2025 Audit of the Board's Information Security Program

Each year, we audit the Board's information security program as required by the Federal Information Security Modernization Act.

The maturity level of the Board's information security program has decreased since last year, leading us to conclude the program is no longer effective. Challenges in cybersecurity governance, coupled with opportunities to strengthen cybersecurity profiles, mobile device security, and information classification for confidential supervisory information, contributed to the decline.

We are making 3 new recommendations to strengthen the Board's information security program. In addition, the Board has addressed 4 recommendations from our previous FISMA audits, leaving 18 previous recommendations that remain open. Given the sensitivity of the information in our review, portions of the public version of this report have been redacted.