NIST Consumer IoT Cybersecurity Labelling

NIST - the US National Institute of Standards and Technology has been examining labelling schemes for the cyber security of Consumer IoT products. Learn more about this project and how it fits with Resillion's Secure Connected Device Logo

In 2021, NIST started a program of work to consider labelling schemes for the Cybersecurity of Consumer IoT products. This work, in response to a Presidential Executive Order (14028) on improving the nation's cybersecurity, considered the requirements for such labelling schemes and was also required to take into account existing labelling schemes in the market.

Input was collected from industry and public stakeholders, and in February 2022 NIST published their Recommended Criteria for Cybersecurity Labelling of Consumer IoT Products.

In a subsequent pilot phase, NIST consulted with private sector companies and other agencies to assess existing labelling schemes, their effectiveness, and the extent to which they align with the NIST Recommended Criteria.

Resillion's Secure Connected Devices Logo

Resillion's Secure Connected Devices Logo is one example of such an existing scheme, and Resillion contributed to the NIST pilot phase in two ways:

With expert opinion on the Recommended Criteria, based on Resillion's experience in developing product assessment process and cybersecurity logo

With a detailed mapping between the NIST Recommended Criteria, and the product test specification used by Resillion to assess devices for the Secure Connected Device Logo. This mapping was performed within the framework of NIST's National Online Informative References Program (OLIR) and has been published in the OLIR Catalogue.

In summary, Resillion's Secure Connected Device Logo is well aligned with the NIST Recommended Criteria, covering approximately 70% of those criteria. The Secure Connected Device Logo emphasises lab-based testing of devices, and this is reflected in the fact that most of the differences between the Logo and the NIST criteria are in areas such as development processes, documentation, and vendor security posture.

NIST's final report was published in May 2022. The report concluded that there is clear interest in consumer cybersecurity labelling programs for IoT products . It also found that, although consumer education is still required, there are several labelling schemes currently available in the industry.

Furthermore, the report recognised the importance of standards that industry can put into practice in support of labelling efforts, and the importance of international mutual recognition between schemes and standards.

The Resillion's Secure Connected Device Logo is aligned with several industry standards, including:

NISTIR 8259A, with an additional mapping available in the OLIR Catalogue

ETSI EN 303 645 and TS 103 701

The ENISA IoT Cybersecurity Baseline

Read more about Resillion's Secure Connected Device Logo here.

Our Accreditations and Certifications

LINK:	https://www.resillion.com/nist-consumer-iot-cybersecurity-labelling/...
	See more stories from eurofins

Most recent headlines