Progress and more recommendations can coexist
The Consumer Product Safety Commission's inspector general says independent auditors found progress in implementing federal information-security requirements in fiscal 2026. The same report lists eight recommendations.
The fiscal 2025 FISMA page listed six. Eight is two more, a 33.3% increase, but recommendation counts alone do not prove that security worsened: metrics, testing scope, resolved items and newly identified work can change between annual audits.
| Audit year | Recommendations | OIG description |
|---|---|---|
| FY 2025 | 6 | Independent FISMA assessment |
| FY 2026 | 8 | Progress in implementing requirements |
| Change | +2 | +33.3% |
Three visible fixes span controls, staffing and documentation
The OIG page identifies annual security-control assessments, a comprehensive workforce skills assessment and updated system security plans using the current NIST SP 800-53 Revision 5 control set among the open work.
Those items address different failure modes: whether controls are tested, whether staff capabilities are known and whether system plans reflect the current standard. A single count should not flatten those distinctions.
No monetary finding and no disclosed breach
The report metadata lists zero questioned costs and zero funds put to better use. It does not say the agency suffered a data breach or that consumer-product information was altered.
The agency's separate fiscal 2027 management-challenges report still names information-technology security as one of three mission-critical challenge areas, alongside enterprise risk and resource management.
Method and limits
This newsroom compared the 2025 and 2026 OIG report pages and calculated the two-recommendation increase against the six-recommendation prior-year base. It used the auditor's own word—progress—rather than treating the count as a grade.
Annual FISMA work can use changing measures and scopes. The comparison is useful for workload, not a controlled trend test of risk or effectiveness.
Sources and further reading
CPSC OIG fiscal 2026 FISMA audit, October 23, 2026 ↗