.jpg?width=1200)
Level 2 is two steps below effective
The Federal Reserve Board inspector general assessed the Board’s information-security program at maturity level 2 on a five-level scale. The audit says an effective program requires level 4.
The reported score moved from level 4 in fiscal 2024 to level 3 in 2025 and level 2 in 2026. The report notes changes in scoring methodology and context, but it also documents substantive weaknesses; the decline should not be reduced to either explanation alone.
| Fiscal year | Maturity level | Effective threshold |
|---|---|---|
| 2024 | 4 | 4 |
| 2025 | 3 | 4 |
| 2026 | 2 | 4 |
Most prior recommendations are still open
Thirteen of 17 recommendations from earlier information-security audits remained open at the 2026 checkpoint. That is 76.47%; four were being closed.
The new audit adds eight recommendations. Combining old and new counts would be misleading because the new items have not had the same implementation window, so this analysis reports them separately.
Weaknesses span governance and technical operations
The inspector general identifies decentralized security operations, an incomplete system inventory, gaps in multifactor-authentication exception governance, vulnerability-management problems, incomplete policy and contingency-planning weaknesses.
A maturity score is a management assessment, not evidence of a successful cyberattack. The report establishes control deficiencies and unresolved corrective work; it does not report that an attacker compromised the Federal Reserve Board.
Method and limits
What’s the Scoop With Broach traced the published maturity levels, calculated the open share of prior recommendations and kept the eight new recommendations distinct. The inspector general, not this newsroom, conducted the security testing.
The public report withholds operational detail that could create risk. Recommendation counts are not severity weights, and year-to-year scores are not perfectly comparable when methodology changes.
Sources and further reading
Federal Reserve OIG report page, 2026-IT-B-018, October 28, 2026 ↗