Watchdog finds US consumer agency's security 'not effective'

Key facts

• The CFPB's information security program was found to be 'not effective.'
• The agency failed to inventory actively used datasets.
• Critical and high-severity vulnerabilities were not remedied within the required 30-day period.
• Cybersecurity risk and impact analyses had outdated or insufficient policies.
• CFPB officials accepted the audit's recommendations and reported progress in improvements.

WASHINGTON, Oct 28 (Reuters) - The top US agency for consumer financial protection is not adequately protecting databases with large volumes of sensitive consumer and business information, potentially exposing them to hackers or theft, a watchdog report said on Wednesday. The audit, which found the Consumer Financial Protection Bureau's information security program 'not effective,' follows nearly two years of upheaval at the agency. According to the Federal Reserve-CFPB Inspector General's office, the CFPB failed to inventory several actively used datasets, potentially leaving them vulnerable. The agency also failed to remedy 'critical and high-severity' vulnerabilities within a required 30-day period and had outdated or insufficient policies on cybersecurity risk and impact analyses, the audit found. CFPB officials stated they accepted the recommendations and had made substantial progress in improving conditions after the audit was finished.