Most civilian agencies have not fully met federal requirements to identify and track networked Internet of Things (IoT) and operational technology (OT) devices, increasing potential cybersecurity risks, the Government Accountability Office (GAO) said in a Sept. 30 report.
Of the 22 civilian Chief Financial Officers (CFO) Act agencies GAO reviewed, 15 had established inventories of networked IoT and OT devices as of September 2026. Of those 15, 11 were maintaining the inventories and 10 had reported all inventory information required by the Office of Management and Budget (OMB).
Only seven agencies had fully met all three requirements, GAO found. Agencies were originally required to establish inventories by September 2024 under OMB guidance issued in December 2023 and updated in January 2025.
GAO noted that OMB had not issued updated networked device cybersecurity guidance covering fiscal year 2026 or overseen agency implementation within an established time frame.
“Until OMB issues this guidance, agencies will lack appropriate direction on how and when to complete their device inventories,” GAO said. “In the absence of inventories, agencies may lack awareness of the number and type of connected devices in their systems and be at risk of not protecting those systems from cyberattacks.”
“Further, without updated guidance and oversight of agencies’ implementation of inventory requirements, agencies may continue to struggle to apply appropriate security controls to vulnerable systems – potentially compromising highly sensitive data and systems,” the watchdog added.
Agencies cited technical and resource constraints and competing priorities among the factors slowing implementation.
GAO recommended that OMB issue updated cybersecurity guidance for networked IoT and OT devices and oversee agencies’ compliance with the requirements. The guidance should also include “a clear imperative to prioritize implementation of the networked device requirements and a timeline for doing so,” GAO said.
OMB did not provide comments on the report.
The report is the third and final GAO review required under the IoT Cybersecurity Improvement Act of 2020.