Senate passes minimum security standards for federal IoT devices

Vendors must notify federal customers of any cyber security flaws in their internet-connected devices

Alarm sign on a red background

The US Senate has unanimously passed a new piece of legislation that will create minimum cyber security standards for government purchased, internet-connected devices.

The Internet of Things (IoT) Cybersecurity Improvement Act (H.R. 1668), introduced by Congresswoman Robin Kelly (D-Illinois), would oblige all internet-connected devices purchased by the federal government to conform to a set of minimum security recommendations issued by the National Institute of Standards and Technology.

Private companies that sell devices to the federal government would also be required to notify agencies if the internet-connected device has a vulnerability that could leave the government open to attacks.

The act would require the National Institute of Standards and Technology (NIST) to issue recommendations addressing, at a minimum, secure development, identity management, patching, and configuration management for IoT devices.

It would also direct the Office of Management and Budget (OMB) to issue guidelines for each agency that are consistent with the NIST recommendations, including making any necessary revisions to the Federal Acquisition Regulation to implement new security standards and guidelines.

The act would also make NIST to work with cyber security researchers, industry experts, and the Department of Homeland Security (DHS) to publish guidelines on vulnerability disclosure and remediation for federal information systems.

Congresswoman Kelly said in a statement that that the act would make sure that “the U.S. government purchases secure devices and closes existing vulnerabilities to protect our national security and the personal information of American families.”

The legislation was unanimously approved by the House in September, and passed on the Senate floor by unanimous consent on the evening of 17 November.

“While more and more products and even household appliances today have software functionality and internet connectivity, too few incorporate even basic safeguards and protections, posing a real risk to individual and national security,” said Sen. Mark Warner, D-Va., in a statement.

“I’m proud that Congress was able to come together today to pass this legislation, which will harness the purchasing power of the federal government and incentivize companies to finally secure the devices they create and sell. I urge the President to sign this bill into law without delay.” 

The bill now heads to the president to be signed into law.

Paul Bischoff, privacy advocate at Comparitech.com, told IT Pro that the establishment of minimum-security standards for government owned IoT devices is long overdue.

“I think it was wise to put NIST, a reputable non-partisan standards body, in charge of drafting guidelines and auditing devices, as opposed to writing fixed standards into law that would only be made obsolete in a few years’ time. Although government-level security standards might not be necessary on all devices, it would be helpful for consumers and businesses to know which devices meet NIST's standards,” he said.

Andrea Carcano, co-founder at Nozomi Networks, said that this is an important first step by the federal government to help ensure IoT device makers improve the security of their products.

“At the same time, you can never guarantee zero risk...that's why enterprise and industrial organizations must put additional security measures and technologies in place to shore up their IoT security,” he said.

“That includes using AI-powered solutions that can quickly identify the hundreds or even thousands of IoT devices connected to the network and assess their level of risk or vulnerability to help prioritize fixes and response. By effectively managing vulnerabilities of their IoT devices, security teams are one step closer to protecting against cyber threats and the risk of downtime due to cyberattacks.”

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

What is a web filter?
cyber security

What is a web filter?

24 Sep 2021
100 million IoT devices affected by zero-day flaw
Internet of Things (IoT)

100 million IoT devices affected by zero-day flaw

24 Sep 2021
Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021
HP Wolf Security: Threat insights report
Whitepaper

HP Wolf Security: Threat insights report

24 Sep 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

17 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
London ranks second to Silicon Valley as world's best startup hub
startups

London ranks second to Silicon Valley as world's best startup hub

22 Sep 2021