NISTIR 8267 (Draft)

Security Review of Consumer Home Internet of Things (IoT) Products

Date Published: October 2019
Comments Due: November 1, 2019 (public comment period is CLOSED)
Email Questions to:


Michael Fagan (NIST), Mary Yang (MITRE), Allen Tan (MITRE), Lora Randolph (MITRE), Karen Scarfone (Scarfone Cybersecurity)


In 2017, more than eight billion IoT devices were in use worldwide and the current estimate is that more than 20 billion IoT devices will be in use by 2020, according to various market research organizations. Since many IoT devices  are accessible via the internet, malicious actors can exploit vulnerabilities to gain access to IoT devices.

Draft NIST Interagency or Internal Report (NISTIR) 8267, Security Assessment of Consumer Home IoT Products, presents the results of technical assessments on security features of smart light bulbs, security lights, security cameras, doorbells, plugs, thermostats, and televisions. This report provides recommendations, along with information on the observations of the devices' security features, to indicate current practices and how these current practices could be improved. These technical assessments will help the NCCoE better address consumer home IoT security in a holistic manner in future projects. In addition, the technical assessments inform the security tenets for IoT devices outlined in Draft NISTIR 8259, Core Cybersecurity Feature Baseline for Securable IoT Devices.

NOTE: A call for patent claims is included on page iv of this draft.  For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications



consumer home Internet of Things; cybersecurity; Internet of Things; IoT devices; smart home
Control Families

None selected


NISTIR 8267 (Draft) (DOI)
Local Download

Supplemental Material:
Submit Comments (other)
Project Homepage (other)

Related NIST Publications:
NISTIR 8259 (Draft)

Document History:
10/01/19: NISTIR 8267 (Draft)


Security and Privacy
general security & privacy

mobile; sensors

Internet of Things