Summary

  • The Federal Reserve Board inspector general’s 28 October 2026 audit found that about 97% of users in one embedded IT group were exempt from phishing-resistant multifactor authentication for certain applications. That figure describes one group and those applications, not the entire Board or every sign-in.
  • The Board did not centrally track its MFA exemptions. Managers could not readily explain some exemptions, and the central IT division lacked a record of their age or expiry. The inspector general recommended an enterprise policy and a review of exception populations; the Board agreed.

An exception that outgrew its ledger

The Board says it enforces phishing-resistant MFA. Its 2026 security program received a level-2 maturity rating on a five-level scale, below the level 4 considered effective. The full audit shows how the exception process contributed to that governance problem. Different divisions administered different groups through different processes. Central IT could not see how long the permissions had lasted or when they would end. In one embedded IT group, roughly 97% of users were exempt for certain applications. A narrow exception mechanism had become the ordinary arrangement for that particular population.

The measured exemption concerned the stronger phishing-resistant requirement in a defined slice of the environment. That distinction matters because the governance failure is measurable without inventing an intrusion. The Board could state its enterprise rule but could not produce one enterprise account of departures from it. A rule that names no owner for its exceptions has lost its claim to control.

The split goes deeper than authentication. One embedded group supporting several divisions maintained separate vulnerability procedures. Its policy allowed reporting vulnerabilities to the information security officer at the group’s discretion, rather than through mandatory enterprise escalation. The Board’s system inventory lacked ten of 32 required field types, including system owner and authorization boundary. A central security officer cannot prioritize a risk that the local process never escalates or an inventory row does not describe.

The program had scored level 3 in 2025 and level 4 in 2024. The inspector general attributes the decline partly to control weaknesses and partly to the scoring method and the new weight of governance. The unresolved control work also appears in the recommendation register: thirteen of 17 prior annual audit recommendations remained open. The new report adds eight, including a policy for MFA exceptions and an assessment of who still needs them. The Board agreed, but the audit did not establish completed migration or a current closure register.

Sources