Date Published: January 2020
Comments Due:
Email Questions to:
Author(s)
Michael Fagan (NIST), Katerina Megas (NIST), Karen Scarfone (Scarfone Cybersecurity), Matthew Smith (G2)
Announcement
An incredible variety and volume of Internet of Things (IoT) devices are being produced. Manufacturers can help their customers by improving how securable the IoT devices they make are, meaning the devices provide functionality that their customers need to secure them within their systems and environments. Manufacturers can also help their customers by providing them with the cybersecurity-related information they need.
This second public draft of NISTIR 8259 describes activities related to cybersecurity that manufacturers should consider performing before their IoT devices are sold to customers. It builds upon NISTIR 8228, Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks. This second public draft contains the same main concepts as the initial public draft, but their presentation has been revised to clarify the concepts and address other comments from the public. NIST encourages reviewers of the initial public draft to read this full draft.
A public comment period for this draft document is open until February 7, 2020.
NOTE: A call for patent claims is included on page iv of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.
[The initial public draft (from 7/31/19) is available at https://doi.org/10.6028/NIST.IR.8259-draft (the link under "Document History" is currently not functioning correctly).]
Internet of Things (IoT) devices often lack device cybersecurity capabilities their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving how securable the IoT devices they make are, meaning the devices provide functionality that their customers need to secure them within their systems and environments, and manufacturers can also help their customers by providing them with the cybersecurity-related information they need. This publication describes voluntary, recommended activities related to cybersecurity that manufacturers should consider performing before their IoT devices are sold to customers. These activities can help manufacturers lessen the cybersecurity-related efforts needed by IoT device customers, which in turn can reduce the prevalence and severity of IoT device compromises and the attacks performed using compromised IoT devices.
Internet of Things (IoT) devices often lack device cybersecurity capabilities their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving how securable the IoT devices they make are, meaning the devices provide...
See full abstract
Internet of Things (IoT) devices often lack device cybersecurity capabilities their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving how securable the IoT devices they make are, meaning the devices provide functionality that their customers need to secure them within their systems and environments, and manufacturers can also help their customers by providing them with the cybersecurity-related information they need. This publication describes voluntary, recommended activities related to cybersecurity that manufacturers should consider performing before their IoT devices are sold to customers. These activities can help manufacturers lessen the cybersecurity-related efforts needed by IoT device customers, which in turn can reduce the prevalence and severity of IoT device compromises and the attacks performed using compromised IoT devices.
Hide full abstract
Keywords
cybersecurity baseline; cybersecurity risk; Internet of Things (IoT); manufacturing; risk management; risk mitigation; securable computing devices; software development
Control Families
None selected
) or https:// don't prove our archive is authentic, only that you securely accessed it. Note that we are working to fix that :)
