GAO Urges OMB to Update IoT and Operational Technology Cybersecurity Guidance

The Government Accountability Office (GAO) has recommended that the Office of Management and Budget (OMB) issue updated cybersecurity guidance for networked Internet of Things (IoT) and operational technology (OT) devices, emphasizing the need for a clear timeline for implementation.

GAO’s report notes that as of September 2026, fifteen federal agencies had completed device inventories, but only seven had met all existing OMB requirements for IoT and OT cybersecurity.

Agencies reported that technical limitations, resource constraints, and competing priorities are major obstacles to achieving full compliance with current cybersecurity standards for connected devices.

The GAO urges OMB to prioritize setting a clear deadline for agencies to finish comprehensive inventories, which are essential for protecting government networks from cyber threats.

Improved guidance would help civilian agencies better secure their networks and plan modernization efforts by providing visibility into connected devices across federal systems.

The recommendation comes amid increasing reliance on IoT and OT in critical infrastructure, highlighting the growing importance of robust cybersecurity measures for government operations.