The Internet of Things (IoT) is a rapidly evolving and expanding collection of diverse technologies that interact with the physical world, yet many organizations are not necessarily aware of the large number of IoT devices they already use. Understanding both existing and future usage of IoT devices can enable organizations to identify IoT’s effects on managing cybersecurity and privacy risks as well as how such risks differ from those of conventional information technology (IT) devices.

NIST announces the publication of NISTIR 8228, Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks, which provides guidance for federal agencies and other organizations to better understand and manage the risks associated with individual IoT devices throughout the lifecycles of those devices. It also considers three high-level goals for risk mitigation: device security, data security, and individual privacy. This introductory report provides the foundation for a planned series of publications on more specific aspects of this topic.