Fed OIG downgrades CFPB cybersecurity assessment to second-lowest level

Failure to maintain ATOs and lack of documentation key factors in decision.

The information security program of the Consumer Financial Protection Bureau (CFPB) is “not effective” and its maturity level has been downgraded to Level 2 (Defined). The move has been made by the Federal Reserve Board Office of Inspector General (OIG), which released its 2025 Federal Information Security Modernization Act (FISMA) audit

Level

Free Trial

Register for free to keep reading.

To continue reading this article and unlock full access to GRIP, register now. You’ll enjoy free access to all content until our subscription service launches in early 2026.

  • Unlimited access to industry insights
  • Stay on top of key rules and regulatory changes with our Rules Navigator
  • Ad-free experience with no distractions
  • Regular podcasts from trusted external experts
  • Fresh compliance and regulatory content every day
Register for free Already a member? Sign in