GAO: Agencies Need to Conduct Cyber Risk Assessments of IoT, OT Devices in Critical Infrastructure Sectors

Federal agencies overseeing critical infrastructure sectors need to do a better job of assessing the cybersecurity risks posed by Internet of Things—or IoT—and operational technology—or OT—devices and systems that they use to help deliver vital services, according to a report from the Government Accountability Office released on Thursday.

GAO’s report analyzed the steps taken by several leading agencies—including the departments of Health and Human Services, Energy, Homeland Security and Transportation—to manage cybersecurity risks related to the use of IoT and OT devices in the healthcare and public health, energy and transportation sectors. 

GAO defined IoT as “the technologies and devices that allow for the network connection and interaction of a wide array of ‘things’” and OT as “programmable systems or devices that interact with the physical environment.” The report noted that IoT and OT devices and systems are extensively used in the three selected sectors to carry out essential services, but are “inherently at risk” of compromise.

“These systems are highly complex, technologically diverse, and often geographically dispersed,” GAO noted. “In addition, they are often interconnected with other internal and external systems and networks, including the internet. This complexity increases the difficulty of identifying, managing and protecting the numerous operating systems, applications and devices comprising the systems and networks.”

Although GAO noted that all of the selected agencies it reviewed “have reported various cybersecurity initiatives to help protect three critical infrastructure sectors with extensive use of IoT or OT devices and systems,” it added that none of them “had developed metrics to assess the effectiveness of their efforts” or “conducted IoT and OT cybersecurity risk assessments.”

“Both of these activities are best practices,” the report said. “Lead agency officials noted difficulty assessing program effectiveness when relying on voluntary information from sector entities. Nevertheless, without attempts to measure effectiveness and assess risks of IoT and OT, the success of initiatives intended to mitigate risks is unknown.”

The report also highlighted that the IoT Cybersecurity Improvement Act of 2020—which also included provisions requiring GAO to review and report on agencies’ IOT and OT cybersecurity efforts—directed that the National Institute of Standards and Technology and the Office of Management and Budget “take specified steps to increase cybersecurity for Internet of Things devices.” Under the law, agencies are prohibited from “procuring or using an IoT device after December 4, 2022, if that device is considered non-compliant with NIST-developed standards.” 

GAO noted that the act also requires that OMB “establish a standardized process for federal agencies to waive the prohibition on procuring or using non-compliant IoT devices if waiver criteria detailed in the act are met.” But GAO found that, as of Nov. 22., OMB “had not yet developed the mandated process for waiving the prohibition on procuring or using non-compliant IoT devices.”

“Given the act’s restrictions on agency use of non-compliant IoT devices beginning in December 2022, the lack of a uniform waiver process could result in a range of inconsistent actions across agencies,” the report said. 

GAO made eight recommendations for the departments of Health and Human Services, Energy, Homeland Security and Transportation, including that the agencies “include IoT and OT devices as part of the risk assessments” and use the 2013 National Infrastructure Protection Plan as a guide to create “sector-specific plans” until the updated National Plan is released in “the first quarter of 2023.” 

GAO also made a separate recommendation that OMB “expeditiously establish a standardized process for the Chief Information Officer of each covered agency to follow in determining whether the IoT cybersecurity waiver may be granted,” as is required by the IoT Cybersecurity Improvement Act. 

The Transportation Department and DHS concurred with GAO’s recommendations, while HHS neither agreed or disagreed with the reports recommendations but “noted planned actions.” The Energy Department said it would not respond to GAO’s recommendations “until after further coordination with other agencies.”

OMB told GAO that it “is targeting November 2022 for release of guidance on the waiver process,” although the agency has still not released any guidance as of the report’s release.