Consumer Watchdog’s Information Security ‘Not Effective,’ Watchdog Finds

The top US agency for consumer financial protection is not adequately protecting databases with large volumes of sensitive consumer and business information, potentially exposing them to hackers or theft, a watchdog report said on Oct. 28.

The audit, which found the Consumer Financial Protection Bureau’s information security program “not effective,” follows nearly two years of upheaval at the agency which the Trump administration last year initially moved to abolish, abruptly closing offices, halting work, canceling contracts and seeking to cut staff en masse.

CFPB representatives did not immediately respond to a request for comment on Wednesday but in a written response to the audit, officials said they accepted its recommendations and had made substantial progress in improving conditions after the audit was finished.

According to the Federal Reserve-CFPB Inspector General’s office, the CFPB failed to inventory several actively used datasets, potentially leaving them vulnerable.

The agency also failed to remedy “critical and high-severity” vulnerabilities within a required 30-day period and had outdated or insufficient policies on cybersecurity risk and impact analyzes, the audit found.

The findings followed a separate IG report last month which said the agency was unable to vouch for the security of computer hardware in its former regional offices, which the Trump administration shuttered last year.

In a written response to the audit, Christopher Chilbert, the CFPB’s chief information officer, noted that the agency had not had any major security incidents or breaches involving individuals’ personal information in the government’s last fiscal year and was working on addressing other deficiencies.

“In summary… the Bureau has already done the work of addressing most of the… recommendations and the Bureau will continue to focus” on further improvements, said Chilbert.