A decentralized IT operation across the Federal Reserve is likely a key factor in the central bank’s underperforming security program, per a watchdog audit released Friday.
In the report, the Fed’s Office of Inspector General gently admonished the agency’s declining maturity level under Federal Information Security Modernization Act standards. The Fed’s information security has a rating of 2 out of 5, meaning the program is considered ineffective. That rating is down from 4 in fiscal 2024 and 3 in fiscal 2025.
The OIG, which also took the Consumer Financial Protection Bureau’s security program to task this week over its own 2 rating, attributed the Fed’s cybersecurity slide to several possibilities, including updated FISMA scoring methodology that “more accurately reflects an agency’s security posture but makes higher ratings more difficult to achieve.”
Still, the OIG chided the Fed for governance gaps, policy enforcement inconsistencies and unresolved recommendations from previous audits.
“Governance challenges stem from the Board’s historically decentralized IT operating environment, where division embedded IT groups have operated independently from the enterprise,” the report said. “Separately, inconsistently enforced security policies and outdated documentation do not fully reflect current operations.”
The watchdog noted that it has “repeatedly’ detailed governance issues linked to the Fed’s IT setup, and the central bank has in fact “taken some significant steps” in response. The agency implemented an updated IT operating model, for example, that OIG said will “better integrate technology functions, optimize technology in support of strategic mission opportunities, provide a more holistic user experience, and keep pace with modernizing technologies.”
The OIG also credited the Fed for its “robust technology capabilities” and for investing in infrastructure and security tools. Nevertheless, some “deficiencies” in how the Fed’s IT operations are structured are likely to limit the effectiveness of tech and security investments, the report said.
The watchdog also believes that the Fed’s scattered IT operations setup lessens visibility into potential issues, creates possible security risks, and limits the agency’s ability to manage the overall IT environment. It also dinged the Fed for inconsistencies in how it adopts corrective actions, for having an incomplete cybersecurity risk register, and for not addressing vulnerability management problems.
Some work has been done to mitigate those problems, the report stated, but there’s more to do.
“Recently, the Board has undergone transition efforts to integrate several embedded IT groups into the Division of IT, including parts of this embedded IT group’s operational environment,” OIG said.
“However, these plans do not involve moving the group’s entire operational environment under the Division of IT,” it continued. “Although Board policies, including IT policies, apply to all divisions without exception, the decision not to transition some IT systems from this group may limit the chief information officer’s (CIO) visibility into the agency’s entire information security environment.”
The OIG offered eight new recommendations to the Fed, including a comprehensive risk assessment of the embedded IT group’s independent operations, the creation of oversight mechanisms to comply with inventory standards, and better oversight of multifactor authentication exceptions, among others.
In its response letter, the Fed said it concurred with the OIG’s recommendations and viewed the audit as “an important opportunity to enhance our information security program’s effectiveness across all Cybersecurity Framework function areas.”
