The program remained below the effective threshold
The Federal Reserve and CFPB inspector general rated the Consumer Financial Protection Bureau’s information-security program at maturity level 2 of 5. Under the review framework, level 4 is the threshold for an effective program.
Ten of 14 prior recommendations remained open at fieldwork’s end—71.4%. The bureau had submitted nine closure packages that the watchdog was still reviewing, an important qualification to the open count.
| Indicator | Result |
|---|---|
| Maturity | 2 of 5 |
| Effective threshold | 4 of 5 |
| Prior recommendations open | 10 of 14 |
| Departures | 524 of 1,758 employees |
Nearly three in ten employees departed
The report says 524 of 1,758 employees departed between September 30, 2024 and December 31, 2025, a 29.8% reduction. The watchdog linked resource constraints to several control weaknesses.
A one-person data-inventory team was responsible for a workload that included missing active datasets and more than 50 unverified entries. Staffing alone does not prove a breach, but it is a measurable control-capacity risk.
Old baselines and overdue vulnerabilities
Three of four sampled systems used an outdated National Institute of Standards and Technology control baseline. The review also found critical or high vulnerabilities that missed the bureau’s 30-day remediation target.
The watchdog issued eight new recommendations, and CFPB management agreed with them. Agreement is the start of remediation, not proof that the controls are now effective.
Method and limits
What’s the Scoop With Broach recalculated the employee-departure and open-recommendation shares from the inspector general’s counts and separated submitted closure packages from verified closure. Technical findings are attributed to the watchdog.
The public report evaluates governance and controls; it does not publish exploitable details or establish that a specific consumer record was accessed improperly.
Sources and further reading
OIG report page, CFPB information security, October 2026 ↗