The federal government has spent years developing standards, guidance, directives and procurement rules intended to protect the growing collection of devices connected to its networks.
There is, however, a rather fundamental prerequisite to securing all those devices: knowing what they are.
Two years after federal agencies were supposed to complete enterprise-wide inventories of their networked Internet of Things and operational technology devices, seven of the 22 civilian agencies reviewed by the Government Accountability Office still had not established those inventories.
The finding comes from a new GAO report examining implementation of federal cybersecurity requirements for networked devices. The devices in question are not limited to the familiar consumer conception of the “Internet of Things.” They can include building automation equipment, environmental sensors, security cameras, physical-access systems, transportation equipment, industrial controllers and specialized equipment in hospitals and laboratories.
In other words, these are devices capable of interacting with the physical world while connected to government networks.
And in parts of the federal government, nobody has yet completed the list.
A September 2024 deadline meets September 2026
The Office of Management and Budget directed civilian Chief Financial Officers Act agencies to establish enterprise-wide inventories of networked IoT and operational technology assets by the end of September 2024.
The inventories were not supposed to be glorified equipment lists.
OMB required agencies to maintain them and include eight categories of information for each asset: identification, description, categorization, the responsible information-system owner or security officer, manufacturer information, software and firmware versions, network connections and application programming interfaces, and applicable security controls.
GAO checked the government’s homework in 2026.
Of the 22 civilian agencies it reviewed, 15 had established an initial inventory. Eleven were maintaining those inventories. Ten had included all the required information.
Only seven had managed to do all three.
That leaves seven agencies without an initial inventory nearly two years after the deadline.
Those seven were the Departments of Agriculture, Health and Human Services, Housing and Urban Development, Labor, Interior and Veterans Affairs, along with the National Science Foundation.
The explanations varied.
Agriculture had conducted a pilot and had technology capable of scanning its network, but implementation was on hold because of infrastructure changes. GAO reported that USDA had no timeline for establishing its inventory.
HHS was still evaluating possible solutions and likewise had no timeline. GAO had already recommended that HHS complete the inventory, a recommendation that remained unaddressed.
Labor cited resource constraints and competing mission-critical priorities. Interior was working toward January 2027. VA was deploying a database to support its enterprise inventory. NSF cited a building relocation and did not provide GAO with a completion timeline.
September 2024, it turns out, was less a finish line than an aspiration.
An inventory of unknown things
One finding from HUD illustrates why the exercise matters beyond compliance paperwork.
HUD was deploying a new hardware asset-management system while trying to establish its inventory. According to GAO, that new system identified more than 160 IoT devices that HUD’s legacy system had not reported.
GAO does not establish that those devices were compromised, improperly configured or malicious. Nor does the HUD result tell us how many similarly undiscovered devices might exist elsewhere in government.
But it demonstrates the underlying problem rather neatly.
An agency cannot make informed decisions about securing a networked device if its asset-management system does not know the device exists.
GAO warned that incomplete inventories could leave chief information officers and chief information security officers unaware of the number and types of devices connected to agency systems, making it harder to apply security controls or respond appropriately to cybersecurity incidents.
That concern is not theoretical.
GAO notes recent cyberattacks against operational technology, including July 2026 incidents targeting internet-connected programmable logic controllers in water and wastewater systems. Attackers modified passwords, locked operators out and disconnected equipment from networks, producing operational effects that included boil-water notices and forcing operators back to manual operations.
The report also cites warnings involving Chinese state-sponsored actors compromising routers and IoT devices, with vulnerable and unsupported equipment being used to establish botnets and potentially provide pathways toward operational technology in critical infrastructure.
Against that threat environment, “we haven’t finished the inventory” becomes somewhat more consequential than a missed administrative deadline.
Some agencies have a list. Sort of.
Completing an inventory did not necessarily mean an agency had completed the assignment.
The Department of Energy had established an inventory and documented plans for maintaining it, but GAO found that DOE completely included only four of OMB’s eight required categories of information. Another category was partially included, while three were absent.
DOE officials told GAO that some information had been removed in fiscal 2025 because of a lack of meaningful data or because the information was sensitive.
Transportation’s inventory fully contained only two of the eight required categories, partially contained one and omitted five.
The Nuclear Regulatory Commission fully included two categories, partially included three and omitted three. The Small Business Administration had the same two-complete, three-partial, three-missing breakdown. Neither provided GAO with a timeline for completing all the requirements.
Then there is Treasury.
Treasury had established an inventory. Officials were working on plans to maintain it.
But GAO found that Treasury wasn’t maintaining the inventory on a recurring basis and that the inventory did not include any of OMB’s required information.
The federal government has therefore achieved the bureaucratic equivalent of creating a filing cabinet before deciding what should go inside it.
Commerce and the Justice Department presented the inverse problem. Their inventories contained all of OMB’s required information, but GAO found that neither department was maintaining its inventory properly on a recurring enterprise-wide basis. DOJ officials cited significant staffing turnover and resource constraints during the preceding year.
The agencies aren’t the only ones behind
The trail eventually leads back to OMB.
OMB issued the requirements agencies were supposed to follow, but GAO found that it had not issued updated network-device cybersecurity guidance covering fiscal 2026.
That matters because GAO concluded that agencies were consequently left without a clear imperative to prioritize implementation or a timeline for completing it.
More significantly, GAO found that OMB had not overseen implementation of its inventory requirements within an established time frame.
GAO had tried to get an update.
The watchdog says OMB did not respond to requests made in February and June 2026 seeking information about the status of its guidance.
When GAO subsequently provided OMB with a draft of this report, OMB did not provide comments.
GAO’s recommendation is consequently directed at OMB rather than the seven delinquent agencies.
The watchdog wants OMB to issue updated cybersecurity guidance covering IoT and operational technology, oversee agency implementation, establish a clear imperative for completing the requirements and provide a timeline.
The cybersecurity rule before the cybersecurity
There has been progress.
GAO’s previous review found that only three of 23 agencies had established inventories of the devices then covered by OMB’s definition. The latest review found 15 of 22 had established inventories, although USAID was excluded from the latest analysis because substantial personnel reductions prevented it from supplying information in time.
Seven agencies also demonstrated that the complete assignment is achievable. Education, DHS, State, EPA, GSA, NASA and OPM had established inventories, documented plans to maintain them and included all required information.
But that makes the remaining gap harder to dismiss.
The federal government has legislation governing IoT cybersecurity. It has NIST standards. It has OMB memoranda. It has CISA directives. It has procurement requirements, vulnerability-management programs, security controls and even a formal process for granting waivers when a device cannot comply with cybersecurity requirements.
What it does not yet have, across a substantial portion of the civilian government, is a complete and continuously maintained answer to the considerably simpler question:
What devices are connected to the network?
Four years after the IoT Cybersecurity Improvement Act began driving this oversight regime, and two years after OMB’s inventory deadline, GAO’s answer is clear.
For seven major federal agencies, the inventory still isn’t finished.
