The CFPB Can Improve Its Safeguards for Protecting Confidential Supervisory Information

Define in policy
a. the process that examiners should use to request access to files in the Supervision Examination System.
b. the criteria that managers and regional analysts should use to assess whether a need to know exists in accordance with the least privilege principle.
c. the requirement that regional analysts document an examiner’s need to know before granting access to supervision files in the Supervision Examination System.
d. consequences for accessing confidential supervisory information without a need to know or providing access to confidential supervisory information when a need to know does not exist.

Develop and require training for CFPB staff involved in the examination process for the policy and guidance resulting from recommendations 1 and 2.

Update the guidance for managing breaches of confidential supervisory information to include expectations for
a. assessing and documenting the level of harm associated with a breach.
b. counseling, training, or taking other measures to hold CFPB staff responsible for breaches accountable, as appropriate, and documenting such actions.
c. analyzing the causes of breaches to identify trends and implement appropriate control adjustments, as necessary.

Update the CFPB’s confidential information breach response directive to
a. provide guidance for assessing the risk to institutions affected by breaches of confidential supervisory information and notifying those institutions.
b. define the roles and responsibilities for those involved in the process.