The U.S. Department of Agriculture’s Inspector General found that most AI systems operating across the agency have not completed required cybersecurity reviews, creating potential exposure to data breaches and operational risks.

Key Takeaways

• 89% of approved AI use cases lacked an Authorization to Operate (ATO), a required federal cybersecurity approval process. <needs to be explained>
• The USDA did not complete risk assessments for all connected AI systems.
• The agency did not fully implement generative AI guidance or update internal policies required under federal Office of Management and Budget (OMB) directives.
• The Inspector General said the USDA prioritized deploying AI systems before implementing required security and governance controls.

The U.S. Department of Agriculture (USDA) Office of Inspector General released an audit finding that the USDA failed to fully implement AI cybersecurity and governance controls used across the department, creating potential security and compliance risks.

89% of AI systems lack the required cybersecurity authorization

According to the report, 73 of the 82 (89%) approved AI use cases did not have an Authorization to Operate (ATO). An ATO is a federal approval process that evaluates whether systems have adequate cybersecurity protections and supporting documentation. An ATO is required before a software system is allowed to connect to government networks. 

These 73 systems were not recorded in the USDA’s cybersecurity tracking system.

The report did not publicly identify the specific AI systems involved or whether the systems processed sensitive or classified information.

Two out of nine approved AI systems were not reviewed for risks

The Inspector General found that the CIO’s office at the USDA did not complete cyber risk assessments for all approved AI systems. Further, the two systems were missing cybersecurity documentation. 

The USDA neglected AI governance, missed deadlines

The audit found that the USDA did follow all federal AI security directives issued by the Office of Management and Budget (OMB). The directives require agencies to inventory AI systems, complete risk reviews before deployment, document data handling practices, and apply cybersecurity controls before systems connect to government networks.

According to the report, the USDA did not update internal IT and cybersecurity policies to address AI-specific risks. These included procedures for AI risk assessments, AI system inventories, security reviews, and ensuring systems completed the federal Authorization to Operate (ATO) process. The audit also found that the USDA did not finalize guidance governing employee use of generative AI systems by the required federal deadlines.

The Inspector General stated that USDA “prioritized AI implementation over cybersecurity and governance controls.”

What the Inspector General recommends

• Create department-wide procedures for AI impact assessments
• Update the USDA cybersecurity and IT policies to address AI systems
• Maintain a continuously updated inventory of all AI systems
• Require risk assessments and cybersecurity reviews before AI systems connect to USDA networks

According to the report, the USDA’s Office of the Chief Information Officer agreed with the findings and recommendations.