Banking and Finance Law Daily Wrap Up, CONSUMER FINANCIAL PROTECTION BUREAU—OIG audit finds overall satisfaction with CFPB’s information security program, (Dec 6, 2013)

By Stephanie K. Mann, J.D.

The Federal Reserve Board Office of Inspector General (OIG) has released its 2013 Audit of the Consumer Financial Protection Bureau’s information security program. The purpose of the audit was to evaluate the effectiveness of the CFPB’s security controls and techniques as well as compliance by the CFPB with Federal Information Security Management Act (FISMA) and related information security policies, procedures, standards, and guidelines.

Findings. Overall, the OIG found that the CFPB has taken multiple steps over the past year to develop, document, and implement an information security program that is consistent with the FISMA requirements. Additionally, the audit found that the CFPB has taken several actions to strengthen its information security program in the 11 areas outlined in the Department of Homeland Security (DHS)’s FISMA reporting guidance. The report found that the CFPB’s security program is generally consistent with six out of the 11 information security areas: identity and access management, incident response and reporting, risk management, plan of action and milestones, remote access management, and contractor systems.

Identified improvements. The audit found several opportunities for the CFPB to improve its information security program through automation, centralization, and other enhancements to ensure that key DHS requirements for continuous monitoring, configuration management, and security training are met.

Recommendations. There are four identifiable areas where the OIG has made recommendations designed to assist the CFPB in strengthening its information security program: continuous monitoring, configuration management, security training, and incident response and reporting. The CFPB’s Chief Information Officer concurred with these recommendations and outlined actions that have been taken, are underway, and are planned.

RegulatoryActivity: CFPB Privacy