US IoT Security Standards and Regulations

The regulatory and standards landscape governing Internet of Things (IoT) security in the United States spans federal statutes, agency rulemaking, voluntary frameworks, and mandatory baseline requirements that collectively define minimum acceptable security practices for connected devices deployed in residential and commercial environments. This page maps the structure of that landscape — the agencies involved, the frameworks in force, the classification distinctions that determine which rules apply, and the tensions that persist between industry flexibility and regulatory certainty. It is a reference for device manufacturers, system integrators, security researchers, and procurement professionals navigating this sector.

• Definition and scope
• Core mechanics or structure
• Causal relationships or drivers
• Classification boundaries
• Tradeoffs and tensions
• Common misconceptions
• Checklist or steps (non-advisory)
• Reference table or matrix
• References

Definition and scope

IoT security standards and regulations address the technical, procedural, and legal requirements that govern how connected devices — including smart locks, thermostats, cameras, sensors, hubs, and embedded controllers — are designed, authenticated, updated, and retired. The scope extends from device-level firmware integrity to network-level transmission security and cloud-based data handling.

In the United States, no single omnibus federal IoT security statute exists. Instead, the landscape is structured through a combination of the IoT Cybersecurity Improvement Act of 2020 (Public Law 116-283), National Institute of Standards and Technology (NIST) guidance documents, Federal Trade Commission (FTC) enforcement authority under Section 5 of the FTC Act, and sector-specific rules from agencies including the Federal Communications Commission (FCC) and the Department of Energy (DOE). The scope of mandatory requirements currently applies most directly to IoT devices procured by federal agencies, while voluntary frameworks — primarily NIST publications — set de facto standards for the broader commercial market.

Smart home devices are a defined subset of the broader IoT category. For regulatory purposes, a "smart home" IoT device typically involves a device that connects to a residential network, interfaces with a consumer application, and collects or transmits data about occupants or the physical environment. Professionals evaluating the full range of connected residential products can reference the Smart Home Security Listings for a structured view of the service sector.

Core mechanics or structure

The structural backbone of US IoT security governance rests on four interconnected layers: federal statutory mandates, NIST technical standards, voluntary labeling programs, and state-level legislation.

Federal statutory layer. The IoT Cybersecurity Improvement Act of 2020 directed NIST to publish standards and guidelines for the federal government's use and management of IoT devices. NIST responded with NIST IR 8259, which defines a core baseline of IoT device cybersecurity capabilities — including device identification, configuration management, data protection, logical access control, and software/firmware update capability.

NIST technical standards layer. NIST IR 8259A establishes the IoT Device Cybersecurity Capability Core Baseline with 6 technical device capabilities and 6 non-technical supporting capabilities. Companion publications — including NIST IR 8259B (federal profile) and NIST IR 8259C (creating a profile using the IoT core baseline) — extend the framework to specific deployment contexts. NIST SP 800-213 provides the federal agency-side guidance that operationalizes the baseline for procurement decisions.

Voluntary labeling layer. The FCC launched the US Cyber Trust Mark program in 2024, a voluntary cybersecurity labeling initiative modeled partly on the Energy Star program. Devices meeting defined security criteria — aligned with NIST IR 8425 — are eligible to display the shield-shaped Cyber Trust Mark label. The program targets consumer IoT devices and is administered through FCC-authorized cybersecurity labeling administrators (CLAs).

State legislation layer. California's SB-327 (effective January 1, 2020) was the first US state law mandating reasonable security features for connected devices. Oregon's HB 2395 followed in 2019. These laws require manufacturers to equip devices with "reasonable security features" — a standard that courts and regulators interpret through reasonableness analysis rather than a defined technical checklist.

Causal relationships or drivers

The growth of regulatory activity in this sector is traceable to specific, documented failure patterns in deployed IoT infrastructure. The Mirai botnet attack of 2016 — which exploited default credentials on approximately 600,000 IoT devices according to reporting cited by the Congressional Research Service — demonstrated that insecure consumer devices could be weaponized to generate distributed denial-of-service (DDoS) traffic affecting critical internet infrastructure.

NIST's development of the IoT baseline framework was further accelerated by Executive Order 14028 (May 2021), "Improving the Nation's Cybersecurity," which directed federal agencies to improve software supply chain security and prompted NIST to develop guidance on software bill of materials (SBOM) requirements and IoT security labeling. The FCC's Cyber Trust Mark program flows directly from that executive order's policy direction.

On the state side, legislative activity has been driven by documented incidents involving consumer cameras, smart doorbells, and home automation hubs being accessed without authorization — vulnerabilities attributed to default passwords, absent encryption, and disabled update mechanisms. The FTC's enforcement actions against companies including TRENDnet (2013) and Ring (2023, settlement of $5.8 million) (FTC press release) established that inadequate IoT security constitutes an unfair or deceptive trade practice under Section 5.

Classification boundaries

IoT devices subject to US security requirements fall into distinct regulatory categories based on procurement channel, device function, and deployment context.

Federal procurement scope. Devices acquired by federal agencies under the IoT Cybersecurity Improvement Act must conform to NIST-published standards. This requirement does not extend automatically to commercial off-the-shelf products sold in consumer retail channels.

Consumer IoT scope. The FCC Cyber Trust Mark program applies to consumer IoT devices — a category that includes smart home hubs, cameras, thermostats, and locks — but excludes medical devices (regulated by FDA under 21 CFR Part 880), motor vehicles (regulated by NHTSA), and certain industrial control systems (addressed under ICS-CERT guidance from CISA).

Medical IoT (IoMT) scope. Connected health devices fall under FDA's cybersecurity guidance framework, most recently formalized through the Omnibus Consolidated Appropriations Act of 2023 (Section 524B), which mandated that medical device manufacturers submit cybersecurity plans as part of premarket submissions.

Industrial and critical infrastructure IoT. Devices integrated into operational technology (OT) environments or connected to systems designated as critical infrastructure are addressed under CISA's cross-sector cybersecurity performance goals (CPGs) and NIST SP 800-82.

For organizations navigating which framework applies to a given deployment, the Smart Home Security Directory Purpose and Scope provides additional context on how residential security products are categorized within the broader connected-device market.

Tradeoffs and tensions

The core structural tension in US IoT security governance is between mandatory minimum requirements and voluntary market-based approaches. Federal procurement mandates create enforceable floors, but they affect only a fraction of total device deployments. The commercial IoT market — which shipped an estimated 1.4 billion units in 2023 according to GSMA Intelligence — remains largely governed by voluntary frameworks, with enforcement driven primarily by FTC unfairness doctrine after harm occurs rather than pre-market certification.

The Cyber Trust Mark program attempts to resolve this tension through market incentive rather than mandate: consumers can identify labeled products, theoretically rewarding manufacturers that meet the standard. Critics note that voluntary labeling programs historically achieve low penetration without procurement requirements or insurance incentives reinforcing participation. Analogues like Energy Star achieved broader adoption partly because utility rebates and building codes incorporated the label.

A second tension exists between security update requirements and device longevity. Both NIST IR 8259A and the Cyber Trust Mark criteria require that devices support software updates. Mandatory update support over extended product lifespans increases manufacturer support costs, which can reduce market entry for smaller manufacturers — potentially reducing product diversity or driving offshore manufacturing where enforcement is absent.

A third tension involves interoperability and security. The Matter protocol — developed by the Connectivity Standards Alliance (CSA) and adopted by major platform vendors — improves device interoperability but introduces a shared attestation infrastructure whose security properties depend on the integrity of the Device Attestation Certificate chain. A compromise in that chain could affect certified devices across multiple manufacturers simultaneously.

Common misconceptions

Misconception: All IoT devices sold in the US must meet federal security standards.
Correction: Federal IoT security requirements under the IoT Cybersecurity Improvement Act of 2020 apply to devices procured by federal agencies, not to all commercial devices. Consumer-market devices are not subject to mandatory pre-market security certification under current federal law.

Misconception: The FCC Cyber Trust Mark certifies that a device cannot be hacked.
Correction: The Cyber Trust Mark indicates that a device met defined baseline criteria at the time of testing. It does not guarantee ongoing security or immunity from exploitation. NIST IR 8425 — the underlying technical standard — sets minimum baseline capabilities, not comprehensive security assurance.

Misconception: California SB-327 requires specific technical controls.
Correction: SB-327 requires "reasonable security features" — a standard intentionally defined without a specific technical checklist. What constitutes "reasonable" is determined through legal analysis, not a fixed enumeration of controls. This contrasts with NIST's explicit capability lists.

Misconception: An SBOM requirement is the same as a security requirement.
Correction: Software bill of materials (SBOM) requirements — as directed under Executive Order 14028 and NTIA guidance — mandate disclosure of software components, not remediation of vulnerabilities in those components. An SBOM enables vulnerability tracking but does not itself impose security controls.

Checklist or steps (non-advisory)

The following sequence reflects the phases typically involved in assessing IoT device compliance against applicable US standards. This is a structural description of the compliance process, not professional advice.

1. Determine procurement channel — Establish whether the device is being acquired for federal agency use (triggering IoT Cybersecurity Improvement Act requirements) or commercial/consumer use (triggering applicable state laws and voluntary frameworks).

2. Identify device category — Classify the device as consumer IoT, medical IoT (FDA jurisdiction), industrial/OT IoT (CISA/NIST SP 800-82), or federal-use IoT (NIST SP 800-213 profile).

3. Map applicable frameworks — Cross-reference the device category against NIST IR 8259A capability baseline, NIST IR 8425 (for Cyber Trust Mark eligibility), and any applicable state statutes (California SB-327, Oregon HB 2395).

4. Evaluate device against NIST IR 8259A capabilities — Assess the six technical capabilities: device identification, device configuration, data protection, logical access to interfaces, software/firmware updates, and cybersecurity event logging.

5. Evaluate non-technical supporting capabilities — Assess documentation, information and query reception, information dissemination, education and awareness, and product lifecycle support practices against NIST IR 8259A non-technical criteria.

6. Assess SBOM availability — Determine whether the manufacturer provides a software bill of materials consistent with NTIA minimum elements guidance (published September 2021).

7. Review update policy and end-of-support commitments — Verify that the manufacturer has published a defined support period and update delivery mechanism.

8. Confirm labeling status — Check FCC Cyber Trust Mark registry (once fully operational) or manufacturer-provided FCC authorization documentation for applicable consumer IoT devices.

9. Document findings against applicable state law — For devices deployed or sold in California, verify "reasonable security" compliance documentation, including unique default credential policies.

For a broader orientation to the professional services sector that implements and audits these standards, the How to Use This Smart Home Security Resource page describes how the directory is structured to support that navigation.

Reference table or matrix

References

• IoT Cybersecurity Improvement Act of 2020 — P.L. 116-283
• NIST IR 8259 — Foundational Cybersecurity Activities for IoT Device Manufacturers
• NIST IR 8259A — IoT Device Cybersecurity Capability Core Baseline
• NIST IR 8425 — Profile of the IoT Core Baseline for Consumer IoT Products
• NIST SP 800-213 — IoT Device Cybersecurity Guidance for the Federal Government
• NIST SP 800-82 Rev. 3 — Guide to OT Security
• FCC Cyber Trust Mark Program
• Executive Order 14028 — Improving the Nation's Cybersecurity
• FTC v. TRENDnet, Inc. — Case No. 122-3090
• FTC Ring Settlement — Press Release, May 2023
• NTIA Minimum Elements for a Software Bill of Materials (SBOM), September 2021
• [California SB-327 — Security of Connected Devices (codified at Cal. Civ