Federal Reserve Cybersecurity Program Rated Ineffective by Watchdog Audit

• •Federal Reserve received a cybersecurity rating of 2 out of 5, indicating ineffectiveness.
• •Decentralized IT operations are a major factor in the agency's declining cybersecurity maturity.
• •The Office of Inspector General issued eight recommendations for improving security practices.

The Federal Reserve's cybersecurity program has been rated ineffective by the Office of Inspector General, receiving a score of 2 out of 5 under the Federal Information Security Modernization Act standards. This rating reflects a decline from previous scores of 4 in fiscal 2024 and 3 in fiscal 2025. The audit attributes the ineffective rating to governance gaps, inconsistent policy enforcement, and a decentralized IT structure where division-level groups operate independently. The report highlighted issues such as incomplete risk registers and unresolved vulnerability management problems. In response, the Federal Reserve is working to integrate its IT groups into a more centralized structure, although these efforts are still incomplete. The audit provided eight new recommendations, including conducting comprehensive risk assessments and improving oversight of multifactor authentication. The Federal Reserve has agreed with the findings and committed to enhancing its security program effectiveness.