GAO Urges OMB to Update Cybersecurity Guidance for Agencies’ Networked Devices

GAO said the guidance should set a clear priority and timeline for completing device inventories, which help agencies protect connected systems from cyberattacks.

GAO published the report Wednesday as the last of three evaluations mandated by the IoT Cybersecurity Improvement Act of 2020.

Together, those memos required initial device inventories by September 2024 and set eight data categories for each connected asset, including software and firmware versions and security controls.

What Challenges Are Agencies Facing in Completing IoT and OT Inventories?

The Department of Housing and Urban Development said a new hardware asset management system identified more than 160 IoT devices its legacy system had not reported.