The New IoT Cybersecurity Improvement Act Becomes Federal Law

Baker Donelson
Contact

Baker Donelson

Recognizing the importance of Internet of Thing (IoT) devices to the federal government, the President signed the IoT Cybersecurity Improvement Act (the Act) into law on December 4, 2020. Manufacturers who build IoT devices for the federal government and government contractors (and their subcontractors) whose services involve IoT devices should pay special attention to the requirements of the Act, as it establishes minimum security requirements for IoT devices owned or controlled by the federal government and mandates that contractors (and their subcontractors) have IoT device vulnerability disclosure policies and procedures in place.

Security Standards and Guidelines

The Act requires the National Institute of Standards and Technology (NIST) to develop standards and guidelines for use of IoT devices by federal agencies. No later than 90 days from the date of the Act, NIST must create and publish standards and guidelines for the use of IoT devices owned or controlled by an agency, including minimum information security requirements for managing cybersecurity risks associated with such devices. Within five years of the date NIST publishes its standards and guidelines, and every five years thereafter, NIST must review and update its standards and guidelines as appropriate.

Within 180 days of the publishing of NIST standards and guidelines, the Office of Management and Budget (OMB), working with the Department of Homeland Security (DHS), must review agencies' existing information security policies and issue policies and procedures to ensure such information security policies are consistent with NIST standards and guidelines.

Guidelines on Vulnerability Reporting and Disclosure

Within 180 days from the date of the Act, NIST must work with private industry, cybersecurity researchers and DHS and develop guidelines for reporting security vulnerabilities of IoT devices and resolving such vulnerabilities. DHS, working with OMB, must provide assistance to (i) agencies on reporting and receiving information about security vulnerabilities of such IoT devices consistent with NIST's standards and guidelines and (ii) contractors and subcontractors on receiving and disseminating information relating to vulnerabilities, and resolution of those vulnerabilities.

Prohibition on Use of Non-Compliant IoT Devices

Subject to limited exceptions, a federal agency will not be able to procure or use an IoT device unless the device complies NIST standards and guidelines.

NIST's Draft Standards and Guidelines

On December 15, 2020, NIST released four new draft publications to begin providing guidance as mandated by the Act − NIST Special Publication 800-213 and NIST Interagency Reports 8259B, 8259C and 8259D. NIST Special Publication 800-213 provides overall guidance to federal agencies on what cybersecurity requirements they need to look for when they acquire IoT devices, including recommendations to help federal agencies consider what security capabilities an IoT device needs to provide. The NIST Interagency Reports provide guidance for manufacturers who are building IoT devices for the federal government, to help them implement NIST's guidance from Special Publication 800-213. The public comment period on these documents extends through February 12, 2021.

Key Takeaways

Given that the Act contains provisions that prevent federal agencies from procuring, using or renewing a contract to procure or use an IoT device if the agency determines that use of the IoT device will prevent compliance with the NIST standards and guidelines, we know that:

  • Any IoT device purchased by the federal government will have to comply with NIST's standards and guidelines, including Special Publication 800-213.
  • Manufacturers providing IoT devices to the federal government will have to comply with NIST standards and guidelines, including NIST Interagency Reports 8259B, 8259C and 8259D when developing their products.
  • Government contractors (and their subcontractors) whose services involve IoT devices will have to adopt vulnerability disclosure policies and procedures to report any vulnerability that may be discovered related to an IoT device.

Considering the timelines for compliance and the wide scope of the Act, manufacturers need to review NIST's new guidance and start building a plan on how to integrate this guidance into their manufacturing processes. Also, government contractors can begin creating or updating their IoT vulnerability management programs, with the knowledge that DHS's guidance will be in line with NIST's new standards and guidelines. While the guidance is still open to public comment, we recommend organizations begin to address the issues as soon as possible, as we do not foresee material modifications and the timeline will be very tight for most organizations.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Baker Donelson | Attorney Advertising

Written by:

Baker Donelson
Contact
more
less

Baker Donelson on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.