they were not adequately documented before changes were implemented.

Inspectors linked some difficulties to staff departures since 2024. They reported that enterprise-wide risk-management activities were suspended in March 2025 and assigned again by June 2026, while responsibility for the data inventory had fallen to one person. The audit cited CFPB figures showing 524 of 1,758 employees had departed between September 30, 2024, and December 31, 2025.

**What the bureau disputes**

The CFPB agreed to the inspector general’s eight new recommendations, but its chief information officer, Christopher Chilbert, challenged the audit’s overall picture. In a response reported by FedScoop on October 29, Chilbert said the review did not fully reflect subsequent improvements. He cited a 55% reduction in vulnerabilities, the retirement of 46 systems and an absence of major security incidents or breaches of personally identifiable information during fiscal 2026.

Those are the bureau’s claims about remediation, not independent confirmation that the inspector general has closed its findings. The watchdog said 10 of 14 recommendations carried over from previous annual audits remained open at the time of its report. It was assessing documentation submitted after fieldwork to determine whether nine of those could be closed.

The difference matters because a security maturity rating measures whether an agency can demonstrate consistent controls, not whether a particular breach has occurred. Likewise, an open audit recommendation is not evidence that data has been compromised.

**What happens next**

The inspector general said it would follow up on the eight new recommendations and the remaining earlier findings. Key questions are whether the CFPB can verify the inventory and physical security of its assets, demonstrate timely remediation of serious vulnerabilities and obtain formal closure of outstanding recommendations.

The report and the bureau’s response leave a documented disagreement over the pace and adequacy of security improvements. Until the inspector general completes its review of the submitted evidence, the audit rating and the agency’s subsequent claims should be reported separately.