NIST IoT device cybersecurity requirements: NISTIR 8259 and SP 800-213

NIST's IoT Cybersecurity Program publishes two linked families of guidance under a congressional mandate: the NISTIR 8259 series, written for device manufacturers, and SP 800-213 / SP 800-213A, written for the federal agencies that buy IoT devices. Together they define what a "reasonably secure" connected device looks like for anyone selling into the US federal market, and they are being actively revised through 2026 — NISTIR 8259 Revision 1 finalized in April 2026 with a broadened scope, while SP 800-213 Revision 1 is still an open draft. A device maker reading only the 2020-2021 baseline risks missing where the ground is already shifting.

Where the mandate comes from

The Internet of Things Cybersecurity Improvement Act of 2020 (Public Law 116-207, H.R. 1668) was enacted 4 December 2020. Section 4 directed NIST to "develop and publish... standards and guidelines for the Federal Government on the appropriate use and management by agencies of Internet of Things devices owned or controlled by an agency" within 90 days of enactment, covering "minimum information security requirements for managing cybersecurity risks" including secure development, identity management, patching and configuration management. Section 5 separately required NIST to publish guidelines on coordinated disclosure of security vulnerabilities affecting federal information systems, including IoT devices, aligned with industry practice and ISO standards. Section 4(c)(1) builds in a standing review clock: NIST must revisit its standards and guidelines "not later than 5 years after" first publishing them "and not less frequently than once every 5 years thereafter" — the clause that is driving the 2025-2026 revision cycle described below.

Once NIST's guidance exists, the Act has teeth on the federal buying side: the law obliges agencies to "implement information security policies and principles... consistent with the standards and guidelines" NIST publishes, so devices and manufacturers that cannot demonstrate the capabilities NIST describes become harder for federal integrators to procure, even though the NIST documents themselves are not regulations.

The NISTIR 8259 series (manufacturer-facing)

Document	Title	Status as of this guide
NISTIR 8259	Foundational Cybersecurity Activities for IoT Device Manufacturers	Published 29 May 2020; superseded by Revision 1 (finalized ~20 April 2026)
NISTIR 8259A	IoT Device Cybersecurity Capability Core Baseline	Published 29 May 2020
NISTIR 8259B	IoT Non-Technical Supporting Capability Core Baseline	Draft
NISTIR 8259C	Creating a Profile Using the IoT Core Baseline and Non-Technical Baseline	Draft
NISTIR 8259D	Profile Using the IoT Core Baseline and Non-Technical Baseline for the Federal Government	Draft

NISTIR 8259 itself "describes recommended activities related to cybersecurity that manufacturers should consider performing before their IoT devices are sold to customers" — four pre-market activities (identify expected customers and uses, identify needed cybersecurity capabilities, determine how to make those capabilities available, and plan for post-market support) plus post-market activities such as monitoring and vulnerability handling. NISTIR 8259A supplies the actual technical content: it "defines an IoT device cybersecurity capability core baseline, which is a set of technical device abilities generally needed to support common cybersecurity controls" — device identification, device configuration, data protection, logical access to interfaces, software and firmware update, and cybersecurity state awareness. NISTIR 8259B complements it with non-technical expectations (documentation, information dissemination, education and awareness, and similar manufacturer-side capabilities). NISTIR 8259C and 8259D are the tailoring layer: C describes "a profiling process (usable by any organization) that starts with the NISTIR 8259A/B core baselines and explains how to integrate those baselines with organization- or application-specific requirements," and D is the worked example of running that process for the federal government context.

SP 800-213 and SP 800-213A (federal buyer-facing)

SP 800-213, "IoT Device Cybersecurity Guidance for the Federal Government," published 29 November 2021, is addressed to the agency doing the buying, not the manufacturer. It "provides IoT-specific guidance for federal organizations in understanding and defining their IoT cybersecurity requirements" and "explains the role of IoT devices as elements of federal systems and provides guidance for addressing the unique risks such devices can present," framed inside the NIST Risk Management Framework (RMF) rather than as a standalone checklist. Its companion, SP 800-213A, "IoT Device Cybersecurity Requirements Catalog," is the reference table: it "provides a catalog of internet of things (IoT) device cybersecurity capabilities" and non-technical supporting capabilities, and "cross references the capabilities in the catalog to the cybersecurity controls in NIST SP 800-53," including an IoT profile built on the SP 800-53B RMF low-impact baseline. In practice, an agency uses SP 800-213 to reason about risk and 800-213A as the lookup table of concrete capabilities to put in a solicitation or system security plan.

The 2026 update: from "devices" to "products"

The Act's five-year review clock lands in this period, and NIST's response is a visible scope change rather than a minor refresh. NIST IR 8259 Revision 1 went through an initial public draft (13 May 2025) and a second public draft (30 September 2025) before its final publication was recorded around 20 April 2026, when it formally withdrew and replaced the 2020 original. NIST's own announcement of the revision frames it as "a pivotal change to addressing the full IoT product scope as well as broadening consideration of maintenance, support and end of life considerations for IoT products" — a direct response to feedback that the original "device" framing undercounted software-only and service-delivered IoT functionality, and that manufacturer obligations around patching and end-of-life notice needed to be explicit rather than implied.

SP 800-213 Revision 1 is following the same path but has not yet landed: NIST released the initial public draft, retitled "IoT Product Cybersecurity Guidelines for the Federal Government," on 24 June 2026, with public comments accepted through 24 August 2026. The draft text states plainly that "an IoT product is a system element," extending the earlier device-centric guidance to treat IoT products — hardware, embedded software and any inseparable cloud/mobile-app components — as a single unit for risk assessment purposes, and gives "general considerations of how IoT products may impact an information system's risk assessment and subsequent allocation of controls." As of this guide's publication date, that draft has not been finalized; SP 800-213 (2021) remains the current, authoritative version, and a manufacturer or integrator should track NIST's SP 800-213 series page directly before assuming the product-scoped revision applies.

How this fits with other device-security obligations

NIST's IoT guidance is US federal-procurement-focused and non-regulatory; it sits alongside, not instead of, the EU's device obligations covered elsewhere on this site. A connected product sold into both markets will typically need the Cyber Resilience Act's Annex I technical requirements and vulnerability-handling duties, firmware SBOM evidence, and a working PSIRT process for coordinated disclosure, alongside NIST's capability baseline if it also targets US federal buyers. None of these frameworks formally cross-reference each other, so treat NISTIR 8259A/SP 800-213A as one more capability checklist to satisfy with the same underlying engineering evidence, not a separate compliance track to build from scratch.

SoftWSP maps a device's actual firmware capabilities — identification, update mechanism, logging, access control — against baselines like NISTIR 8259A so the evidence doubles for US federal buyers and EU regulators alike: see device firmware security.

This guide summarises public NIST and US federal legislative documents; it does not constitute legal or compliance advice.