Profile Using the IoT Core Baseline and Non-Technical Baseline for the Federal Government

Fagan, Michael; Marron, Jeffrey; Brady, Kevin; Cuthill, Barbara; Megas, Katerina; Herold, Rebecca

doi:https://doi.org/10.6028/NIST.IR.8259D-draft

NISTIR 8259D (Draft)

Profile Using the IoT Core Baseline and Non-Technical Baseline for the Federal Government

Documentation Topics

Date Published: December 2020
Comments Due: February 12, 2021
Email Comments to: iotsecurity@nist.gov

Author(s)

Michael Fagan (NIST), Jeffrey Marron (NIST), Kevin Brady (NIST), Barbara Cuthill (NIST), Katerina Megas (NIST), Rebecca Herold (The Privacy Professor Consultancy)

Announcement

Draft NISTIR 8259D provides a worked example result of applying the NISTIR 8259C process, focused on the federal government customer space, where the requirements of the FISMA process and the SP 800-53 security and privacy controls catalog are the essential guidance. NISTIR 8259D provides a device-centric, cybersecurity-oriented profile of the NISTIR 8259A and 8259B core baselines, calibrated against the FISMA low baseline described in NIST SP 800-53B as an example of the criteria for minimal securability for federal use cases.

This draft is released concurrently with these related IoT draft publications:

Draft SP 800-213, IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements
Draft NISTIR 8259B, IoT Non-Technical Supporting Capability Core Baseline
Draft NISTIR 8259C, Creating a Profile Using the IoT Core Baseline and Non-Technical Baseline

See this announcement for more details about all four documents.

NOTE: A call for patent claims is included on page iv of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.

Abstract

The NISTIR 8259 series provide general guidance on how manufacturers can understand and approach their role in supporting customers’ cybersecurity needs and goals. As discussed in those documents, specific sectors and use cases may require more specific guidance than what is included in the device capability core baseline in NISTIR 8259A and the non-technical and supporting capability baseline in NISTIR 8259B for IoT devices. This publication provides the profile created for the Federal Government using the process described in NISTIR 8259C, which can serve as a helpful starting point in determining and anticipating federal agencies’ IoT device cybersecurity requirements.

Keywords

cybersecurity baseline; Internet of Things (IoT); securable computing devices; security requirements; Risk Management Framework

Control Families

None selected

Documentation

Publication:
NISTIR 8259D (Draft) (DOI)
Local Download

Supplemental Material:
None available

Other Parts of this Publication:
NISTIR 8259
NISTIR 8259A
NISTIR 8259B (Draft)
NISTIR 8259C (Draft)

Related NIST Publications:
SP 800-213 (Draft)

Document History:
12/15/20: NISTIR 8259D (Draft)

Topics

Security and Privacy
risk management

Technologies
hardware

Applications
cybersecurity framework; Internet of Things

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

Computer Security Resource Center

Computer Security Resource Center

NISTIR 8259D (Draft)

Profile Using the IoT Core Baseline and Non-Technical Baseline for the Federal Government

Author(s)

Announcement

Abstract

Keywords

Control Families

Documentation

Topics