Date Published: May 13, 2025
Comments Due:
Email Comments to:
Author(s)
Michael Fagan (NIST), Katerina Megas (NIST), Barbara Cuthill (NIST), Jeffrey Marron (NIST), Brad Hoehn (HII)
Announcement
NIST is releasing the draft revision of NIST IR 8259, Foundational Cybersecurity Activities for IoT Device Manufacturers, in keeping with the requirement in the Internet of Things (IoT) Cybersecurity Improvement Act in 2020 to revisit NIST’s IoT cybersecurity guidelines every five years. This document describes recommended activities related to cybersecurity for manufacturers, spanning pre-market and post-market, to help them develop products that meet their customers’ needs and expectations for cybersecurity. This revision marks a pivotal change to addressing the full IoT product scope as well as broadening consideration of maintenance, support and end of life considerations for IoT products. We look forward to hearing your thoughts and comments on this draft.
See this NIST Cybersecurity Insights blog post for more information!
Internet of Things (IoT) products often lack product cybersecurity capabilities their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving the securability of their IoT products by providing necessary cybersecurity functionality and by providing customers with the cybersecurity-related information they need. This publication describes recommended activities related to cybersecurity that manufacturers should consider performing before their IoT products are sold to customers. These foundational cybersecurity activities can help manufacturers lessen the cybersecurity-related efforts needed by customers, which in turn can reduce the prevalence and severity of compromises.
Internet of Things (IoT) products often lack product cybersecurity capabilities their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving the securability of their IoT products by providing necessary...
See full abstract
Internet of Things (IoT) products often lack product cybersecurity capabilities their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving the securability of their IoT products by providing necessary cybersecurity functionality and by providing customers with the cybersecurity-related information they need. This publication describes recommended activities related to cybersecurity that manufacturers should consider performing before their IoT products are sold to customers. These foundational cybersecurity activities can help manufacturers lessen the cybersecurity-related efforts needed by customers, which in turn can reduce the prevalence and severity of compromises.
Hide full abstract
Keywords
cybersecurity risk; Internet of Things (IoT); manufacturing; risk management; risk mitigation; securable computing devices; software development
Control Families
None selected
