Summary

  • As of September 2026, 15 of 22 civilian Chief Financial Officers Act agencies had established an inventory of networked IoT and operational technology devices. Eleven maintained their inventories, ten recorded all eight required categories of information, and only seven fully met all three requirements.
  • HUD said a newer asset management system had identified more than 160 IoT devices absent from its legacy system. Commerce and Justice had inventories with all required fields but were not maintaining them across the enterprise on a recurring basis. The White House Office of Management and Budget had not issued updated FY2026 guidance or overseen implementation within a set timeframe.

The device does not need permission to exist

The GAO report published on September 30, 2026 concerns equipment that touches the physical world: networked sensors, building systems and specialized devices in laboratories and health facilities. An agency needs to know which of those things are on its networks before it can assign an owner, examine the software and apply a control. The federal rule is older than the report. Office of Management and Budget instructions issued in December 2023 and revised in January 2025 required civilian agencies in the review to establish enterprise inventories by September 2024 and keep them current.

Two years after that initial deadline, GAO found seven of 22 agencies still developing their first inventories. Fifteen had a list. Eleven were maintaining a list. Ten had included all eight information categories required for each device. Only seven had completed all three tasks. These are overlapping tests of the same agencies. An inventory that exists can still be stale; a regularly maintained list can still lack the fields that tell a security officer what it contains.

The eight fields explain why this is more than an administrative count. OMB calls for an identifier, description and category; the system owner or security officer; vendor or manufacturer; software and firmware versions; network integrations and interfaces; and security controls. If a connected controller appears without its owner, no one is named to check it. If the version is missing, a team cannot confidently match it to an update. If the network integration is blank, the route by which it reaches other systems is harder to see. The form is a map of who can act when the device changes.

HUD offered a striking case of the first problem. Its officials said a newer hardware asset management system had identified more than 160 IoT devices its legacy system had not reported. They were deploying software for an enterprise inventory but had not set a completion date. The GAO record does not say those 160 devices were compromised. It shows the count changed when the method of looking changed. A government can only assign protection to equipment it has actually brought into view.

A complete column set can still be yesterday's map

The Department of Commerce had all eight required categories in an initial inventory. Its components, however, were responsible for keeping their own lists, and Commerce was not updating the inventory across the entire department on a recurring basis. The Department of Justice also had a complete initial set of fields but lacked recurring maintenance, citing staff turnover and limited resources. Those examples show why a pristine form at launch is a weak achievement if additions and retirements are not carried through the enterprise.

Other agencies illustrated the opposite gap. The Department of Transportation had built an inventory and planned to maintain it, but only two of the eight categories were complete, one partial and five absent. Treasury had an initial inventory, yet GAO found none of the required information in it and no recurring maintenance. Energy had four categories complete, one partial and three missing; its officials said information had been removed because the data were not meaningful or were sensitive. Each gap creates a different task: discovery, upkeep, field quality or a workable way to handle sensitive details.

The full GAO report also records agencies that met the requirements. Education, DHS, State, EPA, GSA, NASA and OPM were among the seven with an initial inventory, maintenance plan and all required categories. This is proof the three-part job can be done. It does not make the inventory exercise effortless. NASA officials said tools cannot reliably classify every discovered asset as IT, IoT or operational technology, and active scanning can disrupt sensitive systems. A better list needs methods suited to the equipment, not just more aggressive queries.

No agency in the 22 reported an IoT cybersecurity waiver. That is the reported waiver record. It cannot fill the missing device rows. A waiver process describes a documented exception for a known device; an undiscovered device never reaches the decision desk.

Washington's missing instruction is a management choice

GAO found that OMB had not issued updated guidance covering fiscal 2026 or overseen inventory implementation in a defined timeframe. The agency complaints included technical constraints, resources and competing priorities. OMB sets the imperative and the deadline that let a department decide which work gets people and budget. Without a current checkpoint, a half-built inventory can remain a standing project while physical devices keep arriving.

GAO made one recommendation: OMB should issue updated guidance with a clear priority and timetable for networked IoT and operational technology inventories, then oversee implementation. OMB did not comment on the draft report. The useful outcome is a dated direction followed by verified agency evidence that the devices, owners, versions, connections and controls are present and kept up to date. The Heng Lu note urging a look beneath institutional descriptions to operating reality supplies the editorial lens. GAO supplies the federal facts.

Sources