The federal government has cybersecurity requirements for connected devices. It has acquisition guidance, security standards and increasingly urgent warnings about attacks on systems that control physical processes.
What it does not yet have is a complete, consistently maintained answer to a basic question: What devices are connected to federal networks?
A September 30 report from the Government Accountability Office found that, among 22 civilian agencies reviewed, 15 had established an initial inventory of networked Internet of Things and operational-technology devices as of September 2026. Only 11 were maintaining those inventories, and only 10 had included all required information for each device. Just seven agencies had met all three requirements.
That is not a minor administrative shortfall. An inventory is the starting point for deciding what must be patched, isolated, monitored, replaced or restored. If an agency does not know that a device exists, it cannot reliably know who owns it, what software it runs, what systems it connects to or what mission depends on it.
An inventory is a security control
The phrase “Internet of Things” can make this sound like a problem involving consumer gadgets. In federal environments, the relevant devices may include building-management systems, physical-access controls, environmental sensors, laboratory equipment, hospital systems, networked cameras, transportation equipment and industrial-control components.
Operational technology differs from ordinary information technology because it can monitor or change the physical world. A compromised office computer may expose records or credentials. A compromised controller may alter a pump, disable an alarm, change a building system or interfere with a physical process.
The distinction matters because a device does not need to resemble a conventional computer to create computer-security risk.
Under Office of Management and Budget requirements reviewed by GAO, an agency’s inventory should identify the asset, describe it, categorize it, name its owner or security officer, identify the vendor or manufacturer, record software and firmware versions, document network connections and integrations, and describe applicable security controls.
A list containing only device names and IP addresses may be useful for accounting. It is not necessarily useful during an incident. A defender may also need to know whether a device can be safely disconnected, whether its firmware is supported, whether it has an external service dependency and whether shutting it down would interrupt a mission.
The useful question is therefore not simply whether an agency possesses an inventory. It is whether the inventory can support a security or recovery decision today.
The gap is operational, not theoretical
GAO said agencies cited technical constraints, limited resources and competing priorities as reasons for incomplete implementation. Those explanations are credible. Specialized devices are often acquired by individual programs, installed by contractors or operated in facilities that were not designed around centralized information-technology management.
That complexity does not make the problem less important. It explains why a federal inventory cannot be treated as a one-time spreadsheet exercise.
Devices are replaced. Software versions change. Vendors change ownership. Temporary equipment becomes permanent. A research system may acquire a new network connection. A building-management platform may be moved to a cloud service. A contractor may retain remote access after the original installation is complete.
An inventory that is not reconciled with procurement, network-monitoring, vulnerability-management and access-control records will gradually become a historical document. It may describe what an agency once operated while omitting what it operates now.
GAO also found that the OMB had not issued updated fiscal-year 2026 guidance establishing a current implementation timeline or a clear priority for completing the work. The report recommends that OMB issue updated guidance and oversee agency implementation. OMB did not provide comments on the report.
The absence of current guidance does not excuse agencies from managing their systems. It does, however, make it harder to determine whether an agency that is behind is following an approved schedule, operating under a documented exception or simply allowing the requirement to recede behind other priorities.
When a connected device controls something physical
The consequences of poor asset visibility become clearer in the water sector. GAO cited July 2026 activity in which cyber actors targeted internet-exposed programmable logic controllers. In some cases, operators were locked out, systems were disconnected and utilities had to revert to manual operations.
Those incidents do not prove that incomplete federal inventories caused equivalent compromises. They do demonstrate why connected-device security cannot be measured only through stolen data or unauthorized logins. The failure may be loss of monitoring, loss of control or the need to operate a physical process without the normal digital interface.
The National Security Agency’s October guidance on zero-trust principles for operational technology makes a related point: users, devices, workflows and communications should be continuously verified rather than trusted solely because they occupy a familiar network location.
But continuous verification also depends on knowing what is present. Least privilege is difficult to enforce when nobody knows which devices a vendor installed. Segmentation is difficult to validate when the connections between systems are incomplete. Monitoring cannot reliably detect an unauthorized device if the organization has no authoritative baseline against which to compare it.
Standards cannot compensate for missing knowledge
Federal agencies are not short of technical advice. The National Institute of Standards and Technology’s draft revision of SP 800-213 treats the acquisition and integration of an IoT product as part of the security risk of the larger information system. That is the correct direction. A connected device is not an isolated purchase; it becomes a system element with dependencies, permissions and failure modes.
Yet standards describe what organizations should know and do. They do not create the missing information.
Nor does a completed inventory by itself secure anything. An agency can document a vulnerable device and still lack the money to replace it. It can identify a system but lack a safe patching process. It can know who owns a device while failing to monitor the owner’s remote access. It can maintain an accurate list and still be unable to operate if the device is disconnected.
The inventory is a foundation, not a finished defense. Without it, however, the rest of the defense becomes partly speculative.
The accountability question
GAO reported that no agencies had reported an IoT cybersecurity waiver under the process it reviewed. That result is ambiguous. It could mean agencies are complying without needing exceptions. It could mean agencies are not using devices that require waivers. It could also indicate that the waiver process is underdeveloped or that reporting is incomplete.
The distinction matters because legitimate operational constraints exist. Some specialized devices cannot be patched without disrupting a laboratory, hospital, facility or industrial process. Others may depend on vendor support that is slow, expensive or unavailable. A waiver process can make those risks visible and force an agency to document compensating controls.
No waiver system, however, can substitute for knowing which devices are in use. A formal exception for an identified risk is different from an unknown system that has never reached the security process.
Federal agencies should ultimately be able to answer, during an incident: What is this device? Who owns it? What does it connect to? Can it be isolated? Can it be restored? What mission fails if it is shut down? What manual process replaces it?
If answering those questions requires a week of assembling records from procurement offices, contractors, facilities teams and program managers, the agency may possess cybersecurity policies without yet possessing operational control of its connected environment.
The government’s IoT problem is therefore less about finding one more security product than about maintaining organizational memory. Connected systems become manageable when an institution knows what exists, how the pieces depend on one another and what happens when one of them fails. Until federal agencies can maintain that knowledge, stronger security language will remain ahead of the systems it is supposed to protect.
This is a different problem from the contractor-access risks examined in my recent report on third-party industrial-control-system integrators. There, the central issue was who else can reach a known operational environment. Here, the earlier question comes first: whether the organization can identify and describe the environment at all.
