Skip to main content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Help us build a secure future for connected devices: share your feedback on draft NISTIR on core baseline of cybersecurity features

IoT image

 

It’s been a busy but productive year for NIST’s Cybersecurity for the Internet of Things (IoT) program as we’ve continued our efforts to engage stakeholders and enlist feedback on several key initiatives. In June, the NIST Cybersecurity for IoT and Privacy Engineering  programs published NIST Internal Report (NISTIR) 8228, Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks. The purpose of NISTIR 8228 is to help federal agencies and other organizations better understand and manage the cybersecurity and privacy risks associated with their use of IoT devices in their organization’s operations throughout the devices' lifecycles.

 

While the publication of NISTIR 8228 represents the culmination of many months of stakeholder engagement through public comments, webcasts and workshops that produced a wealth of valuable feedback, the document is just the first of a planned series of publications focusing on more specific aspects cybersecurity for IoT. Which brings us to an exciting announcement: Draft NISTIR 8259: Core Cybersecurity Feature Baseline for Securable IoT Devices: A Starting Point for IoT Device Manufacturers is now available for public comment!

 

The purpose of this draft publication is to help IOT device manufacturers understand the cybersecurity risks their customers face so IoT devices can provide cybersecurity features that make them at least minimally securable by the individuals and organizations who acquire and use them. By defining a core baseline of cybersecurity features that manufacturers may voluntarily adopt for IoT devices they produce, those manufacturers will then be able to help customers with cybersecurity risk management. IoT device manufacturers will also gain a better understanding of the need to clearly communicate to customers the cybersecurity-relevant characteristics of their connected devices. The publication also provides information on how manufacturers can identify features most appropriate for their customers that go beyond the core baseline and implement those features to further improve how securable their IoT devices are.

 

The features outlined in this draft publication are not exhaustive, and IoT device manufacturers are encouraged to use the core baseline as a starting point. Ultimately, by including cybersecurity features in the IoT devices they design and develop, IoT device manufacturers can make it easier—and in some cases, possible—for IoT device customers to effectively manage their cybersecurity risk and strengthen the security of their devices.

We want your feedback!

 

Your feedback, as always, is very important to us—and has been instrumental in the evolution and development of this draft publication. Please download Draft NISTIR 8259: Core Cybersecurity Feature Baseline for Securable IoT Devices: A Starting Point for IoT Device Manufacturers and submit your feedback through September 30, 2019, at iotsecurity [at] nist.gov.

 

To learn more about the Cybersecurity for IoT Program, visit the NIST website. You can also follow @NISTcyber on Twitter to stay up to date with all of NIST’s cybersecurity programs, and use the hashtag #IoTBaseline to follow and participate in the conversation around a core cybersecurity baseline for IoT devices.

About the author

Katerina Megas

Katerina Megas is the Commercial Adoption Lead for the Trusted Identities Group and Program Manager for the Cybersecurity for the Internet of Things (IoT) program. She has over 25 years of experience...

Related posts

Let’s talk about IoT device security

NIST’s Cybersecurity for the Internet of Things (IoT) Program is beginning stakeholder engagement on identifying a core set of cybersecurity capabilities

Comments

Add new comment

  • This question is for testing whether or not you are a human visitor and to prevent automated spam submissions. Image CAPTCHA
    Enter the characters shown in the image.
Please be respectful when posting comments. We will post all comments without editing as long as they are appropriate for a public, family friendly website, are on topic and do not contain profanity, personal attacks, misleading or false information/accusations or promote specific commercial products, services or organizations. Posts that violate our comment policy will not be posted.