# OIG Flags CFPB Security Weaknesses

The Federal Reserve Office of Inspector General found the Consumer Financial Protection Bureau’s information security program at maturity level 2 of 5. Ten of 14 recommendations from prior audits remain unresolved, and the OIG issued eight additional recommendations. Staffing reductions have affected vulnerability reviews and data-asset inventory management, highlighting possible needs for cyber remediation, asset management, and risk-control support. The report identifies no active solicitation or contract opportunity.

- The findings point to potential future demand for information-security support, but contractors should distinguish that market signal from an available procurement: no solicitation or award is identified.
- Companies providing vulnerability assessment, asset inventory, or security risk-control services may find these capabilities relevant if the CFPB later seeks external support; the signal does not specify requirements, funding, or a procurement timeline.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 29, 2026

### Government Entities
- Consumer Financial Protection Bureau (CFPB)
- Federal Reserve Office of Inspector General (Federal Reserve OIG)

### Key Quotes
> Although these actions do not affect the Bureau’s FISMA score, they have materially hardened CFPB’s infrastructure and demonstrate the Bureau’s efforts to continuously improve the security and privacy of CFPB systems and data.
> — Christopher Chilbert, Chief Information Officer

### Sources
- [Understaffed CFPB’s security program has foundational ‘weaknesses,’ OIG says | FedScoop](https://fedscoop.com/cfpb-cybersecurity-program-watchdog-report) - FedScoop