GAO urges NASA to strengthen cybersecurity risk management

The US Government Accountability Office has called on NASA to strengthen its cybersecurity risk management, warning that spacecraft and space systems face increased risks of cyberattack and mission disruption. The GAO said NASA has yet to implement a priority recommendation to conduct an organisation-wide cybersecurity risk assessment.

In a new report, the watchdog said such an assessment is essential for identifying and mitigating the highest-priority cyber threats across the enterprise. Without it, NASA is less likely to identify relevant threats and vulnerabilities, assess the potential impact of exploitation, or determine the likelihood of harm.

The recommendation is one of four priority items the GAO is highlighting for NASA, which had 46 open recommendations as of July 2026. The GAO also flagged monitoring programme costs and using federal contracting metrics as areas needing attention, and noted that two of the areas, cost monitoring and cybersecurity, are on its High Risk List.