Federal Reserve OIG Flags IT Governance and Security Control Gaps

The Federal Reserve Office of Inspector General (OIG) rated the Board of Governors of the Federal Reserve System’s information security program 2 out of 5, a decline from 4 in fiscal 2024 and 3 in fiscal 2025. The rating indicates that the program is considered ineffective under the assessment framework described in the watchdog’s report. The OIG linked the decline to several possible factors, including an updated Federal Information Security Modernization Act (FISMA) scoring methodology that “more accurately reflects an agency’s security posture but makes higher ratings more difficult to achieve.” The change in methodology is relevant context, but the report also identified persistent operational and governance weaknesses that the Board must address.

The OIG identified the Board’s historically decentralized IT environment as a central challenge. Division-embedded IT groups have operated independently from the enterprise, contributing to governance gaps, inconsistent enforcement of security policies, outdated documentation, and limited visibility across the overall technology environment. According to the report, this structure can make it harder to identify potential issues, manage security risks, and ensure that investments in technology and security tools produce consistent results. The watchdog also cited an incomplete cybersecurity risk register, uneven corrective-action practices, unresolved recommendations from earlier audits, and continuing vulnerability-management problems.

The audit does not announce an acquisition, contract value, solicitation, or procurement contact. For GovCon firms, the recommendations nevertheless provide an indication of capability areas that may become relevant as the Board works through remediation: enterprise IT governance, cybersecurity assessments, vulnerability management, security-policy implementation, asset inventory controls, and integration of embedded IT operations. Contractors should treat these needs as market intelligence—not as an active bid opportunity—and monitor for future notices, budget signals, or agency engagement before committing capture resources.

The Board has concurred with the OIG’s eight recommendations and has already taken steps to adjust its operating model. The watchdog cited an updated IT operating model intended to “better integrate technology functions, optimize technology in support of strategic mission opportunities, provide a more holistic user experience, and keep pace with modernizing technologies.” It also acknowledged the Board’s robust technology capabilities and investments in infrastructure and security tools. However, the report cautioned that remaining structural deficiencies could limit the effectiveness of those investments. Transition efforts have begun to integrate several embedded IT groups into the Division of IT, but they do not move the entire operational environment of the relevant group under that division. This partial integration underscores the implementation challenge: policy coverage alone may not create enterprise-wide control when operations remain distributed.

• Security rating: The Board’s information security program received a 2 out of 5, down from 4 in fiscal 2024 and 3 in fiscal 2025; the OIG described the program as ineffective.
• Recommendations: The OIG issued eight recommendations addressing decentralized operations, inconsistent policy enforcement, unresolved security issues, risk assessment of independently operated embedded IT, asset inventories, and multifactor authentication exceptions.
• Governance concern: Historically independent, division-embedded IT groups can reduce enterprise visibility and complicate risk management and consistent security controls.
• Remediation status: The Board concurred and has begun an updated IT operating model and efforts to integrate several embedded IT groups into the Division of IT.
• Integration limitation: The transition plans do not place the entire operational environment of the relevant embedded group under the Division of IT.
• Additional control gaps: The report cites an incomplete cybersecurity risk register, inconsistent corrective actions, outdated documentation, unresolved prior recommendations, and vulnerability-management issues.
• Potential contractor relevance: Firms with capabilities in cybersecurity assessment, IT governance, vulnerability remediation, asset inventory, multifactor authentication exception management, and decentralized-environment integration may monitor follow-on activity.
• Acquisition status: No solicitation, contract value, procurement contact, funding amount, or acquisition timeline was announced; this audit is not an active procurement opportunity.
• Market-monitoring priority: Track the Board’s implementation of the eight recommendations and look for future requirements tied to enterprise integration, control testing, and remediation support.