Skip to main content

IR 8259AFinal2020

IoT Device Cybersecurity Capability Core Baseline

At a glanceA short list of six security capabilities connected devices should generally have: a unique identity, configurable settings, data protection, restricted interface access, secure software updates and awareness of their own security state. A practical checklist for purchasing.

Reading level
Practitioner
Length
23 pages · about 20 min for the key parts
Best for
Technology directors, Business officials
CSF 2.0
Protect, Govern
Read it on NIST DOI 10.6028/NIST.IR.8259A ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

Key concepts

The baseline describes technical capabilities that let a device support common security controls. Its companion IR 8259B lists non-technical support manufacturers should offer: documentation, a way to receive vulnerability reports, security communications and customer education.

How it is organized

  • Device identification
  • Device configuration
  • Data protection
  • Logical access to interfaces
  • Software update
  • Cybersecurity state awareness
  • Companion: IR 8259B non-technical baseline

What a school district should take from it

  • Six questions cover most of what to ask an IoT vendor.
  • A device that cannot be updated securely will become a liability.

How to use it in your district

  1. Turn the six capabilities into yes/no questions in requests for proposals.
  2. Ask vendors for their vulnerability disclosure contact and support period (IR 8259B).
  3. Prefer devices that can be managed centrally rather than one at a time.

Common misconceptions

Any device labeled 'secure' meets the baseline.
Ask for each capability specifically; marketing labels vary.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • PR.PSPlatform Security
  • GV.SCCybersecurity Supply Chain Risk Management

Tools in the program portal

Related publications

Citation and source

IR 8259A, IoT Device Cybersecurity Capability Core Baseline. National Institute of Standards and Technology. 2020. https://doi.org/10.6028/NIST.IR.8259A.

Topics: Cloud and connected devices, Vendors and supply chain. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.