The Office of Inspector General (OIG) for the Federal Reserve and the Consumer Financial Protection Bureau (CFPB) identified security risks regarding hardware left in vacated CFPB offices. An audit revealed that the agency had not verified the security status of these assets, which potentially contained sensitive financial and consumer data.
In response to a draft management alert issued by the OIG, CFPB Chief Information Officer Christopher Chilbert stated on September 18 that the agency began removing the hardware. Chilbert noted that the CFPB utilizes centralized data centers and cloud providers, arguing that regional equipment does not house sensitive databases.
Despite the disagreement regarding the level of vulnerability, the CFPB agreed to follow the OIG's recommendations. The agency committed to completing the decommissioning of its former regional offices by September 30 and promised to provide a status update to the OIG upon the project's conclusion.
The OIG confirmed that the actions taken by the CFPB align with its recommendations and stated it will continue to monitor the situation to ensure full compliance. Meanwhile, reports indicate ongoing legal and funding challenges involving the CFPB and the current administration.
