Skip to main content

Information Security

Jump To:

Recent Reports

View More Reports

Open Recommendations

Research Security: NIH Action Needed to Strengthen Foreign Interference Risk Management
GAO-27-107848
Oct 16, 2026
Show
1 Open Recommendations
Agency Affected Recommendation Status
National Institutes of Health The Director of NIH should conduct and document, at regular intervals and in accordance with GAO's Fraud Risk Framework, a fraud risk assessment tailored to NIH's extramural research program that considers risks related to foreign interference. (Recommendation 1)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Internet of Things: OMB Action Needed to Ensure Agencies Secure Their Networked Devices
GAO-26-108937
Sep 30, 2026
Show
1 Open Recommendations
Agency Affected Recommendation Status
Office of Management and Budget The Director of OMB should issue updated cybersecurity guidance, to include requirements for networked IoT and OT devices, and oversee agencies' implementation of the requirements. The guidance should include a clear imperative to prioritize implementation of the networked device requirements and a timeline for doing so. (Recommendation 1)
Open
OMB did not provide a response to our draft report. When we confirm what actions OMB has taken in response to this recommendation, we will provide updated information.

Cybersecurity: HHS Should Strengthen Oversight and Enhance Security Controls for the 988 Suicide and Crisis Lifeline
GAO-26-108836
Sep 17, 2026
Show
10 Open Recommendations
Agency Affected Recommendation Status
Department of Health and Human Services The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to incorporate the seven missing cybersecurity control areas from HHS's CPG in the 988 Lifeline cooperative agreement. (Recommendation 1)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Health and Human Services The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to work with the network administrator to incorporate the three missing cybersecurity control areas from HHS's CPG in the 988 Lifeline network administrator's network agreement with the crisis contact centers. (Recommendation 2)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Health and Human Services The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to work with the network administrator to ensure full implementation of the 988 Lifeline network agreement compliance checklist process. (Recommendation 3)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Health and Human Services The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to work with the network administrator to implement the current NIST password guidance. (Recommendation 4)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Health and Human Services The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to work with the network administrator to establish requirements for crisis contact centers' development of incident response planning policies and monitor the implementation of such policies. (Recommendation 5)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Health and Human Services The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to work with the network administrator to establish requirements for crisis contact centers' development of incident response plans and monitor the implementation of such plans. (Recommendation 6)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Aviation Cybersecurity: FAA and TSA Are Collaborating on Cybersecurity but Need to Address Key Shortfalls
GAO-26-107693
Jul 16, 2026
Show
5 Open Recommendations
Agency Affected Recommendation Status
Transportation Security Administration The Administrator of TSA should update the TSA Cybersecurity Roadmap to define the roles and responsibilities for the TSA entities responsible for carrying out the goals and objectives described within it, including for the aviation subsector, and align the roadmap with the DHS Cybersecurity Strategy. The TSA Administrator should communicate its Cybersecurity Roadmap to appropriate non-federal stakeholders (recommendation 1)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Federal Aviation Administration The Administrator of FAA should update the agency's cyber budget data request process to ensure that it includes all cybersecurity spending from program offices. (recommendation 2)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Federal Aviation Administration The Administrator of FAA should ensure that the agency's updated Zero Trust Implementation Plan includes detailed steps for transitioning all operating environments to a zero trust architecture. (recommendation 3)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Federal Aviation Administration The Administrator of FAA should ensure that the agency's updated Zero Trust Implementation Plan fully aligns with NIST best practices for migrating to a zero trust architecture. (recommendation 4)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Federal Aviation Administration The Administrator of FAA should direct the agency's Cybersecurity Steering Committee to take steps, as the agency implements its revised Cybersecurity Strategy, to ensure it carries out monitoring as planned and incorporates lessons learned from its past experiences. (recommendation 5)
Open
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
View More Recommendations

Related Pages

GAO Contacts

Multimedia

Podcasts

DOD's Back Office IT--We Looked At Costs and Cybersecurity Risks
Transcript
The Growing Need for Cyber Diplomacy
Transcript
How Does DOD Protect Itself and Contractors from Cyberthreats?
Transcript