Critical Infrastructure: Actions Needed to Better Secure Internet-Connected Devices

Cyber threats to critical infrastructure IoT (Internet of Things) and OT (operational technology) represent a significant national security challenge. Recent incidents–such as the ransomware attacks targeting health care and essential services during the COVID-19 pandemic–illustrate the cyber threats facing the nation’s critical infrastructure. Congress included provisions in the IoT Cybersecurity Improvement Act of 2020 for GAO (Government Accountability Office) to report on IoT and OT cybersecurity efforts. This report describes overall federal IoT and OT cybersecurity initiatives and identifies leading guidance for addressing IoT cybersecurity and determines the status of OMB’s (Office of Management and Budget’s) process for waiving cybersecurity requirements for IoT devices.