Overview
- The bureau’s security maturity fell from level 4 in fiscal 2024 to level 2 in 2025, the audit concluded.
- Auditors identified 35 systems operating with expired or missing authorizations to operate or use, undermining assurance on controls.
- Following White House actions that halted bureau activity and brought in outside reviewers, canceled task orders and personnel losses cut continuous monitoring and testing capacity.
- The report cites continued reliance on end‑of‑life software and the lack of organization‑level cybersecurity risk profiles.
- CFPB management accepted all six recommendations as CIO Christopher Chilbert disputed the severity and noted no major PII breaches in 2025.