On 30 September 2026, the US Government Accountability Office published GAO-26-108937, "Internet of Things: OMB Action Needed to Ensure Agencies Secure Their Networked Devices." It is the third and final GAO report required by the IoT Cybersecurity Improvement Act of 2020. GAO found that only 7 of 22 civilian agencies fully met OMB's requirements to establish, maintain and fully populate inventories of networked IoT and OT devices. It also found that OMB had not issued guidance for fiscal year 2026.
What's affected
GAO reviewed 22 CFO Act agencies. The headline numbers:
- 15 agencies had established networked IoT and OT device inventories. 7 had not. The initial inventories were due in September 2024.
- 11 agencies were maintaining their inventories.
- 10 agencies included all eight required information categories, 4 included some and 1 included none.
- No agency reported an IoT cybersecurity waiver.
The eight categories OMB requires for each device are where vendors come in:
- Asset identification.
- What the asset is and does.
- How it is classified.
- Who owns it.
- Vendor or manufacturer details.
- Software and firmware versions.
- Network connections, integrations and APIs.
- Security controls applied.
Several of those fields can only be filled accurately with information from the manufacturer.
GAO also restates how the Act works. NIST sets standards and guidelines for agency use of IoT devices. Agency CIOs review contracts, and if a device would prevent compliance with those standards, the agency may not use, procure or renew it unless the agency head grants a waiver. A waiver needs one of three grounds: national security, research, or the device being secured by alternative effective methods. Under OMB's January 2025 memo, M-25-04, waivers may not exceed two years.
Two caveats GAO notes:
- The FAR rule implementing the procurement prohibition was proposed in October 2023 and was still under comment review as of July 2026.
- OMB's most recent networked device memo is M-25-04 from January 2025. GAO recommends OMB issue updated guidance with a clear timeline and oversee implementation. OMB did not provide comments.
On standards, NIST issued an initial public draft of SP 800-213 Revision 1 in June 2026 and plans to finalize it in late 2026. It plans an updated draft of SP 800-213A, the IoT device cybersecurity capability catalog, in winter 2026 to 2027.
Does this apply to you?
GAO's report creates no new obligation. It describes how agencies are doing against existing OMB requirements and recommends OMB act. It matters to you if:
- You sell connected devices, OT equipment or embedded systems to US civilian agencies, directly or through integrators.
- Your device firmware includes third-party or open source components whose versions agencies will need to record.
- Your device exposes network services or APIs that agencies must list as connections and integrations.
- You are an agency or integrator responsible for the inventory itself.
If your federal customers are only buying IT software with no device component, the inventory requirement is less likely to touch you.
What to do now
- By 31 October 2026: prepare a one-page device data sheet per product covering all eight OMB fields that you can answer as the manufacturer: identity, function, firmware and software versions, network services and APIs, and built-in security controls.
- By 30 November 2026: make firmware and software versions readable remotely or through a documented local method. Agencies cannot inventory what they cannot query.
- By 31 December 2026: produce an SBOM for each supported firmware version so agencies can answer the software field at component level.
- By end of 2026: review the SP 800-213 Revision 1 draft, and plan to comment on the SP 800-213A update when NIST publishes it in winter 2026 to 2027. That catalog is what agencies will measure devices against.
- Ongoing: track OMB's next networked device memo and the FAR rule. Either one would change how procurement reviews treat devices that do not meet NIST guidelines.
Why it matters
Inventories are where device security starts. An agency that does not know which firmware version runs on a camera cannot tell whether a new advisory affects it. GAO's finding that most agencies have incomplete inventories, and that OMB has issued no guidance covering fiscal year 2026, means vendor-supplied data will carry more of the load as agencies catch up.
Vendors who publish clear version information, component lists and network service descriptions make that work cheap for their customers. Vendors who do not will find their products harder to justify if the FAR rule is finalized.
Try it yourself
Take one device you sell and try to fill in all eight OMB fields using only your public documentation. Then list the components and versions in its current firmware. Each field you could not fill from documentation is a question an agency will eventually send you.
Click through it at your own pace, or open it full screen.
Quick check
How many of the 22 agencies fully met all three OMB inventory requirements?
Seven. GAO's three requirements were establishing, maintaining and fully populating the networked device inventory.
Is the IoT procurement prohibition already written into the FAR?
Not as a final rule. GAO says the FAR rule was proposed in October 2023 and was still under comment review as of July 2026.
How long can an IoT cybersecurity waiver last under OMB's January 2025 memo?
No more than two years.
