Coverage from Fedscoop indicates that a decentralized information technology operation at the Federal Reserve is contributing to a decline in the central bank’s cybersecurity maturity.
A report from the Office of Inspector General assigned the Federal Reserve a rating of 2 out of 5 under Federal Information Security Modernization Act standards, marking a decrease from previous years. The watchdog attributed this ineffective rating to governance gaps, inconsistent policy enforcement and a fragmented IT structure where division-level groups operate independently from the enterprise. While the report acknowledged that the agency has invested in robust technology and infrastructure, it warned that these decentralized operations limit visibility into potential risks and hinder the effectiveness of security investments. The audit highlighted concerns regarding incomplete risk registers and unresolved vulnerability management issues. In response, the Federal Reserve has begun efforts to integrate some embedded IT groups into the central Division of IT. However, the Office of Inspector General noted that these transitions remain incomplete, potentially restricting the chief information officer from overseeing the entire security environment. The watchdog issued eight new recommendations, including conducting comprehensive risk assessments and improving oversight of multifactor authentication. The Federal Reserve concurred with these findings and committed to enhancing its security program effectiveness.
Source: Fedscoop
