House Passes Internet of Things Legislation

Tucker Arensberg, P.C.

Tucker Arensberg, P.C.This week, the Internet of Things Cybersecurity Improvement Act (HR 1668), which was first introduced in March 2019, passed the House vote. 

“Internet of Things” (or “IoT”) describes a network of physical devices embedded with sensors, software and other technology to connect and exchange date with other devices and systems through the internet.  While the benefit of IoT devices is substantial, data security related to these devices is challenging.  Weaknesses in one IoT device can result in vulnerabilities to the other devices on the network. 

Under the IoT Bill, devices purchased by the United States government must meet certain, minimum security requirements.  Pursuant to this legislation, the National Institute of Standards and Technology (the “NIST”) will be tasked with specifying particular measures for agencies to employ, which could include network segmentation, use of gateways, utilization of operating system containers, and micro-services.  The Office of Management and Budget (“OMB”) will issue specific guidelines that agencies must follow to comply with the IoT Bill and must review those guidelines on a regular basis.

Importantly, the IoT Bill places numerous obligations on vendors of IoT devices.  These vendors must ensure that their IoT devices are patchable, do not contain known vulnerabilities, rely on standard protocols, and do not contain hard-coded passwords.  If an agency believes that it must utilize a device that does not comply with these standards, it may ask the Office of Management and Budget (the “OMB”) for permission to purchase non-compliant devices if it can demonstrate that other security controls have been put in place. A companion bill (S 734) still awaits.  Meanwhile, it is crucial that vendors who develop and provide IoT devices have a clear understanding of this IoT legislation and how to comply with its mandates.  

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Tucker Arensberg, P.C. | Attorney Advertising

Written by:

Tucker Arensberg, P.C.

Tucker Arensberg, P.C. on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.