Skip to main content

SP 800-213Final2021

IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements

At a glanceHelps buyers decide, before purchase, what security capabilities a connected device and its maker must provide. Districts can apply it to cameras, door access, HVAC controls, interactive displays and other connected equipment. Pair it with IR 8259A's baseline of device capabilities.

Reading level
Practitioner
Length
47 pages · about 30 min for the key parts
Best for
Technology directors, Business officials
CSF 2.0
Govern, Protect
Read it on NIST DOI 10.6028/NIST.SP.800-213 ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

Revision in progress. SP 800-213 Rev. 1 initial public draft (2026-06-24) broadens the scope from devices to products; comments closed 2026-08-24. A pre-draft call for comments on SP 800-213A Rev. 1 was open until 2026-10-15.

Key concepts

The guidance treats each device as part of a larger system and explains how to derive device requirements from system security needs, and how to handle risk when a device cannot meet them. Its companion SP 800-213A catalogs device capabilities and manufacturer support to draw from.

How it is organized

  • Background: IoT devices as system elements
  • Identifying device cybersecurity requirements
  • Risk management options for IoT devices
  • Companion: SP 800-213A capability catalog

What a school district should take from it

  • Ask before buying: can the device be updated, can default passwords be changed, and how will the maker report vulnerabilities?
  • Facilities and safety systems are part of the district's attack surface.

How to use it in your district

  1. Add an IoT security checklist (unique credentials, updates, logging, vendor support period) to facilities and technology purchases.
  2. Put connected building systems on their own network segment.
  3. Record each connected system and its vendor in the asset inventory and Vendor Registry.

Common misconceptions

Facilities equipment is not a technology concern.
Connected cameras, door controllers and HVAC systems can be entry points to the network.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • GV.SCCybersecurity Supply Chain Risk Management
  • PR.PSPlatform Security

Tools in the program portal

Related publications

  • IR 8259ABaseline capabilities for connected devices
  • SP 1305Supply chain risk quick-start

Citation and source

SP 800-213, IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements. National Institute of Standards and Technology. 2021. https://doi.org/10.6028/NIST.SP.800-213.

Topics: Cloud and connected devices, Vendors and supply chain. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.