Sharpening the Focus on Product Requirements and Cybersecurity Risks: Updated Foundational Activities for IoT Product Manufacturers

NIST has updated its guidelines for manufacturers developing IoT products to better incorporate cybersecurity activities into the development process. 

Internet of Things (IoT) products often lack product cybersecurity capabilities that their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving the securability of their IoT products by providing necessary cybersecurity functionality and by providing customers with the cybersecurity-related information they need. This publication describes recommended activities related to cybersecurity that manufacturers should consider performing before their IoT products are sold to customers. These foundational cybersecurity activities can help manufacturers lessen the cybersecurity-related efforts needed by customers, which in turn can reduce the prevalence and severity of compromises.

NIST IR 8259r1 (Revision 1), Foundational Cybersecurity Activities for IoT Product Manufacturers, describes recommended activities related to cybersecurity for manufacturers, spanning pre-market through post-market activities, to help them develop products that meet their customers’ needs and expectations for cybersecurity. This revision marks a pivotal change in addressing the full IoT product scope and broadening consideration of communications with customers about cybersecurity, maintenance, support, and end-of-life for IoT products.