CFPB’s Cybersecurity Comedy of Errors: From Top-Notch to Not-So-Much
The US Consumer Financial Protection Bureau’s infosec program is reportedly “not effective,” dropping from a “managed” level-4 maturity to a “defined” level-2. The audit blames outdated software and reliance on risk acceptance memorandums, which sounds like using a seatbelt made of spaghetti for cybersecurity risk profiles.
Hot Take:
The Consumer Financial Protection Bureau’s (CFPB) cybersecurity program is like a high school senior with a serious case of senioritis, just barely skating by. Once the teacher’s pet with a level-4 maturity, it’s now slacking off at level-2. Could it be time for a cybersecurity intervention?
Key Points:
- CFPB’s cybersecurity maturity has slipped from level-4 to level-2, according to an OIG audit.
- Major issues include poor system authorization maintenance and lack of cybersecurity risk profiles.
- 35 systems were found operating with expired or absent authorizations.
- CFPB agrees with most findings but disputes claims about its cybersecurity risk registers.
- Resource constraints, including staff reductions, have impacted the infosec program.
Already a member? Log in here