Federal cybersecurity oversight -- housing finance, health, nuclear, aviation
Four Regulators Vouch for Their Cybersecurity. Four Audits Don't.
Summary
Four federal agencies guard the cybersecurity of systems Americans depend on -- the regulator of Fannie Mae and Freddie Mac, the lead agency for healthcare, the licensor of the nation's nuclear reactors, and the overseers of aviation. In each case an independent audit reached the opposite conclusion from the program's own posture: FHFA's FISMA program was rated Level 2 of 5, and management disagreed with all four fixes; was rated 'Not Effective' for a sixth straight year, and disputed three of ten; the inspection program its own inspector general called 'robust and adaptive' was documented with unclear guidance and undefined training; and 's roadmap for who is responsible still dates to 2018. Read together, four separate reports show self-assessment outpacing verified capability.
By Augustus · October 14, 2026
Three examiners, four unrelated audits, one shape: the agency's self-view runs ahead of what got verified. FHFA⧉ -- regulator of Fannie Mae and Freddie Mac -- rated Level 2, two rungs below 'effective'; management disagreed with all four fixes. HHS⧉, healthcare's lead cyber agency, hit Level 3 on Core metrics and Level 1 on Supplemental -- 'Not Effective' six years running -- and disputed three of ten fixes; the kept all three.
FHFA cybersecurity maturity
Level 2 of 5
'Defined' -- two rungs below the Level 4 a program needs to be rated effective; management disagreed with all four fixes
FISMA result
'Not Effective'
sixth consecutive year; disputed three of the ten fixes meant to correct it
annual cyber inspections
27 -> 19/yr
cut about 30% under an executive order -- as the called the program 'robust and adaptive'
Two of the four programs, graded on the same scale, sat below the effectiveness bar
The two cases audited on the identical five-level FISMA maturity scale. A program is only rated effective at Level 4 - Managed and Measurable or higher. FHFA landed at Level 2 overall; 's Core metrics reached Level 3 and its Supplemental metrics Level 1, an overall 'Not Effective' for the sixth straight year. (The nuclear and aviation programs were examined by different audits, not on this scale.)
Effective bar (Level 4 - Managed and Measurable)
4
FHFA -- overall program
2
HHS -- Core metrics
3
HHS -- Supplemental metrics
1
Source: FHFA- AUD-2026-004 (p.2); - OAS-25-18-041 (What Found); scale from AUD-2026-004 (p.2)
View data as table
| Effective bar (Level 4 - Managed and Measurable) | 4 | The threshold a FISMA program must reach to be rated effective |
|---|---|---|
| FHFA -- overall program | 2 | Level 2 - Defined (Not Effective) |
| HHS -- Core metrics | 3 | 'Consistently Implemented' -- Level 3 on the same scale |
| HHS -- Supplemental metrics | 1 | 'Ad Hoc' -- Level 1 |
NRC covers 55 plants and 94 reactors with 24 qualified inspectors -- a third under a year's experience -- while cutting annual inspections from 27 to 19. GAO⧉ found 's governing document is still its 2018 roadmap, silent on who's responsible; implemented just three of seven of its own strategy's objectives, and left $16.9 million of cybersecurity spending off three straight years of reports.
The one cybersecurity program left off its reports, three years running
's Information Security/Cybersecurity Program President's budget requests -- the exact line item found missing from 's cyber-spending reports to in fiscal years 2024, 2025, and 2026
FY2024
6.4
FY2025
5.9
FY2026
4.6
Source: -26-107693, Table 2 (p.32)
View data as table
| FY2024 | 6.4 |
|---|---|
| FY2025 | 5.9 |
| FY2026 | 4.6 |
How each regulator answered its own auditor's fixes
The number of the audit's recommendations each agency contested. Two regulators disputed their auditors outright; the other two contested nothing -- but deferred the fixes rather than dispute them.
FHFA -- disagreed with all 4 of its FISMA fixes
4
HHS -- did not concur with 3 of 10
3
NRC -- contested none of 9
0
FAA & TSA -- contested none of 5
0
Source: FHFA- AUD-2026-004; - OAS-25-18-041; - --26-A-03; -26-107693
View data as table
| FHFA -- disagreed with all 4 of its FISMA fixes | 4 | Management disagreed with every one of the four new recommendations |
|---|---|---|
| HHS -- did not concur with 3 of 10 | 3 | The Inspector General kept all three despite 's non-concurrence |
| NRC -- contested none of 9 | 0 | offered no formal comments and waived the exit conference |
| FAA & TSA -- contested none of 5 | 0 | and agreed with all five, then deferred the fixes |
- The same shape recurs in four unrelated audits. Housing finance, health, nuclear, and aviation regulators each called their cybersecurity sound; independent examiners found the opposite and documented it.
- Two agencies graded on the identical scale both fell short. FHFA rated Level 2; landed at Level 3 (Core) and Level 1 (Supplemental) -- neither reached the Level 4 bar for 'effective.'
- Disputing the fix, not making it. FHFA rejected all four of its recommendations, three of ten -- the kept every one. and / didn't dispute, they deferred.
- The gaps show up in money and people, too. $16.9M in cyber spending missing from reports; 24 inspectors for 94 reactors; a 2024 ransomware attack on the health sector cost an estimated $874 million.
Every number traces to the primary audit re-fetched and re-read for this synthesis: FHFA- AUD-2026-004, - OAS-25-18-041, - --26-A-03, and -26-107693. The ~30% inspection cut, the $16.9M total, and the non-concurrence shares are this outlet's arithmetic on the source documents' own figures (methods in analysis.json); see verification.json.
Sources(9) ▾
- Federal Housing Finance Agency, Office of Inspector General (performance audit by Sikich CPA LLC), Audit of the Federal Housing Finance Agency's Information Security Programs and Practices Fiscal Year 2026 (AUD-2026-004) (2026-07-30) — FHFA-'s FY2026 FISMA audit, performed by Sikich CPA LLC. Re-fetched directly from fhfaoig.gov (HTTP 200) and read with pdftotext -layout for this synthesis. Sourced from it: the overall Level 2 - Defined (Not Effective) maturity rating and the Level 4 effectiveness threshold (Executive Summary p.2); the count of 4 new recommendations and 5 prior recommendations still open (p.2-3); and the Evaluation of Management Comments recording that FHFA management disagreed with all four recommendations (p.13, transmittal p.2). First reported in this outlet's member article fhfa-cybersecurity-maturity-gap; re-verified here against the issuer-hosted PDF and the byte-identical oversight.gov mirror. fhfaoig.gov · original document
- Council of the Inspectors General on Integrity and Efficiency (oversight.gov), Audit of the Federal Housing Finance Agency's Information Security Programs and Practices Fiscal Year 2026 (AUD-2026-004) -- oversight.gov copy (2026-07-30) — The same FHFA- report on the oversight.gov federal -report portal (HTTP 200), used to corroborate the issuer-hosted fhfaoig.gov copy: an independent second reachable copy of the identical file (matching byte length) on a different .gov host. oversight.gov · original document
- U.S. Government Accountability Office, Healthcare Cybersecurity: HHS Continues to Have Challenges as Lead Agency (GAO-25-107755) (2024-11-13) — 's November 2024 Snapshot on 's cybersecurity leadership of the healthcare and public health sector. Direct gao.gov fetch bot-blocks a plain curl (HTTP 403); read in full via the Wayback capture (HTTP 200). Sourced from it: the February 2024 Change Healthcare ransomware attack's estimated $874 million in losses, and hospitals' self-assessed 70.7 percent NIST framework adoption with not yet tracking ransomware-specific practices or evaluating its own support. First reported in this outlet's member article hhs-cybersecurity-oversight-gap. gao.gov · original document
- U.S. Government Accountability Office, Chief Information Officer Open Recommendations: Department of Health and Human Services (GAO-25-108539) (2025-09-03) — 's September 2025 letter to 's Chief Information Officer summarizing 82 open recommendations spanning cybersecurity and IT acquisitions. Direct gao.gov fetch bot-blocks a plain curl (HTTP 403); read via the Wayback capture (HTTP 200). Sourced from it: the 82 open recommendations, 37 considered sensitive, 1 designated a priority recommendation. First reported in this outlet's member article hhs-cybersecurity-oversight-gap. gao.gov · original document
- U.S. Department of Health and Human Services, Office of Inspector General (audit performed by Ernst & Young LLP), Review of the Department of Health and Human Services' Compliance With the Federal Information Security Modernization Act of 2014 for Fiscal Year 2025 (OAS-25-18-041) (2026-03-02) — -'s annual FISMA compliance audit for fiscal year 2025, performed by Ernst & Young LLP. Re-fetched directly from oig.hhs.gov (HTTP 200) and read with pdftotext -layout. Sourced from it: the 'Not Effective' rating for the sixth consecutive year, with Core metrics at 'Consistently Implemented' and Supplemental metrics at 'Ad Hoc'; and the ten recommendations, of which concurred with seven and did not concur with three (with the maintaining the validity of each). First reported in this outlet's member article hhs-cybersecurity-oversight-gap. oig.hhs.gov · original document
- U.S. Nuclear Regulatory Commission, Office of the Inspector General, Audit of the U.S. Nuclear Regulatory Commission's Cybersecurity Inspection Program for Operating Nuclear Power Plants (OIG-NRC-26-A-03) (2026-06-04) — -'s performance audit of the cybersecurity inspection program for operating nuclear power plants. Re-fetched directly from oversight.gov (HTTP 200) and read with pdftotext -layout for this synthesis. Sourced from it: the Results in Brief conclusion that the program 'is fundamentally robust and adaptive to emerging cyber threats' followed by the four itemized operational gaps (guidance lacks clarity; training-qualification expectations not well-defined; redundant/time-consuming tasks; time not accurately reported) (p.i); the 55 operating plants / 94 reactors scope (p.1); the 24 qualified inspectors with 8 having under a year of experience (p.4); the re-baselining that cuts annual cybersecurity inspections from 27 to 19 (p.6-7); and the 9 recommendations with offering no formal comments and waiving the exit conference (p.i, p.23). First reported in this outlet's member article nrc-cyber-inspection-capacity-gap. oversight.gov · original document
- Nuclear Regulatory Commission OIG (nrcoig.oversight.gov), Audit of the U.S. Nuclear Regulatory Commission's (NRC) Cybersecurity Inspection Program for Operating Nuclear Power Plants (report listing) (2026-06-04) — The -'s own report-listing page, corroborating report number --26-A-03, the June 4, 2026 issue date, the title, and the 9-recommendation finding summary on a second independently-loading page. nrcoig.oversight.gov · original document
- U.S. Government Accountability Office, Aviation Cybersecurity: FAA and TSA Are Collaborating on Cybersecurity but Need to Address Key Shortfalls -- Full Report (GAO-26-107693) (2026-07-16) — 's full 84-page aviation-cybersecurity audit. A plain curl of the gao.gov PDF bot-blocks (HTTP 403); the report was re-fetched intact via the standard document fetcher and read with pdftotext -layout. Sourced from it: defined its entities' roles while 's 2018 Cybersecurity Roadmap did not, is no longer aligned with the current Cybersecurity Strategy, and was due for update between 2018 and 2026 per Administrator's Intent 3.0 (p.23-24); Table 2's FY2024-2026 Information Security/Cybersecurity Program budget requests of 6.4, 5.9, and 4.6 million dollars (p.32) and 's omission of that program from its cyber budget reporting in all three years (p.30-31); the March 2026 updated strategy that still does not identify responsible entities (p.18, footnote 25); fully implementing 3 of 7 objectives and only 1 of 7 entities demonstrating required monitoring (p.40-41); and the five recommendations (one to , four to ) with and both agreeing and tying the fix to a later strategy realignment (p.51-53). First reported in this outlet's member article faa-tsa-aviation-cybersecurity-gap. gao.gov · original document
- U.S. Government Accountability Office, Aviation Cybersecurity: FAA and TSA Are Collaborating on Cybersecurity but Need to Address Key Shortfalls -- Highlights & Product Page (GAO-26-107693) (2026-07-16) — 's own product page and two-page Highlights for the aviation audit, independently reachable via the Artemis sealed capture (HTTP 200). Corroborates the report's top-line findings: 's 2018 roadmap outdated and undefined on roles; only 1 of 7 entities demonstrating required monitoring; fully implementing 3 of 7 objectives; not reporting all cybersecurity costs to ; and 5 total recommendations (1 , 4 ). gao.gov · original document
Comments
Always open. Logged-in readers can annotate paragraphs in place.
Loading comments…
Four regulators vouch for their own cybersecurity. Four independent audits say otherwise. FHFA's FISMA program rated Level 2 of 5; HHS was 'Not Effective' for a sixth straight year; NRC's inspection program, its own called 'robust and adaptive,' then documented unclear guidance and undefined training; TSA's accountability roadmap still dates to 2018.