Internet of Things Cybersecurity Improvement Act Enacted
New IoT law mandates security standards and guidance for federal procurement of IoT devices.
On December 4, 2020, President Trump signed Internet of Things ("IoT") Cybersecurity Improvement Act ("IoT Law"). The IoT Law requires the National Institute of Standards and Technology ("NIST") to develop and publish baseline standards and guidelines for how the federal government uses and manages IoT devices connected to information systems. NIST—which already has been addressing IoT cybersecurity—is required to promulgate "minimum information security requirements for managing cybersecurity risks associated with such devices." The IoT Law requires these new standards and guidelines to be consistent with NIST’s current guidance regarding:
- Vulnerability identification and management;
- Secure development;
- Identity management;
- Patch management; and
- Configuration management.
NIST is also tasked with publishing guidelines for IoT vendors regarding the disclosure of security vulnerabilities and dissemination of information about resolution of these vulnerabilities.
In addition to mandating NIST’s development of standards and guidelines, the IoT Law provides:
- Requirements for the Office of Management and Budget ("OMB") to review federal agency information security policies for consistency with the NIST standards and guidelines;
- Updates to the Federal Acquisition Regulation for consistency with the NIST standards and guidelines; and
- Prohibitions on federal procurement of IoT devices that fail to comply with NIST standards and guidelines.
While technically applying only to federal government procurement, NIST's standards and guidelines have the potential to influence state law and private sector practices. For instance, many IoT devices sold to the federal government that meet the NIST-based standards inevitably also will be sold to the private sector. As a practical matter, the NIST standards may have a broader impact on security practices across the IoT industry.
Daniel Ongaro, an associate in the Minneapolis Office, assisted in the preparation of this Alert.
