TL;DR
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
The Federal Reserve’s Office of Inspector General issued a management alert citing a ‘collective lack of action’ that allowed information security risks tied to a departing international finance employee to go unresolved for over a year. The Fed board concurred with recommendations, with corrective steps planned for 2027.
The Federal Reserve’s internal watchdog has issued a management alert warning that a ‘collective lack of action’ across multiple Fed board divisions allowed information security risks involving a departing employee to remain unresolved for more than a year, increasing the chance of a major information security breach unless the board acts. The Office of Inspector General released the alert Monday, ahead of a planned audit, over what it called concerns about the board’s diligence in responding to a 2024 incident.
The alert centers on a former employee of the Fed board’s division of international finance who potentially removed Federal Open Market Committee classified and other sensitive information before retiring. The OIG learned of the potential incident in July 2025, a full year after the employee’s retirement. The OIG said there was not a sufficient basis to pursue a misconduct investigation, partly because many alerts about potential removal of sensitive information were false positives, but that the episode exposed systemic weaknesses in the board’s offboarding process.
The employee’s history of handling sensitive information drew scrutiny well before 2024, according to the report. In 2021, the information security operations team notified the division that the employee had copied files to an unencrypted USB device; the employee claimed they mistakenly thought the device was encrypted. In 2023, the employee attempted to send sensitive FOMC classified information to a personal email account, which the division told the OIG the employee characterized as inadvertent. Despite counseling about proper transfer procedures, the employee engaged in similar activity before retiring in July 2024 without seeking a supervisor’s review, the OIG said.
In February 2024, the employee announced retirement plans and a desire to remove files before departing. That June, the employee traveled to a country the Fed board had designated as restricted, and the international finance division was unaware of the travel plans, the report said. The OIG determined the board’s governance of its information security program and enforcement of controls lack clarity, driven by conflicting understandings of escalation and resolution responsibilities among different groups, which contributed to the incident remaining unresolved for over a year. The Fed board concurred with the OIG’s recommendations.
Stakes for Market-Sensitive Fed Data
FOMC classified information is among the most market-sensitive material the Federal Reserve handles, covering deliberations that move interest rates and financial markets when disclosed. The OIG warned that without clear, standardized processes and shared responsibility, ‘process weaknesses are likely to persist, undermining the effectiveness of the Board’s overall information security program and increasing the risk of a major information security breach.’
The case also raises questions about the central bank’s offboarding controls — the procedures used when employees with access to sensitive data leave. The watchdog found the board’s review of the incident was insufficient, its policies for responding to information removal incidents inadequate, and that the possible incident was not escalated as it should have been. For an institution whose credibility rests on controlling closely held information, the finding that no single group took ownership of the risk is a governance concern in its own right.
Timeline of Missed Warnings
The OIG’s alert traces a multi-year pattern. In 2021, the employee improperly removed sensitive FOMC classified information using an unencrypted USB device, according to the report. In 2023, the employee attempted to transfer FOMC classified information to a personal email account. In February 2024, the employee announced retirement plans and an intent to remove files before leaving. The information incident began shortly before the employee’s June 2024 travel to a restricted country and continued past the July 2024 retirement.
The OIG said it became increasingly concerned after learning of the earlier USB incident, and noted that the limited follow-up activities that did occur ‘were not commensurate with the accumulation of risks in this situation.’ The management alert was issued before completion of a planned audit, a step watchdogs use when they believe findings require immediate attention rather than waiting for a full review to conclude.
“The failures involved a collective lack of action across multiple divisions, and the limited follow-up activities that did occur were not commensurate with the accumulation of risks in this situation.”
— Federal Reserve Office of Inspector General
What the Alert Does Not Resolve
The OIG said there was not a sufficient basis to pursue a misconduct investigation of the 2024 offboarding incident, in part because many alerts related to potential removal of sensitive information were false positives. That means the extent of any actual data loss — and whether sensitive FOMC information was in fact removed or misused — is not established in the alert.
The report does not identify the employee or the restricted country involved. The full planned audit on the board’s information security practices has not been completed, so additional findings may emerge. Whether the corrective timeline through 2027 will be met, and whether the fixes will close the governance gaps the OIG identified, remain open questions.
Fed’s Remediation Roadmap to 2027
The Fed board concurred with the OIG’s recommendations. According to the report, the central bank plans to implement processes and protocols defining roles and responsibilities and to strengthen escalation alerts by the first quarter of 2027. It also intends to create enhanced monitoring capabilities and escalation protocols through a new data loss prevention solution by the third quarter of 2027.
The OIG’s planned audit of the board’s information security program is expected to continue, and the watchdog’s follow-up on the board’s corrective actions will determine whether the governance and enforcement gaps are closed. Interim measures, if any, before the 2027 deadlines were not detailed in the alert.
Key Questions
What did the Fed’s OIG find?
The Office of Inspector General found governance and control weaknesses that allowed a potential information removal incident involving FOMC classified material by a departing international finance employee to remain unresolved for over a year. It attributed the failure to a ‘collective lack of action across multiple divisions’ and unclear escalation responsibilities.
Is the former employee being investigated for misconduct?
No. The OIG said there was not a sufficient basis to pursue a misconduct investigation of the 2024 incident, partly because many alerts about potential removal of sensitive information were false positives. The alert instead focuses on systemic weaknesses in the board’s offboarding and information security processes.
What information was at risk?
The alert concerns potentially removed FOMC classified and other sensitive information. The employee had previously transferred FOMC classified information to an unencrypted USB device in 2021 and attempted to send such information to a personal email account in 2023, according to the report.
How has the Fed responded?
The Fed board concurred with the OIG’s recommendations. It plans to define roles and responsibilities and strengthen escalation alerts by Q1 2027, and to implement a new data loss prevention solution with enhanced monitoring by Q3 2027.
Why did the OIG issue an alert before finishing its audit?
The OIG said it issued the management alert because the incident highlighted information security risks and control breakdowns requiring the board’s immediate attention, rather than waiting for the planned audit to be completed.
Source: rss
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
