IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements

Published

November 29, 2021

Author(s)

Michael Fagan, Katerina N. Megas, Jeffrey Marron, Kevin Gerard Brady, Barbara Bell Cuthill, Rebecca Herold, David Lemire, Noel Hoehn

Abstract

Organizations will increasingly use Internet of Things (IoT) devices for the mission benefits they can offer, but care must be taken in the acquisition and implementation of IoT devices. This publication contains background and recommendations to help organizations consider how an IoT device they plan to acquire can integrate into a system. IoT devices and their support for security controls are presented in the context of organizational and system risk management. This publication provides guidance on considering system security from the device perspective. This allows for the identification of device cybersecurity requirements—the abilities and actions an organization will expect from an IoT device and its manufacturer and/or third parties, respectively.

Citation

Special Publication (NIST SP) - 800-213

Report Number

800-213

NIST Pub Series

Special Publication (NIST SP)

Pub Type

NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.SP.800-213

Local Download

Keywords

Cybersecurity baseline, Internet of Things (IoT), securable computing devices, security requirements, Risk Management Framework, Cybersecurity Framework

Citation

Fagan, M. , Megas, K. , Marron, J. , Brady, K. , Cuthill, B. , Herold, R. , Lemire, D. and Hoehn, N. (2021), IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.SP.800-213, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=933704 (Accessed October 9, 2025)