A federal watchdog has found that the Consumer Financial Protection Bureau did not adequately protect databases containing large amounts of sensitive consumer and business information. The findings raise concerns about the agency’s ability to safeguard data used in its work overseeing banks, lenders and other financial companies.
The audit, released Wednesday, rated the CFPB’s information security program “not effective.” It was conducted by the Federal Reserve-CFPB Office of Inspector General, an independent oversight office that reviews the agencies’ operations.
Audit cites gaps in basic security controls
Investigators found that the bureau had not created a complete inventory of several datasets that were still in active use. Without a reliable record of the information it holds, an agency may have difficulty determining what requires protection and how access should be managed.
The audit also said the CFPB had not resolved “critical and high-severity” cybersecurity weaknesses within the required 30-day period. In addition, investigators identified cybersecurity risk policies that were outdated or insufficient.
- The information security program received an “not effective” rating.
- Some active datasets were missing from the bureau’s inventory.
- Serious vulnerabilities remained unresolved beyond the required deadline.
| Finding | What investigators reported |
|---|---|
| Data inventory | Several actively used datasets were not inventoried |
| Vulnerability response | Critical and high-severity weaknesses were not fixed within 30 days |
| Risk policies | Some policies were outdated or inadequate |
Staffing upheaval preceded the findings
The review follows nearly two years of disruption at the CFPB, including efforts by the Trump administration to reduce staffing, close offices, cancel contracts and limit the bureau’s operations. The audit linked staffing losses to difficulties in maintaining the agency’s information-security work.
The inspector general’s findings also came after a separate report in September. That review said the CFPB could not verify the security of computer equipment left at former regional offices after those locations were closed.
CFPB says it has addressed most recommendations
Christopher Chilbert, the CFPB’s chief information officer, said in a written response that the agency had not experienced a major security incident or a breach involving personal information during the most recent fiscal year.
“In summary... the Bureau has already done the work of addressing most of the... recommendations and the Bureau will continue to focus” on further improvements.
Chilbert said the bureau had made substantial progress correcting the deficiencies and accepted the audit’s recommendations. The audit’s findings concern the agency’s security controls and oversight practices; they do not, according to the reported material, establish that hackers stole CFPB data or that a consumer-information breach occurred.
The CFPB handles information connected to consumer financial complaints, supervision and enforcement activities. The audit’s concerns therefore involve systems and databases containing information tied to consumers and businesses, even as the bureau says it recorded no major personal-information breach during the latest fiscal year.
