CFPB Report: 2026-IT-C-017 October 27, 2026
A strong information security program is essential for the CFPB to protect millions of consumer complaints, sensitive financial information, and confidential supervisory records on financial institutions.
According to federal metrics for evaluating agencies’ information security programs, the CFPB’s information security program is not effective. We found weaknesses in several areas, including records for assets and datasets, vulnerability management, and policies, and several of our recommendations from previous information security program audits remain open.
We have eight recommendations to address these issues. The CFPB agreed with our recommendations.
