Non-technical supporting capabilities include the actions manufacturers or their supporting entities take in support of initial and on-going security of IoT devices. Such actions make it easier for customers to understand and identify how IoT devices are built to meet their cybersecurity needs, as well as the manufacturers' goals for how the IoT device should be securely used. The non-technical cybersecurity capabilities described can support cybersecurity-related customer efforts. By making customers more knowledgeable about how to secure the IoT devices, and how to most effectively use the device's cybersecurity capabilities, manufacturers can help reduce the number of occurrences and related severity of IoT device compromises, thwart attacks against the devices, and reduce the number of vulnerabilities that are exploited and lead to compromised devices.
The purpose of this catalog is to help IoT device manufacturers and their supporting entities (contractors, supply chain vendors, etc.) to identify non-technical IoT cybersecurity supporting capability actions they can use to better support their customers' cybersecurity needs and goals for understanding, identifying, and managing cybersecurity and privacy risks associated with the use of the manufacturer's IoT device. Such actions can include using communications, documentation, training, and other activities throughout the full lifecycle of an individual IoT device.
The actions found within this catalog provide a wide range of non-technical cybersecurity actions that can be used to support a manufacturer's goals and intended uses of each IoT device, and to meet the expectations and needs of the IoT device customers, to help them to use the device in a way that supports their risk management requirements. Because this is a catalog of actions, it is not expected that a manufacturer would use all the actions within this catalog.
Manufacturers, and their supporting entities, can determine which of the non-technical actions are applicable to each IoT device. This can be accomplished by taking into consideration:
1) the goal of the IoT device;
2) the technical capabilities of the IoT device;
3) the expectations for the intended uses of the IoT device;
4) the types of uses for the IoT device that are not intended;
5) the IoT device customer's purpose for using the IoT device;
6) the expected context within which the IoT device is meant to be used;
7) the data that is generated, derived, collected, generated, stored, disseminated and otherwise used;
8) the expected security actions that the IoT device customer will be responsible for performing;
9) the actions the manufacturer will commit to performing; and
10) the associated risks that the IoT device brings into the system where it will be used by each IoT device customer.
Manufacturers can then provide the most useful communications and education to their customers for each associated device. Manufacturers should consider that risks may vary greatly from one IoT customer to the next, so the non-technical communications and actions they take and provide to IoT device customers will be an important aspect of security for each IoT device.
Cybersecurity and privacy risks for an IoT device cannot all be addressed within the IoT device itself. Every IoT device operates within a broader IoT environment where it interacts with other IoT and non-IoT devices, cloud-based services, people, and other components. IoT device customers need to understand the assumptions and expectations under which the manufacturer created the IoT device that they are considering purchasing. Then after purchase, IoT device customers need to be provided with communications, education, and actions that will help them to understand how to securely use and maintain the IoT device. Such understanding will allow the IoT customer to more knowledgeably determine the risks of using the IoT device within their system (risks that the manufacturer may not have even thought about when engineering the device) and establish the associated technical abilities and non-technical actions.
NIST created the NISTIR 8259 series of IoT cybersecurity guidance documents, and the associated SP 800-213 document, to meet the needs of federal agencies, and to provide manufacturers creating IoT devices with guidance and information describing the cybersecurity requirements that need to be established and maintained for IoT devices used within federal agencies.
For assistance in determining risks created by IoT devices, manufacturers and their supporting entities can use the following NIST resources. These are also some of the documents which federal agencies use for determining risks within their systems and can inform manufacturers' actions for identifying the general kinds of risks the IoT device customers consider:
The IoT Cybersecurity Manufacturer Non-Technical Supporting Capabilities catalog is structured as follows: