Summary

Following the publication of draft revision IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements, NIST SP 800-213 Rev. 1, NIST has initiated the process of revising the companion document IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog,  NIST SP 800-213A, to incorporate lessons learned, align with relevant NIST guidance (e.g., Cybersecurity Framework (CSF) 2.0, NIST SP 800-53 Rev. 5.2.0)—as well as IoT cybersecurity standards and practices, and address changes in the IoT threat landscape.

NIST invites public feedback, insights, and suggestions to maximize the document’s effectiveness, relevance, and usability in helping the community understand and manage cybersecurity risk. We welcome any valuable perspectives on the draft. To help guide this input, NIST has included specific questions below, though reviewers are encouraged to address any, all, or additional topics in their comments.

The public comment period is open through September 15, 2026. Submit comments via email to iotsecurity@nist.gov with the subject line “Comments on SP 800-213A.”

Input Requested

Specifically, NIST asks for input on the following questions to help us plan and produce an initial revision of NIST SP 800-213A:

1. Addressing IoT Products. Given that draft NIST SP 800-213 Rev. 1 discusses IoT products while NIST SP 800-213A was written for IoT devices, how should we align NIST SP 800-213A with NIST SP 800-213 Rev. 1 in relation to IoT products?
2. Novel and Unique IoT Adoption and Use Cases. How is your organization using IoT and are there novel IoT use cases we should consider in the update?
3. Addressing Unique and Tailored IoT Deployments. How can the NIST SP 800-213A guidelines appropriately handle situations in which an organization combines multiple off-the-shelf components (e.g., Raspberry Pi, sensors) to create an IoT sub-system akin to an IoT product?
4. Foundational Guidelines to Base our Work Upon. The content in NIST SP 800-213A was sourced primarily from NIST SP 800-53 Rev. 5, as well as the NIST Cybersecurity Framework (CSF). What other sources should we look to?
5. Document Usability. Do current descriptions and discussions for each capability in NIST SP 800-213A help practitioners identify appropriate IoT product cybersecurity capabilities in different operational environments?

Submitted comments, including attachments and other supporting materials, will become part of the public record and are subject to public disclosure. Personally identifiable information and confidential business information should not be included (e.g., account numbers, Social Security numbers, names of other individuals). Comments that contain profanity, vulgarity, threats, or other inappropriate language will not be posted or considered.

Storage technology has evolved in two primary directions: (1) increased media storage capacity and (2) architectural changes that provide a software-based abstraction over all forms of background storage technologies. However, the latter evolution has increased management complexity and the probability of configuration errors and associated security threats. This document traces the evolution of the storage technology landscape and analyzes current security threats and resultant risks to provide a comprehensive set of security recommendations in the form of storage security controls. 

Important updates in this revision of SP 800-209 include:

• Section 2 — Removal of content associated with obsolete and/or proprietary technologies.
• Section 3 — Completely revised to primarily focus on threats and risks that are specific to storage systems and ecosystems. References to other NIST publications are provided for generic ICT threats and risks. Two notable focus areas were also added:
  • “Platform Security Compromises” — Focuses on threats associated with the underlying/supporting infrastructure for data storage
  • “Compromised Data Resilience/Protection” — Focuses on threats to secondary data assets and the secondary data asset generation process (i.e., backups)
• Section 4 — Retitled as “Storage Security Controls.” The security recommendations have been reorganized from nine categories into seven formalized control families with standardized control acronyms.
  • Several new control families have been added, and some existing controls have been consolidated under new control families to provide coverage for all threats and risks covered in previous sections.
• Appendix C — Added to provide a complete list of the storage security controls described in Sec. 4 as well as a mapping of mitigating controls for the storage-oriented threats identified in Sec. 3.

NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.