Skip to Navigation
Skip to Main content
OIG Home
OIG Home


Skip SHARE THIS PAGE section Skip STAY CONNECTED section

CFPB Report: 2020-IT-C-021 November 2, 2020

2020 Audit of the Bureau’s Information Security Program

available formats

The Federal Information Security Modernization Act of 2014 requires us to perform an annual, independent evaluation of the Bureau's information security program. We evaluated the program's maturity level (from a possible low of 1 to a possible high of 5) across several areas.

The Bureau continues to operate its information security program effectively at level 4 (managed and measurable). Nonetheless, the Bureau has opportunities to further strengthen its information security program—for example, by making policy and technology improvements to strengthen separation of duties controls in the Bureau's configuration management processes.

We are making a recommendation to strengthen the Bureau's information security program in the area of configuration management.