SP 800-213A Rev. 1, PRE-DRAFT Call for Comments: IoT Device Cybersecurity Requirement CatalogInitial Preliminary Draft

Summary

Following the publication of draft revision IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements, NIST SP 800-213 Rev. 1, NIST has initiated the process of revising the companion document IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog,  NIST SP 800-213A, to incorporate lessons learned, align with relevant NIST guidance (e.g., Cybersecurity Framework (CSF) 2.0, NIST SP 800-53 Rev. 5.2.0)—as well as IoT cybersecurity standards and practices, and address changes in the IoT threat landscape.

NIST invites public feedback, insights, and suggestions to maximize the document’s effectiveness, relevance, and usability in helping the community understand and manage cybersecurity risk. We welcome any valuable perspectives on the draft. To help guide this input, NIST has included specific questions below, though reviewers are encouraged to address any, all, or additional topics in their comments.

The public comment period is open through September 15, 2026. Submit comments via email to iotsecurity@nist.gov with the subject line “Comments on SP 800-213A.”

Input Requested

Specifically, NIST asks for input on the following questions to help us plan and produce an initial revision of NIST SP 800-213A:

1. Addressing IoT Products. Given that draft NIST SP 800-213 Rev. 1 discusses IoT products while NIST SP 800-213A was written for IoT devices, how should we align NIST SP 800-213A with NIST SP 800-213 Rev. 1 in relation to IoT products?
2. Novel and Unique IoT Adoption and Use Cases. How is your organization using IoT and are there novel IoT use cases we should consider in the update?
3. Addressing Unique and Tailored IoT Deployments. How can the NIST SP 800-213A guidelines appropriately handle situations in which an organization combines multiple off-the-shelf components (e.g., Raspberry Pi, sensors) to create an IoT sub-system akin to an IoT product?
4. Foundational Guidelines to Base our Work Upon. The content in NIST SP 800-213A was sourced primarily from NIST SP 800-53 Rev. 5, as well as the NIST Cybersecurity Framework (CSF). What other sources should we look to?
5. Document Usability. Do current descriptions and discussions for each capability in NIST SP 800-213A help practitioners identify appropriate IoT product cybersecurity capabilities in different operational environments?

Submitted comments, including attachments and other supporting materials, will become part of the public record and are subject to public disclosure. Personally identifiable information and confidential business information should not be included (e.g., account numbers, Social Security numbers, names of other individuals). Comments that contain profanity, vulgarity, threats, or other inappropriate language will not be posted or considered.