Foundational Cybersecurity Activities for IoT Product Manufacturers

Official websites use .gov
A .gov website belongs to an official government
organization in the United States.

Secure .gov websites use HTTPS
A lock () or https:// means you’ve safely connected to
the .gov website. Share sensitive information only on official,
secure websites.

Information Technology Laboratory Computer Security Resource Center

1. Publications

NIST IR 8259 Rev. 1

Foundational Cybersecurity Activities for IoT Product Manufacturers

Date Published: April 2026

Supersedes: IR 8259 (05/29/2020)

Author(s)

Michael Fagan (NIST), Katerina Megas (NIST), Barbara Cuthill (NIST), Jeffrey Marron (NIST), Brad Hoehn (HII)

Abstract

Internet of Things (IoT) products often lack product cybersecurity capabilities their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving the securability of their IoT products by providing necessary cybersecurity functionality and by providing customers with the cybersecurity-related information they need. This publication describes recommended activities related to cybersecurity that manufacturers should consider performing before their IoT products are sold to customers. These foundational cybersecurity activities can help manufacturers lessen the cybersecurity-related efforts needed by customers, which in turn can reduce the prevalence and severity of compromises.

Internet of Things (IoT) products often lack product cybersecurity capabilities their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving the securability of their IoT products by providing necessary...

Keywords

cybersecurity risk; Internet of Things (IoT); manufacturing; risk management; risk mitigation; securable computing devices; software development

Control Families

None selected

Documentation

Publication:
https://doi.org/10.6028/NIST.IR.8259r1
Download URL

Supplemental Material:
NIST Cybersecurity for IoT Program

Publication Parts:
IR 8259A
IR 8259B

Related NIST Publications:
SP 800-213
SP 800-213A
IR 8228

Document History:
05/13/25: IR 8259 Rev. 1 (Draft)
09/30/25: IR 8259 Rev. 1 (Draft)
04/20/26: IR 8259 Rev. 1 (Final)

Topics

Security and Privacy risk management

Applications cyber-physical systems, Internet of Things

Laws and Regulations Executive Order 13800, Internet of Things Cybersecurity Improvement Act

Sectors manufacturing