Federal Audit Finds 15 of 22 Agencies Lack Complete IoT Device Inventories

Federal agencies fail basic IoT inventory requirements

A September 30 Government Accountability Office audit found that only 7 of 22 civilian CFO Act agencies had fully addressed Office of Management and Budget requirements for networked-device cybersecurity. Fifteen agencies established device inventories, but only 11 maintained them, and just 10 included required information such as device descriptions and software versions.

The gap matters because device inventories are the foundation for vulnerability management, patch prioritization, and waiver processes. Without accurate software-version data, agencies cannot determine exposure to known vulnerabilities or demonstrate compliance with federal mandates. The audit signals that one-time deployments are insufficient—the operational cost lies in keeping inventories current as devices are added, removed, or updated.

Federal buyers and contractors should expect increased scrutiny of inventory completeness, software-version tracking, and audit trails. Procurement teams evaluating platforms should require evidence that a product can discover unmanaged devices across OT, medical, building automation, and embedded environments; maintain an auditable inventory; identify firmware versions; and export records for OMB or agency reporting. Traditional mobile-device-management products generally do not provide equivalent visibility into these unmanaged device classes.

NIST revises IoT procurement guidance

NIST released a draft revision of SP 800-213r1, IoT Product Cybersecurity Guidelines for the Federal Government, on September 26. The revision incorporates lessons learned and aligns the guidance with the Cybersecurity Framework 2.0 and SP 800-53 Revision 5.2.0. NIST intends the updated catalog to help agencies establish procurement requirements for device identity, secure configuration, vulnerability handling, update mechanisms, logging, and lifecycle support.

The draft shifts competition from generic "secure IoT" positioning to procurement evidence. Vendors will increasingly need to document how their controls map to federal catalogs. Products from Microsoft, Cisco, Palo Alto Networks, Armis, Claroty, and specialized IoT-security vendors will compete partly on the directness of their reporting and the granularity of their control mappings.

Federal buyers and suppliers should treat the draft as a signal to review upcoming solicitations and security questionnaires. Procurement teams should ask vendors for explicit mappings to NIST IoT requirements, supported update and end-of-life policies, device identity capabilities, and retention of security telemetry. Because this is a draft, buyers should avoid treating every proposed control as a final mandatory requirement but should budget for additional documentation and integration work as the guidance is finalized.

OT network segmentation remains weak

Forescout Research analyzed 47,700 network segments across 209 organizations, covering approximately 2.5 million devices. Only 13% of network segments containing OT devices were exclusively OT segments. Nearly half of segments containing OT or Internet of Medical Things devices also contained IT and IoT assets, increasing the possibility of lateral movement between operational and enterprise systems.

The result strengthens the case for products that combine passive asset discovery, behavioral monitoring, segmentation policy, and enforcement. Forescout competes in this area with Claroty, Nozomi Networks, Armis, Microsoft Defender for IoT, Cisco Cyber Vision, and Palo Alto Networks' OT-security offerings. Network-access and microsegmentation vendors such as Cisco, Illumio, and Akamai Guardicore also compete for portions of the budget.

Enterprises should not evaluate IoT security solely as a device-monitoring purchase. The data supports funding a combined program covering asset inventory, zone design, segmentation, and lateral-movement detection. Buyers should ask whether a platform can identify mixed IT/OT/IoT segments, recommend or enforce policy without disrupting industrial processes, and integrate with existing firewalls and network-access-control systems. The study's sample is substantial but vendor-sponsored, so procurement teams should validate the findings against their own network telemetry before committing budget.

What to watch

The federal audit and NIST revision create near-term procurement momentum for IoT-security platforms that provide continuous discovery, firmware identification, and compliance reporting. The segmentation study adds weight to the case for funding network redesign alongside detection. Buyers should prepare for more detailed security questionnaires, longer vendor-evaluation cycles, and higher operational costs for inventory maintenance. The combination of regulatory scrutiny and weak baseline controls increases the probability that IoT security will shift from discretionary projects to mandated line items in federal and critical-infrastructure budgets.