The IoT Cybersecurity Improvement Act of 2020 includes provisions for OMB and civilian CFO Act agencies to identify and protect networked devices.
OMB established its networked device requirements in December 2023 and updated them in January 2025, setting a September 2024 deadline for agencies to complete their initial inventories.
Broader Context The audit's scope covers the 22 civilian CFO Act agencies.
GAO compared those agencies' inventory implementation efforts with OMB requirements and interviewed relevant agency officials to obtain their views and verify the information provided.
With only seven of the 22 agencies reviewed fully addressing all three OMB requirements, GAO concluded that updated guidance and oversight are needed to ensure agencies implement networked-device cybersecurity requirements.