A cryptographic inventory can be technically precise and still be dangerously incomplete if the underlying asset inventory is missing devices. The U.S. Government Accountability Office’s September 30 report, Internet of Things: OMB Action Needed to Ensure Agencies Secure Their Networked Devices, offers a concrete warning about that prerequisite.
GAO reviewed 22 civilian Chief Financial Officer Act agencies. As of September 2026, 15 had established a networked-device inventory, 11 were maintaining one, and 10 included all required information for each device. Only seven had fully addressed all three requirements. The report concerns IoT and operational technology cybersecurity broadly, not PQC specifically. But its findings expose a foundational problem for cryptographic governance: teams cannot evaluate cryptography on devices they have not identified and kept current.
Crypto discovery starts one layer earlier
Cryptographic inventory programs often begin with certificates, network handshakes, source repositories, package manifests, or library scans. Those are valuable evidence sources, but each assumes a known scope. An unmanaged controller, sensor gateway, building system, laboratory appliance, or medical device may never enter the scan target list. It may sit behind a restricted segment, communicate intermittently, or be managed by a vendor.
The result is a false denominator. A dashboard might report that 90 percent of discovered TLS endpoints meet policy while saying nothing about unknown devices. Migration metrics become credible only when they state both cryptographic posture and asset coverage.
Organizations should therefore track at least three related populations:
- Expected assets: devices and systems inferred from procurement, architecture, ownership, facilities, network, and service records;
- Observed assets: devices seen through authorized discovery, telemetry, management platforms, and integrations; and
- Cryptographically characterized assets: assets for which relevant algorithms, protocols, certificates, keys, libraries, or trust relationships have been evaluated.
The gaps between those populations are work items, not proof that no cryptography exists.
IoT and OT make absence especially difficult to prove
Networked devices may use TLS, SSH, VPNs, proprietary secure channels, signed firmware, code-signing roots, device certificates, secure boot, or cloud enrollment credentials. Some mechanisms are visible on the wire. Others are dormant until an update, recovery, commissioning, or remote-support event. Still others are embedded in firmware or handled by an upstream service.
That means no single discovery method provides complete coverage. Active probing may be unsafe or prohibited for sensitive operational equipment. Passive observation sees only traffic present during the collection window. Software composition data may omit runtime configuration. Supplier documentation may be incomplete or describe a product family rather than the installed version.
A responsible program combines evidence and records limitations. It does not turn a discovery gap into an “all clear.”
Maintenance is more important than the first census
GAO’s numbers distinguish establishing an inventory from maintaining it. That difference matters because cryptographic state changes even when the asset name stays the same. Firmware updates replace libraries. Certificates rotate. Cloud endpoints change. Vendors alter support. New protocol defaults appear. A device moves between segments or changes mission.
A one-time CBOM or spreadsheet is a snapshot. Governance needs change detection and re-evaluation. Each material observation should update a canonical record while preserving provenance: which source reported the fact, when it was collected, what scope it covered, and how confident the organization is in the match.
For long-lived devices, teams should also capture replacement constraints, update mechanisms, support dates, and cryptographic agility. A device that cannot accept new trust anchors or signature algorithms may become a post-quantum migration blocker years before the hardware physically fails.
Turn coverage gaps into owned remediation
GAO reports that agencies cited technical and resource constraints and competing priorities. Crypto programs face the same pressures, so a useful inventory must drive action rather than simply count unknowns.
For every uncovered or partially characterized asset group, record an owner, business or mission context, discovery barrier, next evidence source, due date, and interim control. High-priority groups may include internet-exposed devices, systems handling long-lived sensitive data, firmware-signing infrastructure, identity roots, safety-relevant OT, and equipment with long procurement cycles.
Metrics should make uncertainty visible. Report the percentage of expected assets observed, the percentage cryptographically characterized, the freshness of evidence, and the number of unresolved ownership or supplier questions. A smaller honest coverage number is more useful than a polished compliance percentage built on an unknown estate.
What organizations should do next
First, reconcile asset sources before declaring the boundary of a cryptographic inventory. Compare procurement, configuration management, network access control, endpoint management, facilities, cloud, vulnerability-management, and supplier records.
Second, define safe discovery by asset class. Selected, authorized observation for a server is different from interacting with a fragile controller. Document exclusions and use alternate evidence where direct inspection is inappropriate.
Third, link each cryptographic fact to the asset, relationship, evidence source, and observation time. Avoid detached lists of certificates or algorithms that cannot be traced to operational ownership.
Finally, establish a refresh loop. Reconcile new and missing assets, evaluate changed cryptography, assign remediation, and preserve proof. That is how an inventory becomes an operating control.
How Vista Platform helps
Vista Platform is a self-hosted cryptographic system of record. Its operating loop—discovery, canonical inventory, evaluation, action, and proof—helps teams combine evidence from supported, authorized sources, normalize relationships, evaluate posture, and track remediation.
Vista Platform Core is free of charge and includes discovery, inventory, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps. Vista tracks and governs post-quantum migration; it does not generate PQC keys or carry out every migration. Selected-asset Active Scan is not indiscriminate network scanning. Vista is not a vulnerability scanner, and incomplete discovery is not proof that cryptographic exposure is absent.
Learn more about cryptographic inventory and CBOM and compliance evidence.
Where uncertainty remains
GAO’s report measures compliance with specific federal networked-device requirements and does not assess the cryptography on those devices. It also does not establish that every inventory gap contains a cryptographic risk. The inference is operational: unknown or stale assets create unmeasured scope, so cryptographic and PQC readiness claims must disclose coverage and uncertainty.
Source
- Internet of Things: OMB Action Needed to Ensure Agencies Secure Their Networked Devices, U.S. Government Accountability Office, September 30, 2026.