The overall rating was ineffective
The Federal Reserve Board's inspector general said the Board's information-security program was not effective under the federal metrics used for the annual review. The finding matters because the Board handles sensitive information connected to monetary policy, supervision and financial stability.
An ineffective program rating does not mean every Board system was breached or unavailable. It means the program, measured across required control areas, did not meet the effectiveness threshold.
Weaknesses crossed several control areas
The public summary identifies governance, policies and contingency planning among the weak areas and says recommendations from earlier audits remain open. That combination points to both new and recurring work.
The summary does not publish sensitive exploit details. Readers therefore should not infer a specific vulnerability or affected account beyond what the audit states.
Eight recommendations remain the test
The watchdog made eight recommendations, and the Board agreed. The next evidence is implementation: revised controls, testing and formal closure by the inspector general.
Management agreement is a commitment, not proof that risk has already been reduced. Future status reports should show which earlier recommendations remain open and why.
Sources and further reading
Federal Reserve Board and CFPB OIG: 2026 information-security audit ↗