US Consumer Watchdog Audit Leaves Ten Cybersecurity Fixes Open Despite Agency Response

An inspector-general audit dated 27 October 2026 has rated the US Consumer Financial Protection Bureau's information-security programme ineffective for a second consecutive year. The report identifies a gap between documented safeguards and controls that are consistently implemented, while also recording corrective work the agency says it completed after auditors finished their fieldwork.

The distinction matters for people who have submitted financial complaints or whose information appears in supervisory records. The bureau holds millions of consumer complaints, sensitive financial data and confidential records about financial institutions. A weakness in how those assets are tracked can increase exposure to cyber threats. The audit does not establish that those records were stolen or that a breach occurred.

What the federal audit measured

The Office of Inspector General for the Federal Reserve Board and CFPB assigned the agency level 2 on a five-level federal information-security maturity scale. Level 2 means procedures are defined but not consistently carried out. Federal guidance treats level 4, which requires managed and measurable implementation, as the threshold for an effective programme. This is a governance assessment, not a count of successful cyberattacks.

The inspector general found actively used datasets missing from the bureau's inventory, with more than 50 additional datasets awaiting confirmation of whether they were in use. The audit says the team responsible for maintaining the data inventory had been reduced to one person. Without a complete record of what information is held and where, the bureau cannot demonstrate comprehensive oversight of its information assets.

The review also identified critical and high-severity software vulnerabilities that were not remedied within the required 30-day period. Auditors said formal plans for tracking some overdue issues were prepared only after they requested records. In a sample of four systems, three had outdated security-control baselines documented in one management tool. Importantly, the bureau showed that those systems had been assessed against the current baseline in another tool; the finding therefore concerns inconsistent documentation, not proof that every control was absent.

Older recommendations remain unresolved

Ten of fourteen recommendations carried forward from earlier annual security audits were still open when the new report was issued. The inspector general said it was reviewing evidence submitted after fieldwork to determine whether nine of those ten could be closed. Submission of a corrective-action package is not the same as independent acceptance or closure.

The 2026 audit makes eight new recommendations addressing asset inventories, risk-management processes and policy governance. The bureau agreed with the recommendations. It also reported that work had advanced since the audit period, including efforts to address weaknesses identified by the watchdog.

Staffing changes provide relevant context without establishing that every deficiency arose from them. The audit cites bureau figures showing 524 of 1,758 employees departed between September 2024 and December 2025. It reports that reduced staffing hindered security-related work and that enterprise-wide risk-management activities were suspended in March 2025, with responsibilities reassigned in June 2026.

Agency response and the accountability test

In its written response, Chief Information Officer Christopher Chilbert challenged what he considered missing context about work completed after the auditors' fieldwork. He said the bureau had experienced no major security incidents or breaches involving individuals' personal information during fiscal 2026 and had submitted evidence of corrective actions. Those statements are the agency's account; the inspector general's published rating remains the independent assessment until further review establishes a change.

For public oversight, the next measurable question is whether the watchdog accepts closure evidence for the older findings and whether the eight new recommendations lead to consistently implemented controls. Neither a promise to remediate nor a low maturity rating alone establishes a data leak. The audit establishes weaknesses in recordkeeping, vulnerability tracking and policy implementation that can be tested again against the federal standard.

TFNOS examined the inspector general's report dated 27 October and independently published sector reporting dated 29 October. The official report gives a publication date but no verifiable clock time on its landing page; the sector report also provides a date without a verifiable publication time. TFNOS did not independently test CFPB systems or verify whether post-audit fixes have been accepted.