Information Security

Recent Reports

Service Member Records: DOD Needs to Address Improper and Delayed Releasing of Personnel and Health Information

Published: Oct 16, 2026

Publicly Released: Oct 16, 2026

Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat [Reissued with revisions on Oct. 14, 2026]

GAO-27-108740

Published: Oct 06, 2026

Publicly Released: Oct 06, 2026

Internet of Things: OMB Action Needed to Ensure Agencies Secure Their Networked Devices

GAO-26-108937

Published: Sep 30, 2026

Publicly Released: Sep 30, 2026

DOGE: Congress and the Public Lack Assurance That Systems and Data Were Protected at Multiple Agencies

GAO-26-108192

Published: Sep 29, 2026

Publicly Released: Sep 29, 2026

Cybersecurity Regulations: Industry Panelists Identify Duplication and Conflicts and Ways to Address Them

GAO-26-109197

Published: Sep 28, 2026

Publicly Released: Sep 28, 2026

Aviation Cybersecurity: Enhanced Air Safety Requires FAA to Better Mitigate Threats to Aircraft Communications

GAO-26-108439

Published: Sep 21, 2026

Publicly Released: Sep 21, 2026

View More Reports

Open Recommendations

Service Member Records: DOD Needs to Address Improper and Delayed Releasing of Personnel and Health Information

GAO-27-107784

Oct 16, 2026

Show

5 Open Recommendations

Agency Affected	Recommendation	Status
Department of Defense	The Secretary of Defense should ensure that the Secretary of the Army, in consultation with the Director of Administration and Management's Oversight and Compliance Directorate, ensures that the functional review recently conducted adequately aligns with a workforce planning analysis that ensures the number of staff available for processing requests for service member personnel records aligns with current and projected needs. (Recommendation 1)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Defense	The Secretary of Defense should ensure that the Secretary of the Navy, in consultation with the Director of Administration and Management's Oversight and Compliance Directorate, conducts a workforce planning analysis to ensure that the number of staff available for processing requests for service member personnel records aligns with current and projected needs. (Recommendation 2)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Defense	The Secretary of Defense should ensure that the Commandant of the Marine Corps, in consultation with the Director of Administration and Management's Oversight and Compliance Directorate, conducts a workforce planning analysis to ensure that the number of staff available for processing requests for service member personnel records aligns with current and projected needs. (Recommendation 3)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Defense	The Secretary of Defense should ensure that the Secretary of the Air Force, in consultation with the Director of Administration and Management's Oversight and Compliance Directorate, conducts a workforce planning analysis to ensure that the number of staff available for processing requests for service member personnel records aligns with current and projected needs. (Recommendation 4)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Defense	The Secretary of Defense should ensure that the Assistant Secretary of Defense for Health Affairs, in coordination with the DHA Director, includes an assessment of the current framework and systems for processing health records requests in the agency's study of the "health informatics" business function to identify opportunities for improvement, such as consolidating databases or using artificial intelligence. (Recommendation 5)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Internet of Things: OMB Action Needed to Ensure Agencies Secure Their Networked Devices

GAO-26-108937

Sep 30, 2026

Show

1 Open Recommendations

Agency Affected	Recommendation	Status
Office of Management and Budget	The Director of OMB should issue updated cybersecurity guidance, to include requirements for networked IoT and OT devices, and oversee agencies' implementation of the requirements. The guidance should include a clear imperative to prioritize implementation of the networked device requirements and a timeline for doing so. (Recommendation 1)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Cybersecurity: HHS Should Strengthen Oversight and Enhance Security Controls for the 988 Suicide and Crisis Lifeline

GAO-26-108836

Sep 17, 2026

Show

10 Open Recommendations

Agency Affected	Recommendation	Status
Department of Health and Human Services	The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to incorporate the seven missing cybersecurity control areas from HHS's CPG in the 988 Lifeline cooperative agreement. (Recommendation 1)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Health and Human Services	The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to work with the network administrator to incorporate the three missing cybersecurity control areas from HHS's CPG in the 988 Lifeline network administrator's network agreement with the crisis contact centers. (Recommendation 2)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Health and Human Services	The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to work with the network administrator to ensure full implementation of the 988 Lifeline network agreement compliance checklist process. (Recommendation 3)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Health and Human Services	The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to work with the network administrator to implement the current NIST password guidance. (Recommendation 4)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Health and Human Services	The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to work with the network administrator to establish requirements for crisis contact centers' development of incident response planning policies and monitor the implementation of such policies. (Recommendation 5)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Department of Health and Human Services	The Secretary of HHS should direct the Assistant Secretary for Mental Health and Substance Abuse to work with the network administrator to establish requirements for crisis contact centers' development of incident response plans and monitor the implementation of such plans. (Recommendation 6)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Aviation Cybersecurity: FAA and TSA Are Collaborating on Cybersecurity but Need to Address Key Shortfalls

GAO-26-107693

Jul 16, 2026

Show

5 Open Recommendations

Agency Affected	Recommendation	Status
Transportation Security Administration	The Administrator of TSA should update the TSA Cybersecurity Roadmap to define the roles and responsibilities for the TSA entities responsible for carrying out the goals and objectives described within it, including for the aviation subsector, and align the roadmap with the DHS Cybersecurity Strategy. The TSA Administrator should communicate its Cybersecurity Roadmap to appropriate non-federal stakeholders (recommendation 1)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Federal Aviation Administration	The Administrator of FAA should update the agency's cyber budget data request process to ensure that it includes all cybersecurity spending from program offices. (recommendation 2)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Federal Aviation Administration	The Administrator of FAA should ensure that the agency's updated Zero Trust Implementation Plan includes detailed steps for transitioning all operating environments to a zero trust architecture. (recommendation 3)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Federal Aviation Administration	The Administrator of FAA should ensure that the agency's updated Zero Trust Implementation Plan fully aligns with NIST best practices for migrating to a zero trust architecture. (recommendation 4)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
Federal Aviation Administration	The Administrator of FAA should direct the agency's Cybersecurity Steering Committee to take steps, as the agency implements its revised Cybersecurity Strategy, to ensure it carries out monitoring as planned and incorporates lessons learned from its past experiences. (recommendation 5)	Open When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.