IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements

Fagan, Michael; Marron, Jeffrey; Brady, Kevin; Cuthill, Barbara; Megas, Katerina; Herold, Rebecca; Lemire, David; Hoehn, Brad

doi:https://doi.org/10.6028/NIST.SP.800-213

SP 800-213

IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements

Documentation Topics

Date Published: November 2021

Author(s)

Michael Fagan (NIST), Jeffrey Marron (NIST), Kevin Brady (NIST), Barbara Cuthill (NIST), Katerina Megas (NIST), Rebecca Herold (The Privacy Professor Consultancy), David Lemire (Huntington Ingalls Industries), Brad Hoehn (Huntington Ingalls Industries)

Abstract

Organizations will increasingly use Internet of Things (IoT) devices for the mission benefits they can offer, but care must be taken in the acquisition and implementation of IoT devices. This publication contains background and recommendations to help organizations consider how an IoT device they plan to acquire can integrate into a system. IoT devices and their support for security controls are presented in the context of organizational and system risk management. This publication provides guidance on considering system security from the device perspective. This allows for the identification of device cybersecurity requirements—the abilities and actions an organization will expect from an IoT device and its manufacturer and/or third parties, respectively.

Keywords

cybersecurity baseline; Internet of Things (IoT); securable computing devices; security requirements; Risk Management Framework; Cybersecurity Framework

Control Families

None selected

Documentation

Publication:
SP 800-213 (DOI)
Local Download

Supplemental Material:
Blog post (web)

Other Parts of this Publication:
SP 800-213A

Related NIST Publications:
NISTIR 8259
NISTIR 8259A
NISTIR 8259B
NISTIR 8379

Document History:
12/15/20: SP 800-213 (Draft)
11/29/21: SP 800-213 (Final)

Topics

Security and Privacy
acquisition; program management; risk management

Technologies
hardware

Applications
cybersecurity framework; Internet of Things

Laws and Regulations
Internet of Things Cybersecurity Improvement Act