Cybersecurity Policy Report, NIST Group to Offer IoT Recommendations on Privacy, Security, (Apr 2, 2024)

By Jeff Williams

During the first of two scheduled days of virtual meetings, members of the National Institute of Standards and Technology’s Internet of Things (IoT) Advisory Board (ITAB) today started to fine-tune the latest version of their draft report and recommendations regarding numerous IoT-related matters, including what policies, programs, or multistakeholder activities could promote IoT use and ensure security.

The ITAB plans to send its report and recommendations by the end of May to the IoT Federal Working Group (IoTFWG), which was established by the National Defense Authorization Act for fiscal year 2021 to identify federal regulations, practices, and policies that inhibit development of IoT; the benefits of federal agencies adopting IoT technology; and ensuring federal coordination related to IoT security.

During the meeting, Greg Witte, a consultant contracted by NIST to support the ITAB, said the group had received “generally favorable feedback” from the IoTFWG regarding the advisory board’s preliminary findings (CPR, Aug. 25, 2023).

There has been a “positive collaboration” between the “separate but connected teams,” he said.

The draft report details several general findings, including findings that industry adoption of IoT technology has been “slower than expected” and that there is a “lack of coordination at the national level” that is “hindering IoT adoption and operation across the economy and industry sectors.”

The report also points to other challenges standing in the way of broader IoT expansion, such as interoperability between devices, a lack of trust in IoT security, and an insufficient number of people in the workforce “with the technical, digital and analytic skills required to develop, integrate and deploy, operate and maintain IoT devices and IoT-enabled systems and applications.”

The ITAB’s draft lays out broad recommendations—along with specific ways to address them—related to establishing a national IoT strategy; modernizing IoT infrastructure; establishing trust in the technology; expanding the IoT-related workforce; facilitating broader adoption; and providing incentives to boost the IoT market and to create a resilient IoT supply chain.

Among the suggestions for implementing its recommendations, the draft says there could be more coordination between agencies to create a national IoT strategy, as well as funding for research and development and upgrades to existing infrastructure to support greater government use of IoT.

The government should also advocate for the implementation and adoption of interoperable data standards related to public safety of IoT, as well as for supply chain logistics and reliability.

The ITAB also suggested including IoT workforce expansion in other federal workforce-related efforts, as well as collaborating with “industry, academia, and state and local government to create an IoT trained workforce embedded in target high priority industry sectors.”

The draft also includes suggestions about providing “specific and consistent cybersecurity guidance for IoT providers and adopters to ensure secure operations in a whole-of-government approach,” including recommendations for strengthening cybersecurity measures related to the IoT supply chain to “address concerns around data privacy, security, confidentiality, trust, and potential risks associated with increased connectivity and interdependence of IoT systems.”

In addition, the draft recommends the White House and Congress facilitate and support the development of a data and privacy framework that includes “privacy by design” principles, “clear policies” for third-party data sharing and IoT device data use, and using “plain language in IoT privacy policies,” among others.

News: FederalLegislation DataSecurity DataPrivacy