Where To Report Waste

Fraud, Abuse, Or Retaliation

2023 Audit of the Board’s Information Security Program

Submitting OIG:

Federal Reserve Board & CFPB OIG

Date Issued:

Friday, September 29, 2023

Agency Reviewed / Investigated:

Board of Governors of the Federal Reserve System

Submitting OIG-Specific Report Number:

2023-IT-B-015

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

$0

Funds for Better Use:

$0

Number of Recommendations:

7

Report updated under NDAA 5274:

No

View Document:

Attachment	Size
board-information-security-program-sep2023.pdf	1.15 MB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
1	Open	No
Prioritize the definition and incorporation of a cybersecurity risk tolerance into the agency's cybersecurity policies, procedures, and processes, as appropriate.
2	Open	No
Ensure all required attributes are consistently documented within the agency's cybersecurity risk register.
3	Open	No
Document and implement a process to consistently inventory the Board's web applications, including its public-facing websites.
4	Open	No
Document and implement a process to consistently inventory and prioritize the Board's third-party systems, including the identification of subcontractors.
5	Open	No
Enforce the agency's iOS Update and Device Inactivity Policy to ensure that agency services are denied to mobile devices that are out of compliance.
6	Open	No
Develop, document, and implement a process to review and update the Board's privacy impact assessments.
7	Open	No
Ensure that the process to update privacy impact assessments is adequately resourced for effective implementation.