Summary

  • In its 28 October 2026 audit, the Federal Reserve Board's inspector general found that the Board conducts biannual contingency testing and maintains division-level continuity plans, but has not developed individual information-system contingency plans containing the required technical recovery steps.
  • Business impact analysis sits with the Board's Intelligence, Insider Risk, and National Security Programs group; technical contingency planning sits with its Division of IT. Their coordination, responsibilities and update cycle are not defined in a common policy. Most business impact analyses had not been updated since 2023 or earlier.
  • The Board's security program was rated maturity level 2 of 5, below the federal level-4 effectiveness threshold. Changes in scoring and the addition of a governance domain affect comparisons with previous years. Thirteen of 17 older audit recommendations remained open; the Board agreed with eight new ones.

A plan for the division meets a machine that needs a plan

The Federal Reserve Board's inspector general issued its 2026 security audit on 28 October. The audit concerns the Board of Governors, the federal agency that uses sensitive financial and supervisory information to inform its work. It is not a survey of every Reserve Bank or every system in the Federal Reserve network. The finding with the clearest operational consequence is plain: the Board runs contingency tests twice a year and maintains continuity-of-operations plans for divisions, but it has not produced individual information-system contingency plans with the required restoration details.

A division plan can say which business function must continue. A system plan has to tell technicians what to recover, in what order, to what point in time, through which alternate arrangements, and how to test that the system actually returns. The inspector general found that the Board's division plans and system security plans lack the required technical recovery procedures, system-specific priorities, recovery point objectives, alternate processing steps and restoration activities. A Board official told the auditors that contingency information was captured in system security plans.

They checked the plans and found the individual-system procedures missing.

This is a more precise problem than a claim that the agency never practices. It practices. What the audit cannot find is the complete written handoff from a business need to a specific system's recovery. A drill can prove that an exercise happened; it cannot silently supply a procedure absent from the system plan. The missing document becomes most expensive when an interruption forces people to choose which service to restore first and which version of its data can be accepted.

Two planning desks, no rule for joining their pages

The split starts before the technical manual. Intelligence, Insider Risk, and National Security Programs, or IINS, manages business impact and process analyses and continuity planning. The Division of IT manages technical contingency planning. The inspector general found no established policy stating how the two groups coordinate those analyses, who aligns priorities and recovery capabilities, or how often their records must be reviewed together.

The age of the records makes the gap visible. Most business impact analyses had not been updated since 2023 or earlier; more than half of the business process analyses had not been updated since 2024 or earlier. Several process analyses updated in 2025 were not reflected in their matching impact analyses. A current technical plan cannot reliably implement an old priority, while an updated business priority cannot restore a system whose steps were never specified. The Board's own continuity framework expects formal, documented and periodically reviewed procedures for essential functions.

The two desks have paperwork; they lack the shared version of it.

The consequence is a contest between clocks. Business staff may set a recovery priority and time frame. Technical staff may be working from a different inventory, a different dependency map, or a plan that ends at the division's name. The audit says this mismatch gives the Board limited assurance that critical systems can be recovered consistently and on time during disruptions. It reports a control gap and exposure, not a particular failed recovery. The decision that matters now is who owns the reconciliation before an incident chooses the order instead.

The system inventory offers a second measure of the same governance problem. The Board's inventory omitted 10 of the 32 fields required by its own standard, including information type, authorization boundary, system owner and cloud service type. Some systems holding personal information or supporting essential functions were misclassified, and systems listed in another compliance tool were absent from the inventory. Those are missing fields, not ten missing systems. A recovery plan needs an accurate list of what exists, who owns it and what it supports. An inventory with those gaps makes every later priority discussion harder.

A security score is not a recovery test

The OIG's official highlights rate the Board's 2026 information-security program at level 2 on a five-level maturity scale: policies are defined but not consistently implemented. Federal guidance treats level 4, managed and measurable, as effective. The Board received a level 4 in fiscal 2024 and level 3 in fiscal 2025, but the series is not a clean measure of a three-year decline. The scoring method changed from the most common rating to a calculated average, cybersecurity governance became a separate domain, and the OIG identified additional weaknesses. The present level-2 result is the audit's finding; a simple slope through the three scores would invent a measurement it did not make.

The backlog is easier to count. Thirteen of 17 recommendations carried over from prior annual security audits remained open; the inspector general closed four after Board action. This report added eight recommendations. They cover enterprise technology governance, inventory, authentication exceptions, vulnerability handling, monitoring, recovery planning and cloud-provider contract controls. The Board's chief information officer and chief financial officer agreed with the findings and recommendations and outlined planned actions. Acceptance gives the work an owner; it is not the completed work.

One recommendation goes directly to the seam: establish organization-wide rules for the IINS and IT groups to coordinate business impact and process analyses with technical planning, then require individual-system contingency plans. The Board could demonstrate the change with dated analyses that match, an inventory that names each system and owner, and tested restoration steps for the systems carrying essential functions. That is a sharper receipt than another division-level exercise announcement.

The Board has security tools, an updated technology operating model, and a testing calendar. The inspector general credits those investments. The audit's difficult claim is that they cannot compensate for an unowned join between a business function and its system. If a disruption arrives, an organizational chart cannot tell a technician the recovery point of a particular application. The time to connect the two plans is before the chart becomes the only map in the room.

Sources