The load-bearing documents for a DIB program — CMMC / DFARS regulatory text (eCFR), federal rulemaking, NIST publications and OIRA review — organized as a library. Pick a document; the reader shows the dex dossier: what it says, why it matters, and the concrete obligations it imposes. Originals open at the source.
SP 800-213 Rev. 1, IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity RequirementsInitial Public Draft
NIST SP 800-213 Rev. 1 (Initial Public Draft) provides guidelines for establishing cybersecurity requirements for IoT products to support security controls and risk assessments in federal systems.
This initial public draft updates guidelines for establishing cybersecurity requirements for Internet of Things (IoT) products used by the federal government. It emphasizes that IoT products are system elements that must be considered in the risk management process, as their acquisition and integration can alter a system's risk assessment and require additional or new controls. The publication provides general considerations on how IoT products impact an information system's risk assessment and subsequent control allocation, referencing SP 800-30 for risk assessment guidance.
For DIBs, this draft establishes foundational requirements for securing IoT devices integrated into federal systems, directly impacting CMMC compliance by defining how IoT products must be evaluated and controlled under the Risk Management Framework.
- Establish cybersecurity requirements for IoT products to support security controls.
- Consider IoT products as system elements in the risk management process.
- Conduct updated risk assessments when integrating IoT products into information systems.
- Select and implement additional or new controls based on updated risk assessments.
- Reference SP 800-30 for assessing risk due to IoT product inclusion.