Skip to content
Standards & bodies

NIST

The U.S. National Institute of Standards and Technology, whose cybersecurity frameworks and IoT device guidance underpin federal procurement rules and the Cyber Trust Mark.

NIST is a U.S. government agency whose publications are widely used as de facto security baselines well beyond the United States. For IoT the most cited are its guidance on device cybersecurity capabilities, which defines what a connected product should be able to do, such as support unique identification, configurable access and updatable software, and its broader Cybersecurity Framework. These documents were referenced by federal procurement law for IoT devices and form the technical basis of the U.S. Cyber Trust Mark labeling program.

NIST also runs the cryptographic standards process, including the lightweight cryptography selection intended for constrained devices, and maintains the vulnerability database that CVE entries are scored against. Its documents are free, which makes them a practical starting point for an IoT security program. See IoT security regulation for how they relate to European rules.

Part of the IoT Glossary. Spotted an error or a missing term? Tell us.