The GAO’s September 2026 case work on IoT OT inventories shows a basic security-control problem: many civilian agencies had identified networked devices, but fewer had kept complete, current records with the information OMB required. For infrastructure teams, that distinction matters. A one-time list can satisfy a project milestone; an actively maintained inventory supports risk ownership, patch planning, segmentation decisions, and incident response.
The findings are not a sign that agencies ignored the issue entirely. Most of the 22 civilian Chief Financial Officer Act agencies reviewed had made progress by September 2026. The gap was in completeness and sustainment. That is a familiar pattern in operational technology and facilities-heavy environments, where asset data often sits across procurement systems, engineering records, local spreadsheets, and network tools that were not built for the same purpose.
What GAO Found In IoT OT Inventories
Agency Status In September 2026
GAO reported that, as of September 2026, 15 of the 22 civilian CFO Act agencies reviewed had established an enterprise-wide inventory of networked IoT/OT devices, while 11 were maintaining those inventories on an ongoing basis, according to the GAO report page. Only 10 agencies had included all eight categories of information required by OMB, and only seven had fully addressed all three requirements: establishment, maintenance, and inclusion of all required information categories.
The Compliance Gap Is A Data-Quality Gap
The difference between 15 established inventories and seven fully compliant programs is the technical center of the issue. Networked-device inventories are not useful merely because they contain device names. They need enough structured information to support decisions. If a record lacks owner, software version, connectivity, categorization, or security-control data, the agency may know a device exists but still struggle to judge exposure, assign remediation work, or validate whether compensating controls apply.
That problem is especially acute for operational technology. OT devices may have long service lives, maintenance windows tied to facility operations, and vendor support cycles that differ from conventional IT endpoints. GAO’s reported barriers included technical limitations, resource constraints, competing priorities, and difficulty distinguishing IT, OT, and IoT devices. Those are not excuses, but they are practical indicators of why the inventory task remained unfinished for many agencies.
OMB Requirements And Inventory Data Quality
Eight Required Information Categories
GAO’s detailed report states that OMB memoranda issued in December 2023 and January 2025 required agencies to establish full inventories by September 2024 and include eight key categories of information, such as asset description, manufacturer, software version, connectivity, owner, categorization, and security controls, as described in the GAO detailed report. The September 2026 results show that deadlines alone did not produce uniform execution.
From a controls perspective, those fields are not administrative decoration. Manufacturer and software-version data help identify exposure to known flaws and unsupported components. Connectivity information helps assess whether a device can be reached from enterprise networks or external paths. Ownership data determines who is accountable for approvals, maintenance windows, and risk acceptance. Categorization and security-control records help link the device to agency risk processes rather than leaving it as an isolated engineering asset.
Why IoT OT Inventories Remain Hard To Sustain
For federal IoT OT inventories, the hard part is not only device discovery. It is keeping records synchronized with acquisition, installation, configuration changes, decommissioning, and security exceptions. A device can enter service through a facilities project, a lab deployment, a local modernization effort, or a vendor-managed system. If the agency lacks a clear intake path, the inventory becomes stale shortly after it is created.
OMB’s requirement for ongoing maintenance addresses that risk directly. GAO found that only 11 of 22 reviewed agencies were maintaining inventories on an ongoing basis as of September 2026. That result indicates a governance issue as much as a tooling issue. Scanners and asset platforms can help where devices are visible and identifiable, but agencies still need process owners, update triggers, validation checks, and a way to reconcile technical discovery against procurement and system-authorization records.
Why Maintenance Is The Operational Test
Waiver Reporting Became Cleaner
The waiver data in the research suggests one area where reporting became more orderly. In July 2024, six agencies had reported IoT cybersecurity waivers under OMB’s process, but GAO told five of them that they should not have reported waivers. Four corrected those reports, while HHS had not yet corrected at that time. By September 2026, none of the 22 agencies reviewed had reported an active IoT cybersecurity waiver. HHS had earlier reported one, then removed it after the devices in question were taken out of the system.
That improvement should be read narrowly. Cleaner waiver reporting does not mean inventories are complete or that device risk has disappeared. It means the exception channel was not showing active waivers at the time GAO assessed the agencies. The main weakness remained inventory execution: establishment, maintenance, and full data-category coverage.
Asset Records Need Operational Ownership
In data center and facility environments, asset ownership can be fragmented. A network team may see the connection, a facilities group may own the equipment, a contractor may perform maintenance, and a security office may own policy review. If an inventory record does not map those relationships, response work slows down. During an incident or urgent vulnerability review, teams need to know not just where a device is, but who can approve changes and what operational constraints apply.
This is where maintenance becomes the real test. An inventory that is accurate on the day of an audit can still fail operationally if it does not change when the environment changes. Agencies dealing with IoT and OT equipment need repeatable update points: procurement approval, network connection, system authorization, configuration change, maintenance event, and removal from service. Without those points, records decay quietly.
Security And Oversight Risks
Risk Is Operational, Not Abstract
Weak IoT OT inventories create uncertainty before technical defense work even begins. Agencies cannot consistently prioritize patching, isolation, monitoring, or replacement if they lack current information about what is deployed and how it connects. The GAO findings do not establish that every missing data field led to a security incident. They do show that many agencies lacked the complete records OMB required for managing networked-device security at enterprise scale.
The distinction matters because federal IoT/OT environments may include devices that are not managed like ordinary workstations. Some may be difficult to scan safely, some may depend on vendor maintenance, and some may support facility functions that are sensitive to downtime. A cautious security program therefore needs asset intelligence before it applies controls. The inventory is the map that determines whether security action is targeted or improvised.
Oversight Needs Current Guidance
Agencies also cited lack of updated guidance or oversight from OMB as a barrier, and the research notes that OMB had not issued fiscal year 2026 guidance as of August 2026. That is significant because agency programs often need central direction to resolve definitional and reporting questions. If teams are unsure how to classify a device or how to interpret the boundary between IT, OT, and IoT, inconsistent reporting is a predictable result.
Technical tooling will not solve classification alone. Agencies need common definitions, repeatable data models, and validation procedures that can survive personnel turnover and changes in device mix. A site such as Techncoins, available at this link, often tracks related infrastructure and security-governance issues, but the federal case here is specific: GAO found that formal requirements existed, yet implementation remained uneven across the agencies reviewed.
GAO Report On Federal Agency IoT OT Inventories
What The Case Study Shows
The September 2026 GAO report frames IoT OT inventories as a basic but unfinished control area. The agencies reviewed had made measurable progress, but the gap between creating an inventory and sustaining a complete one remained substantial. Seven of 22 agencies had fully addressed all three OMB requirements, which leaves most reviewed agencies with at least one unresolved inventory weakness.
For security leaders and infrastructure operators, the practical lesson is restrained but clear. Inventory programs need to be treated as living operational controls, not reporting artifacts. The key evidence to track after the GAO report is whether agencies can raise the number of maintained inventories, increase coverage of the required data categories, and resolve classification problems between IT, OT, and IoT without relying on one-off cleanup projects.
The case also shows why federal device security depends on governance as much as discovery. Asset tools can find many connected devices, but OMB-required records require ownership, categorization, connectivity context, and security-control status. Until those elements are maintained as devices change, agencies will continue to face avoidable uncertainty in securing networked systems.
