Considerations for managing Internet of Things (IoT) cybersecurity and privacy risks
Open accessAbstract
Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities.The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications.Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
NIST's Cybersecurity for IoT program has created and connected norms, rules, and related tools to improve the security of associated gadgets and the conditions where they are.
“NIST's Cybersecurity for IoT program [31] has created and connected norms, rules, and related tools to improve the security of associated gadgets and the conditions where they are.”
From IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process (2020) · cites this paper as [31]
NIST IR 8228 documents the potential challenges with IoT devices and risk considerations in achieving device and data security.
“NIST IR 8228 [31] documents the potential challenges with IoT devices and risk considerations in achieving device and data security.”
From IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process (2020) · cites this paper as [31]
Device protection has four risk mitigation areas: asset management, vulnerability management, access management, and incident detection.
“Device protection has four risk mitigation areas including asset management, vulnerability management, access management, and incident detection.”
From IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process (2020) · cites this paper as [31]
NIST has come up with three main goals for IoT risk assessment: device protection, data protection, and user privacy.
“NIST has come up with three main goals for IoT risk assessment: (a) device protection, (b) data protection, and (c) user privacy.”
From IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process (2020) · cites this paper as [31]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
References 6 · Cited by 163
- Authors
- Boeckl, K., Fagan, M., Fisher, W., Lefkovitz, N., Megas, K. N., Nadeau, E., O'Rourke, D. G., Piccarreta, B., & Scarfone, K.
- Affiliations
- National Institute of Standards and Technology (US)
- Published
- 2019-06
- OpenAlex
- W2894066856
- Cited by
- 163
- References
- 6
- Citations by year
- 2026: 12 · 2025: 18 · 2024: 20 · 2023: 19 · 2022: 16 · 2021: 38 · 2020: 30 · 2019: 9 · 2018: 1
- Type
- report
- Language
- en
- Open access
- gold
- doi.org
- Funders
- Information Technology Laboratory
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
- Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- Internet of Things, Internet of Things security, privacy risks, risk management, federal agencies
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
