{"database": "openregs", "table": "gao_reports", "rows": [["GAO-26-108937", "Internet of Things: OMB Action Needed to Ensure Agencies Secure Their Networked Devices", "2026-09-30", "GAO-26-108937", null, null, "What GAO Found\n\nThe nation\u2019s infrastructure relies on information systems to support its varied functions. This includes the networked Internet of Things (IoT) and operational technology (OT) devices that interact with the physical world, including in building maintenance systems and specialized equipment in hospitals and laboratories.\n\nResponsible federal agencies have issued guidance, best practices, and requirements to help agencies securely procure such devices. For example, the Office of Management and Budget (OMB) has issued requirements to ensure that agencies establish and maintain inventories of their networked devices and process IoT cybersecurity waivers.\n\nHowever, most agencies have not fully addressed OMB\u2019s networked device requirements, which were established in December 2023 and updated in January 2025. Specifically, agencies\u2019 initial inventories were required to be completed by September 2024. However, as of September 2026, of the 22 civilian Chief Financial Officer (CFO) Act agencies in GAO\u2019s review, 15 had established an inventory, 11 were maintaining their inventories, and 10 had included all required information (such as asset description and software version) for each device. Overall, only seven agencies had fully addressed all three of OMB\u2019s requirements. Further, no agencies had reported an IoT cybersecurity waiver.\n\nStatus of 22 Agency Networked Device Inventories, as of September 2026\n\n\n\nAgencies cited a variety of reasons for not having completed or maintained inventories with required information, including technical and resource constraints and competing priorities. However, OMB has yet to issue updated guidance to agencies that covers fiscal year 2026, leaving agencies without a clear imperative to prioritize implementation of the requirements and a timeline for doing so. Until OMB issues this guidance, agencies will lack appropriate direction on how and when to complete their device inventories. In the absence of inventories, agencies may lack awareness of the number and type of connected devices in their systems and be at risk of not protecting those systems from cyberattacks. Further, without updated guidance and oversight of agencies\u2019 implementation of inventory requirements, agencies may continue to struggle to apply appropriate security controls to vulnerable systems\u2014potentially compromising highly sensitive data and systems.\n\nWhy GAO Did This Study\n\nNetworked technologies and devices are facing increasing cyber threats from around the globe. For example, in July 2026, cyber threat actors disrupted operations in the water sector by modifying passwords to disconnect networked programmable logic controllers, which are a type of OT. Moreover, emerging technologies such as artificial intelligence can compound risks faced by these technologies and devices. The IoT Cybersecurity Improvement Act of 2020 includes provisions for OMB and civilian CFO Act agencies to identify and protect networked devices.\n\nThe act also includes provisions for GAO to report every 2 years on IoT guidance and the waiver process through 2026. This final report in a series of three (1) describes guidance and best practices for procuring secure networked devices; and (2) evaluates agencies\u2019 progress in addressing networked device cybersecurity.\n\nGAO identified federal agencies with cybersecurity or acquisition responsibilities and described guidance and best practices developed by those agencies for procuring secure networked devices. GAO compared 22 civilian CFO Act agencies\u2019 inventory implementation efforts to OMB\u2019s requirements. GAO also interviewed relevant agency officials to obtain their views and verify the information provided.", null, null, null, null, null, null, null, "https://www.gao.gov/products/gao-26-108937", null]], "columns": ["package_id", "title", "date_issued", "report_number", "document_type", "doc_class", "abstract", "subjects", "public_laws", "usc_references", "statute_references", "citation", "pdf_url", "html_url", "detail_url", "sudocs"], "primary_keys": ["package_id"], "primary_key_values": ["GAO-26-108937"], "units": {}, "query_ms": 0.33090508077293634, "source": "Federal Register API & Regulations.gov API", "source_url": "https://www.federalregister.gov/developers/api/v1", "license": "Public Domain (U.S. Government data)", "license_url": "https://www.regulations.gov/faq"}