IoT SMM: Retail Profile for Point-of-Sale Devices
omg/2020-08-01

Authors
Frederick Hirsch (Upham Security), Andy Mattice (Lexmark), Bart McGlothin (Cisco), Leonid
Rubhakin (Aptos), Ekaterina Rudina (Kaspersky), Ron Zahavi (Microsoft)

Technical Editor
Stephen Mellor (IIC staff)

IoT SMM: Retail Profile for Point-of-Sale Devices

Contents

CONTENTS
1 The IoT Security Maturity Model ....................................................................................... 5
1.1
1.2

The SMM Process ................................................................................................................ 6
Understanding the Model .................................................................................................... 6
1.2.1
Security Governance............................................................................................................ 8
1.2.2
Security Enablement............................................................................................................ 9
1.2.3
Security Hardening ............................................................................................................ 10
1.3 Applying the Model ........................................................................................................... 11
1.3.1
Scoring and Prioritization .................................................................................................. 11
1.3.2
Comprehensiveness Levels ................................................................................................ 11
1.3.3
Scope ................................................................................................................................. 12
1.3.4
SMM Template .................................................................................................................. 12
1.4 Security Maturity Profiles .................................................................................................. 13

2 Retail Use Case: Point-of-Sale .......................................................................................... 17
2.1
2.2

Payment Security Ecosystem Example ................................................................................ 17
UPOS Device Types ............................................................................................................ 18

3 Profile Tables .................................................................................................................. 20
3.1
3.2
3.3
3.4
3.5
3.6
3.7
3.8
3.9
3.10
3.11
3.12
3.13
3.14
3.15
3.16
3.17

Compliance Management Practice ..................................................................................... 24
Threat Modeling Practice ................................................................................................... 26
Risk Attitude Practice ........................................................................................................ 29
Product Supply Chain Risk Management Practice ............................................................... 31
Services Third-Party Dependencies Management Practice .................................................. 31
Establishing and Maintaining Identities Practice ................................................................. 33
Access Control Practice ...................................................................................................... 34
Asset, Change and Configuration Management Practice ..................................................... 35
Physical Protection Practice ............................................................................................... 35
Protection Model and Policy for Data Practice .................................................................... 37
Implementation of Data Protection Practices Practice ........................................................ 38
Vulnerability Assessment Practice ...................................................................................... 40
Patch Management Practice .............................................................................................. 40
Monitoring Practice ........................................................................................................... 41
Situational Awareness and Information Sharing Practice .................................................... 42
Event Detection and Response Plan Practice ...................................................................... 43
Remediation, Recovery and Continuity of Operations Practice ............................................ 43

Annex A

Acronyms ...................................................................................................... 44

Annex B

Definitions .................................................................................................... 45

Annex C

References .................................................................................................... 45

Annex D

Authors and Legal Notice ............................................................................... 47

2

IoT SMM: Retail Profile for Point-of-Sale Devices

Contents

Figure 1-1: SMM Hierarchy ............................................................................................................................ 7
Figure 1-2: Security Governance ................................................................................................................... 8
Figure 1-3: Security Enablement ................................................................................................................... 9
Figure 1-4: Security Hardening ....................................................................................................................10
Figure 2-1: Traditional Integrated Payment ................................................................................................17
Figure 2-2: Semi-Integrated Payment..........................................................................................................18
Figure 2-3: Device Types at Retail Point of Sale ..........................................................................................19

Table 1-1: SMM Template ...........................................................................................................................13
Table 1-2: Template with industry and system specific considerations .....................................................14
Table 1-3: Displays the industry and system specific considerations within the template. .......................15
Table 3-1: Security Program Management ..................................................................................................24
Table 3-2: Compliance Management ..........................................................................................................26
Table 3-3: Threat Modeling .........................................................................................................................28
Table 3-4: Risk Attitude................................................................................................................................31
Table 3-5: Product Supply Chain Risk Management....................................................................................31
Table 3-6: Services Third-Party Dependencies Management .....................................................................32
Table 3-7: Establishing and Maintaining Identities .....................................................................................34
Table 3-8: Access Control.............................................................................................................................35
Table 3-9: Asset, Change and Configuration Management .........................................................................35
Table 3-10: Physical Protection ...................................................................................................................37
Table 3-11: Protection Model and Policy for Data ......................................................................................38
Table 3-12: Implementation of Data Protection Practices ..........................................................................40
Table 3-13: Vulnerability Assessment..........................................................................................................40
Table 3-14: Patch Management ..................................................................................................................41
Table 3-15: Monitoring Practice ..................................................................................................................42
Table 3-16: Situational Awareness and Information Sharing Practice ........................................................42
Table 3-17: Event Detection and Response Plan .........................................................................................43
Table 3-18: Remediation, Recovery and Continuity of Operations .............................................................44

IoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Model

The retail landscape is changing with digital transformation, evolving technologies, andincreasing risks associated with greater connectivity and integration. The retail industry is
deploying Internet connected devices to reach and serve customers better, ranging from new
point of sale (also known as point of service) payment devices such as radio-frequency
identification (RFID) and signature scanners, to audit-logging devices such as printers, cash
dispensers and other systems such as lights and cameras. With the proliferation of mobile devices
and other technologies, retailers are intentionally and, perhaps, unintentionally, collecting more
and more data about their customers. New threats constantly emerge, and attackers are
becoming more capable and organized. At the same time, compliance requirements around dataprotection and security are becoming more significant. These trends increase the urgency andimportance of addressing security and data protection concerns in a systematic and effective
manner.
The Object Management Group’s (OMG) Retail Domain Task Group1 (with members previously
in the ARTS community2) has recognized these issues and previously produced primers about
security and data protection threats and associated controls. Trust is essential to the customer
relationship with the retailer. The challenge is to figure out how much security is needed, howmuch to invest to fit certain scenarios and which controls to deploy, given the complexity of theretail environment. All aspects must be considered including governance, technology andoperations. The IoT Security Maturity Model (SMM) helps organize and manage these concerns,
enabling various stakeholders to communicate and determine appropriate maturity targets,assess the current status, and create action plans to address gaps.
The SMM defines general considerations to form a foundation from which communities canconsider their specific needs and concerns and extend the SMM by creating profiles that consider
industry and device specific concerns. This document is a profile for the point of sale (POS) retail
community.
This document, the “IoT Security Maturity Model: Retail Profile,” is an industry profile extension
to the “IoT Security Maturity Model: Practitioners Guide” that provides details on the SMM. It
draws on the detailed analysis in the ARTS Cybersecurity Primer 3 and the ARTS Data Privacy
Primer4. The material in Payment Card Industry (PCI) standards are relevant, in particular the
Data Security Standard,5 Payment Application Data Security Standard,6 and the PIN Transaction
Security Devices standard.7

1 https://www.omg.org/retail/2Association

for Retail Technology Standards (ARTS) in the National Retail Federation (NRF),
https://nrf.com/insights/retail-technology
3 See [ARTS-CYBERP2015]
4 See [ARTS-DATAP2015]
5
See [PCI-DSS]
6 See [PCI-PADSS]
7 See [PCI-PTS]

IoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Model

1 THE IOT SECURITY MATURITY MODEL
The goal of a SMM is to provide a path for Internet of Things (IoT) providers to know where theyneed to be and how to invest in security mechanisms that meet their requirements without overinvesting in unnecessary security mechanisms. It seeks to help organizations identify theappropriate approach for effective enhancement of these practices where needed. Deciding
where to focus limited security resources is a challenge for most organizations given thecomplexity of a constantly changing security landscape.
As an informed understanding of the risks and threats an organization faces is the foundation ofchoosing and implementing appropriate security controls, the model provides a conceptual
framework to organize the myriad considerations. The framework helps an organization decide
what their security target state should be and what their current state is. Repeatedly comparing
the target and current states identifies where further improvement can be made.
Not all IoT systems require the same strength of protection mechanisms and the sameprocedures to be deemed secure enough. The organization determines the priorities that drive
the security enhancement process, making it possible for the mechanisms and procedures to fit
the organization’s goals without going beyond what is necessary. The implementation of security
mechanisms and processes are considered mature if they are expected to be effective in
addressing those goals. It is the security mechanisms’ appropriateness in addressing the goals,
rather than their objective strength, that determines the maturity. Hence, security maturity is
the degree of confidence that the current security state meets all organizational needs andsecurity-related requirements. Security maturity is a measure of the understanding of the current
security level, its necessity, benefits and cost of its support. Factors to weigh in such an analysis
include the specific threats to an organization's industry vertical, regulatory and compliancerequirements, the unique risks present in an environment and the organization's threat profile.
Security level,1 on the other hand, is a measure of confidence that system vulnerabilities are
addressed appropriately and that the system functions in an intended manner. The SMM does
not say what the appropriate security level should be; it provides guidance and structure fororganizations to identify considerations for different maturity levels appropriate for theirindustry and system. It provides guidance for defining and accounting for different levels ofcomprehensiveness and alignment with industry sector and system, including non-industrial
systems. Some users of the model will apply its guidance to create industry- and system-specificprofiles, which can then be used by a broader audience, in concert with the model, to help assessmaturity in a specific vertical or use case.
The audience for this document includes owners of IoT systems, decision makers, security leadersin various verticals, business risk managers, system integrators, architects, security assessors,
analysts, policy and regulatory authorities, and other stakeholders concerned about the proper

1 According to [IEC-62443-33]

IoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Model

strategy for the implementation of mature security practices tailored to the needs andconstraints of the specific IoT system.
Those using this SMM should be able to determine and clearly communicate to management theanswers to the following questions:• Given the organizational requirements1 and threat landscape, what is my solution’s target
maturity state?
• What is my solution’s current maturity state?
• What are the mechanisms and processes that will take my solution’s maturity from its
current state to its target state?

1.1

THE SMM PROCESS

Organizational business stakeholders define goals for the security posture of the organizationand the systems it owns or operates. These systems may be brand new or brownfield. These
goals should be mapped to objectives that tie to the risks. Technical teams within theorganization, or third-party assessment vendors, map these objectives into tangible security
techniques and capabilities, identifying the appropriate target security maturity state.
Establishing a target maturity state, while accounting for industry and system-specificconsiderations, facilitates generation of security profiles. These profiles capture target security
maturity states of systems and can act as templates for evaluating security maturity of a specificarea of use, common use-case or system of interest.

1.2

UNDERSTANDING THE MODEL

Figure 1-1 illustrates the structure of the SMM and the breakdown of security maturity domains.
Domains are the high-level views that capture the key aspects of security maturity: governance,
enablement and hardening. Each of the domains has different key aspects to it, called
subdomains. For example, the hardening domain includes subdomains vulnerability and patch
management, situational awareness and event and incident response. Each domain may use avariety of practices, both technical and organizational, to achieve results related to that domain.
This hierarchical approach enables the maturity and gap analysis to be viewed at different levelsof detail, from the various domains overall to the individual practices.

1Namely, business or mission needs, requirements from regulatory authorities, and other similar factors.

IoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Model

Domains are pivotal to determining
the priorities of security maturity
enhancement at the strategic level.

At the domains level, the stakeholder
determines the priorities of the direction
in improving security.

Sub Domains reflect the basicmeans of obtaining these priorities
at the planning level.

At the sub domains level, the stakeholder
identifies the typical needs for addressing
security concerns.

Practices define typical activities
associated with sub domains andidentified at the tactical level.

At the practices level, the stakeholder
considers the purpose of specific security
activities.
Figure 1-1: SMM Hierarchy

IoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Model

1.2.1 SECURITY GOVERNANCE
Figure 1-2 below describes the elements of the governance domain of the SMM.

The security governance domain is the heart of security. It influences and informs every
security practice including business processes, legal and operational issues, reputation
protection and revenue generation.
Security strategy and the governance sub domain facilitates organizational drivers alongwith providing security, compliance with regulations, laws and contractual obligations. This
also can relate to customer expectations and reputation management.
Security program management
practice is vital to the clear planningand timely provision of security
activities, control over the process andresults and optimal decision-making
procedure for fulfillment of security
related demands.

Compliance management practice isnecessary when strict requirements forcompliance with evolving security
standards is needed.

Threat modeling and the risk assessment sub domain identifies gaps in specificconfigurations, products, scenarios and technologies and prioritize countermeasuresaccordingly.
Threat modeling practice aims at bothrevealing known and specific factorsthat may place the functioning of agiven system at risk and accurately
describing these factors.

Risk attitude practice enables anorganization to establish a strategy for
dealing with risks according to risk
management policy, including conditions
for acceptance, avoidance, evaluation,
mitigation and transference.

Supply chain and the external dependencies management sub domain aims at controllingand minimizing a system’s exposure to attacks from third parties that have privileged accessand can conceal attacks.
Product Supply chain risk
management practice addresses theneed to enable trust for contractors or
suppliers and to ascertain the absenceof hidden threat sources, ensuring the
integrity of the supply chain.

Services Third party dependencies
management practice addresses the needto enable trust for partners and other third
parties. The ability to have assurance of thetrust of third parties requires
understanding of the business and trust
infrastructure and possible hidden threatsources.

Figure 1-2: Security GovernanceIoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Model

1.2.2 SECURITY ENABLEMENT
Figure 1-3 below describes the elements of the enablement domain of the SMM.

The security enablement domain is based on established security policy and addresses
the business risks using the best available means. Security policy and controls are subject
to periodic review and assessment.
Identity and access management sub domain aims to protect the organization and control
the use of resources by the identified agents to reduce the risk of information leakage,tampering, theft or destruction.
Establishing and maintaining
identities practice helps to identify
and constrain who may access thesystem and their privileges.

Access control practice policy andimplementation allow a business to limit
access to resources to only the specificidentities that require access and only at
the specific level needed to meetorganizational requirements.

The asset management sub domain is put in place to protect both physical and digital assets.
This is an area of strong collaboration between IT and physical security teams.

Asset, Change and Configuration
Management practice constrains thetypes of changes allowed, when thosechanges can be made, approval
processes and how to handle
emergency change scenarios.

Physical protection practice policies
address the physical security and safety ofthe premises, its people and its systems toprevent theft and ensure the ongoing safe
operation of equipment.

The data protection sub domain prevents unauthorized data disclosure or manipulation ofdata, both for data at rest, in transit and in use. This is important for security, privacy,
regulatory compliance, legal and intellectual property protection.

The security model and policy fordata practice identifies whether
different categories of data exist andconsiders the specific objectives andrules for data protection.

The implementation of data protection
controls practice describes the preferred
application of data protection mechanisms
to address confidentiality, integrity andavailability.

Figure 1-3: Security Enablement

IoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Model

1.2.3 SECURITY HARDENING
Figure 1-4 below describes the elements of the security hardening domain of the SMM.

The security hardening domain practices support trustworthiness objectives through theassessment, recognition and remediation of risks with both organizational and technicalcountermeasures. This needs to take into account changes over time.
Vulnerability and the patch management sub domain policies and procedures keep systems
up to date and less prone to attacks.
Vulnerability assessment practicehelps to identify vulnerabilities,
determine the risk that eachvulnerability places on theorganization and develop a prioritized
remediation plan.

Patch management practice policy clarifies
when and how frequently to apply thesoftware patches, sets up procedures for
emergency patches and proposes
additional mitigations in the instance ofconstrained access to the system or otherissues involved with patching.

The situational awareness sub domain aims at understanding the current security state
enabling an organization to prioritize and manage threats more effectively.
Monitoring practice is used to monitor
the state of the system, identify
anomalies and aid in dispute
resolution.

Situational Awareness and Information
sharing practice helps organizations bebetter prepared to respond to threats.
Sharing threat information keeps systems
up to date.

Event and incident response, continuity of operations sub domain implemented in a
combination of policy and technical preparation allows an organization to respond toincidents swiftly and minimize disruption to the rest of the system.
An event detection and response plan
defines what a security event is andhow to detect and assign events forinvestigation, escalate them as needed
and respond appropriately. It should
also include a communications planfor sharing information appropriately
and in a timely manner withstakeholders.

Remediation, recovery, and continuity ofoperations represent a combination oftechnical redundancies whereby trained
staff and business continuity policy help anorganization recover quickly from an event
to expedite returning to business as usual.

Figure 1-4: Security Hardening

IoT SMM: Retail Profile for Point-of-Sale Devices

1.3

1: The IoT Security Maturity ModelAPPLYING THE MODEL

Two aspects are essential for measuring the maturation progress of IoT systems and prioritizing
associated security practices – comprehensiveness and scope. These are considered within thecontext of the target and assessment, namely the system of interest, whether end to end, acomponent or a sub-system under consideration.
Comprehensiveness captures the degree of depth, consistency and assurance of security
measures that support security maturity domains, sub domains or practices. For example, ahigher level of comprehensiveness of threat modeling implies a more automated systematic andextensive approach.
Scope reflects the degree of fit to the industry or system needs. This captures the degree ofcustomization of the security measures that support security maturity domains, sub domains orpractices. Such customizations are typically required to address industry-specific or systemspecific constraints of the IoT system.
1.3.1 SCORING AND PRIORITIZATION
Any rigorous security self-assessment procedure, including the SMM, needs a scoring andprioritization method to enable evaluation of the current state and the development of a metricsbased security strategy.
Comprehensiveness and scope, which are orthogonal, help score and prioritize security maturity
practices. Certain IoT systems may not require the highly sophisticated or narrowly scoped
implementation of all security practices. Such implementation may be over-engineered, given
the particular system and the threats that it faces. The security maturity of the system should bedetermined against the requirements that best meet its purpose and intended use.
1.3.2 COMPREHENSIVENESS LEVELS
There are five comprehensiveness levels for every security domain, sub domain and practice,from Level 0 to Level 4, with larger numbers indicating a higher degree of comprehensiveness of
security controls. Every comprehensiveness level covers all the requirements set by the lower
levels, augmenting them with additional ones.
Level 0, None: There is no common understanding of how the security practice is applied and no
related requirements are implemented. (As this is null, we shall not discuss it further).
Level 1, Minimum: The minimum requirements of the security practice are implemented. There
are no assurance activities for the security practice implementation.
Level 2, Ad hoc: The requirements for the practice cover main use cases and well-known security
incidents in similar environments. The requirements increase accuracy and level of granularity
for the environment under consideration. The assurance measures support ad hoc reviews of thepractice implementation to ensure baseline mitigations for known risks. For this assurance,
application of measures learned through successful references may be applied.

IoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Model

Level 3, Consistent: The requirements consider best practices, standards, regulations,classifications, software and other tools. Using such tools helps to establish a consistent approachto practice deployment. The assurance of the implementation validates the implementation
against security patterns, design with security in mind from the beginning and known protection
approaches and mechanisms. This includes creating a system with the security design consideredin the architecture and design as well as definition defaults.
Level 4, Formalized: A well-established process forms the basis for practice implementation,
providing continuous support and security enhancements. The assurance on the implementation
focuses on the coverage of security needs and timely addressing of issues that appear to threaten
the system of interest. For this assurance, a more complex approach is applied that uses semiformal to formal methods.
1.3.3 SCOPE
The scope measurement captures the extent to which the specifics of an application, network or
system of interest is taken into account during the implementation of the security facet.
There are three levels of scope for every security facet, from Level 1 to Level 3, with higher
numbers indicating a narrower and more specific scope.
Level 1, General: This is the broadest scope. The security practice is implemented in the computer
systems and networks without any assessment of its relevance to the specific IoT sector,
equipment used, software or processes to be maintained. The security capabilities andtechniques are applied as they were in the typical environment.
Level 2, Industry specific: The scope is narrowed from the general case to an industry-specificscenario. The security practice is implemented considering sector-specific issues, particularly
those regarding components and processes that are prone to certain types of attacks, and known
vulnerabilities and incidents that have taken place.
Level 3, System specific: This is the narrowest scope. The security practice implementation isaligned with the specific organizational needs and risks of the system under consideration,
identified trust boundaries, components, technologies, processes and usage scenarios.
Combining the general and domain specific objectives in a unique manner sets the requirementsof this implementation.
1.3.4 SMM TEMPLATEAll IoT devices, networks and systems do not require the highest comprehensiveness and scopefor all security domains, sub domains or practices. The security maturity target for the system ofinterest is defined as the set of all desirable values of comprehensiveness and scope
characteristics for every security maturity domain, sub domain and practice.
In case of insufficient details about the system-security needs the stakeholders may initiallydetermine the target levels of comprehensiveness and scope just for domains. These levels
determine the relative priorities of security governance, enablement and hardening. The levels
set for the domains will be inherited by the appropriate sub domains and then by the practices

IoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Modelaccording to the hierarchy. The stakeholders may modify the levels to match the risks moreclosely. This is helpful for the step-by-step recognition of an uncertain security maturity target.
The security maturity target by default is defined when referring to the comprehensiveness andscope for security maturity practices as seen in Error! Reference source not found.. Each practicetable has four columns, one for each comprehensiveness level. The objective in each leveldescribes the general considerations that should be met. Guidance is provided in the form ofgeneral considerations.

ComprehensivenessComprehensivenessComprehensivenessComprehensivenessLevel 1 (Minimum)
Level 2 (Ad Hoc)
Level 3 (Consistent)
Level 4 (Formalized)
Objective<Objective Level 1><Objective Level 2><Objective Level 3><Objective Level 4>General<List of Level 1 general <List of Level 2 general <List of Level 3 general <List of Level 4 generalconsiderations
considerations>considerations>considerations>considerations>

Table 1-1: SMM Template

1.4

SECURITY MATURITY PROFILESThe SMM is designed to be extensible across a wide array of industries and systems. It addresses
the general scope, which looks at common security maturity best practices in the industry. Thereis an opportunity to add industry-specific and system-specific scope to any or all of the practices.
The IIC will collaborate with a wide range of industry groups to encourage development of
profiles—practice tables that go beyond general scope and include industry- and system-specificrequirements for different comprehensiveness levels. For example, a retail group may create
profiles of some or all practices that include best practices and regulatory requirements specificto the retail industry; they may also create system specific profiles for commonly used devices
such as card readers or security cameras. A health care profile may include specific guidance
related to HIPAA, while a system-specific profile could address considerations for, say, FDA preand post-market guidance for implanted medical devices.
Industry and system profiles need not be created for every practice in the model. An industry
may decide that the general scope is sufficient for most of the governance-related practices butthat a few of the enablement practices necessitate an industry-level point of view.
When extending for industry or system-specific considerations, the practice table as seen in Table
1-2 expands to include two additional rows.

IoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Model<Practice-Name><Practice Description>

Objective

ComprehensivenessLevel 1 (Minimum)<Objective Level 1>

ComprehensivenessLevel 2 (Ad Hoc)
<Objective Level 2>

Generalconsiderations<List of Level 1 general <List of Level 2 general <List of Level 3 general <List of Level 4 generalconsiderations>considerations>considerations>considerations>

Industryspecificconsiderations<List of Level 1
industry specificconsiderations><List of Level 2
industry specificconsiderations>

ComprehensivenessLevel 3 (Consistent)<Objective Level 3><List of Level 3
industry specificconsiderations>

ComprehensivenessLevel 4 (Formalized)<Objective Level 4><List of Level 4
industry specificconsiderations>

System-specific <List of Level 1 system <List of Level 2 system <List of Level 3 system <List of Level 4 system
considerations specificspecific
specific
specific
considerations>considerations>considerations>considerations>

Table 1-2: Template with industry and system specific considerations

Industry-specific considerations include the sector-specific issues, particularly components andprocesses that are prone to certain types of attacks, known vulnerabilities, incidents that took
place in similar systems and possible harm to this kind of operational technology as well as sector
specific priorities including legal and regulatory guidance.
While the general row in the table included headings for achieving the level and indicators ofaccomplishment, the industry row should include a general description of the industry-specificissues as noted above and for a comprehensiveness level with industry-specific considerations:1.
2.

what needs to be done to achieve that level andrelevant industry guidelines for that level.

System-specific considerations include the specific security-relevant business needs and risks forthe system under consideration, identified trust boundaries, components, technologies,
processes, and usage scenarios that combine the general and domain-specific objectives in aunique manner.
As the general and industry rows in the table included headings and structure described above,the system row should include a description of the system and how it is used in the larger IoT
infrastructure and for a comprehensiveness level with industry-specific considerations:3.
4.

what needs to be done to achieve that level andindicators of accomplishment that can assist assessors in identifying if the organization
has met the requirements of the level.

IoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Model

Compliance Management
This practice is necessary when strict requirements for compliance with evolving security standards is needed.
ComprehensivenessLevel 1 (Minimum)
Objective

See main table.

GeneralConsiderations

See main table.

Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Ensure compliancewith Internal privacy
and data security
requirements for thebusiness.

Consider regulatory
guidelines relevant toretailers including:
Data Security Standard(PCI-DSS), Payment
Application Data
Security Standard (PADSS, 2010), and the
PIN Transaction
Security Devices (PTS,2010).

Indicators ofachievement
Internal privacy anddata security
compliance areintegrated as part ofoverall complianceprogram.
Device Scope
Considerations

ComprehensivenessLevel 4 (Formalized)…

Ensure compliancewith PIN Transaction
Security Devices (PTS,
2010)…
Indicators ofachievement
Complete set of
documents verifying
and assuring
compliance withsecurity-related
requirements.
…

Table 1-3: Displays the industry and system specific considerations within the template.

Establishing a target maturity state, while accounting for industry and system-specificconsiderations, facilitates generation of security profiles. These profiles capture systems’ target

IoT SMM: Retail Profile for Point-of-Sale Devices

1: The IoT Security Maturity Modelsecurity maturity and can act as templates for evaluating security maturity of a specific area ofuse, common use-case or system of interest.

IoT SMM: Retail Profile for Point-of-Sale Devices

2: Retail Use Case: Point-of-Sale

2 RETAIL USE CASE: POINT-OF-SALE
2.1

PAYMENT SECURITY ECOSYSTEM EXAMPLE

Because of the inherent value and belief of an easy theft, today’s hackers are increasingly seeing
value in locating and breaching large databases of payment information rather than focusing on
the theft of individual credit cards or user information (of course, intercepting and collecting
individual credit card payments remains highly lucrative). Below is an example of how payment
systems evolved to improve the security and PCI compliance.
Traditional retail payment systems were implemented using so-called Integrated paymentarchitecture.

Figure 2-1: Traditional Integrated Payment

In this integrated architecture, Point-of-Sale (POS) controls the payment terminal. It builds
payment messages and handles the authorization flow. Since all the significant data flows
through the POS system, all the sub-systems on the diagram above have to deal with cardholder’sdata. Therefore, they all must be protected against determined criminal attackers. Also, thecompliance with PCI regulations must be achieved at all retail locations including the back office.
A modern semi-Integrated payment architecture can help to address these challenges.

IoT SMM: Retail Profile for Point-of-Sale Devices

2: Retail Use Case: Point-of-Sale

Figure 2-2: Semi-Integrated Payment

In this semi-integrated architecture, the payment terminal is still connected to the POS. However,the communication between them is limited to only non-sensitive commands. In this architecture
the payment terminal also has an independent connection to authorization host system. The
cardholder data only travels between the payment terminal and the authorization host. As aresult, the sensitive payment data never enters the POS system. It is typical that the semiintegrated solution also uses additional payment security technologies such as Point-to-Point
Encryption (P2PE) and tokenization.
Such clear separation between the payment sub-system and POS provides greater flexibility to
implement different payment solutions. Semi-integrated solutions reduce the scope of PCI
compliance and significantly improve security.

2.2

UPOS DEVICE TYPESThe industry-level scope represents all IoT as related to UPOS that are network connected via the
WS-POS standard,1 or newer UPOS v2 API's.2
For device scope consideration there are four identified device types. These device types wereconsidered in determining which requirements are general to the retail industry scope and which
are specific to the device scope. The types include devices related to (1) payment or personal

1 [WS-POS]
2 [UPOS v2 APIS]

IoT SMM: Retail Profile for Point-of-Sale Devices

2: Retail Use Case: Point-of-Sale

information (e.g., payment device), (2) audit logging and reporting (e.g., printer), (3) locallyvaluable assets (e.g., cash drawer) and (4) other (e.g., lighting). The examples are highlighted in

Figure 2-3: Device Types at Retail Point of Sale

•

•

•

Type 1: Payment and/or PII/Identity information relatedo Biometrics
o Check Scannero Credit Authorization Terminal (CAT)o Electronic Value Reader/Writero Individual Recognition *o Magnetic Stripe Reader (MSR)o Magnetic Ink Character Recognition Reader (MICR)o PIN Pado Point Card Reader / Writero RFID Scannero Signature Captureo Smart Card Reader / Writero Video Capture Camera *Type 2: Audit logging and reporting relatedo Electronic Journalo Fiscal Printero Hard Totals
o POS PrinterType 3: Locally valuable assets like cash related

IoT SMM: Retail Profile for Point-of-Sale Devices•

3: Profile Tableso Bill Acceptoro Bill Dispensero Cash Changero Cash Drawero Coin Acceptoro Coin Dispensero Item Dispensero KeylockType 4: All other, local device control relatedo Belto BumpBaro Device Monitor *o Gateo Gesture Control *o Graphic Display *o Image Scannero Lightso Line Displayo Motion Sensor
o POS Keyboard
o POS Powero Remote Order Displayo Scaleo Scanner (Bar Code Reader)o Sound Player *o Sound Recorder *o Speech Synthesis *o Tone Indicatoro Voice Recognition ** = new in UPOS 1.16

3 PROFILE TABLES
The following tables add the industry and device scope to the general SMM considerations as
appropriate.

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Security Program Management PracticeSecurity Program Management
This practice is critical for the planning and timely provision of security activities, control over the process andresults and optimal decision-making procedure for fulfillment of security related demands.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

ComprehensivenessLevel 4 (Formalized)

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Plan the resources forsecurity management,
communication,
training andawareness.
Certify fiscal reporting
devices, weights andmeasures.
Initiate backgroundchecks for newly hired
associates.
Document systemsecurity
administration roles
and responsibilities.
Adhere to local
retailer requirements
established by cities
and states.

Incorporate and follow PCI Compliant with nostandards relevant to compensating
retailers:
controls.
Data Security Standard Engage with retail(PCI-DSS) applied tocommunity regarding
network infrastructure incident sharing,
Payment Application situational awareness,
Data Security Standard security alerts (e.g.,(PA-DSS) - applies to
NRF Security Mailer).
POS systems
PIN Transaction
Indicators of
Security Devices (PTS) achievement- applies to UPOS card
Systematic
devices
approaches to sharing
HIPPA in particular forof information andPharmacies
awareness with theDevelop processes to
Retail community are
increase awarenessin place.
and integrating thefollowing into the
Indicators ofprogram:achievement
FTC Start with
Security, a Guide forDocumented plan for Businesssecurity management The Open Web
includingApplication Security
communications
Project (OWASP)
training and
DOJ Best Practices forawareness.
Victim Response andFiscal device andReporting of Cyberweights and measure Incidents, (DOJ, 2015).
yearly certification
Center for Internet
documents.
Security’s “Critical
Employee background Security Controls forcheck results.
Effective Cyber
System administration Defense”
roles andThe SANS Instituteresponsibilities
created a list of Top 20
documentation.

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Security Program Management
Document detailing
how local retailer
requirements arebeing met.

NIST Special
Publications, ISO
27002, and the HiTrust
Common Security
Framework (CSF).
EU data protection
regulations with GDPR
Children’s Online
Privacy Protection Act(COPPA)
Smart Card Alliancedocument andstandards groups (PCI
SSC, EMVCo,
GlobalPlatform)
Global/International
Retailer Requirements- Tax, Labor, Digital
Sovereignty
Indicators ofachievement
Assessment reports
and design documents
demonstrating
conformance of
security management
practices to therelevant standards

Industry Scope
Considerations

What needs to bedone to achieve thislevel
Plan the resources forsecurity management,
communication,
training andawareness.
Certify fiscal reporting
devices, weights andmeasures.
Initiate backgroundchecks for newly hired
associates.
Document systemsecurity
administration roles
and responsibilities.

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Incorporate and follow PCI Compliant with nostandards relevant to compensating
retailers:
controls.
Data Security Standard Engage with retail(PCI-DSS) applied tocommunity regarding
network infrastructure incident sharing,
Payment Application situational awareness,
Data Security Standard security alerts (e.g.,(PA-DSS) - applies to
NRF Security Mailer).
POS systems
PIN Transaction
Indicators of
Security Devices (PTS) achievement- applies to UPOS card
Systematic
devices
approaches to sharing
HIPPA in particular for

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Security Program Management
Adhere to local
retailer requirements
established by cities
and states.

Pharmacies
of information andDevelop processes to awareness with theincrease awareness
Retail community are
and integrating thein place.
following into theprogram:
Indicators of
FTC Start withachievement
Security, a Guide forDocumented plan for Businesssecurity management The Open Web
Application Security
including
Project (OWASP)
communications
DOJ Best Practices fortraining andVictim Response andawareness.
Reporting of Cyber
Fiscal device andweights and measure Incidents, (DOJ, 2015).
Center for Internet
yearly certification
Security’s “Critical
documents.
Employee background Security Controls for
Effective Cybercheck results.
System administration Defense”
The SANS Instituteroles andcreated a list of Top 20
responsibilities
NIST Special
documentation.
Publications, ISO
Document detailing
27002, and the HiTrust
how local retailer
Common Security
requirements are
Framework (CSF).
being met.
EU data protection
regulations with GDPR
Children’s Online
Privacy Protection Act(COPPA)
Smart Card Alliancedocument andstandards groups (PCI
SSC, EMVCo,
GlobalPlatform)
Global/International
Retailer Requirements- Tax, Labor, Digital
Sovereignty
Indicators ofachievement
Assessment reports
and design documents
demonstrating
conformance of

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Security Program Management
security management
practices to therelevant standards

Table 3-1: Security Program Management

3.1

COMPLIANCE MANAGEMENT PRACTICE
Compliance Management

This practice is necessary when strict requirements for compliance with evolving security standards is needed.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Ensure compliancewith Internal privacy
and data security
requirements for thebusiness.

Consider regulatory
guidelines relevant toretailers including:
Data Security Standard(PCI-DSS), Payment
Application Data
Security Standard (PADSS, 2010), and the
PIN Transaction
Security Devices (PTS,2010).
FTC Start with
Security, a Guide for
Business
The Open Web
Application Security
Project (OWASPDOJ Best Practices forVictim Response andReporting of Cyber
Incidents, (DOJ, 2015).
Consider bestpractices and incident
next steps including:Center for Internet
Security’s “Critical
Security Controls for
Effective Cyber
Defense”
The SANS Institute list

Indicators ofachievement
Internal privacy anddata security
compliance areintegrated as part ofoverall complianceprogram.

ComprehensivenessLevel 4 (Formalized)

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Compliance Managementof Top 20
HIPPA
NIST Special
Publications, ISO
27002, and the HiTrust
Common Security
Framework (CSF).
GDPR
Children’s Online
Privacy Protection Act(COPPA)
Smart Card Alliancedocument andstandards groups (PCI
SSC, EMVCo,
GlobalPlatform)
Adhere to local
retailer requirements
established bycountries, states, andcities.
Government
compliance toregulation of weights
and measures.
European compliancefor Fiscal reporting.
Indicators ofachievement
Complete set of
documents verifying
and assuring
compliance withsecurity-related
requirements.
Valid certificates andother supporting
evidence.
Device Scope
Considerations

Ensure compliancewith PIN Transaction
Security Devices (PTS,2010).
Adhere to European
fiscal reporting retailer
requirements
established bycountries, states, andcities.

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Compliance Management
Government
compliance toregulation of weights
and measures.
Adhere to HIPAA for
PII and data
verification at POS inretail pharmacies.
Indicators ofachievement
Complete set of
documents verifying
and assuring
compliance withsecurity-related
requirements.
Valid certificates andother supporting
evidence.

Table 3-2: Compliance Management

3.2

THREAT MODELING PRACTICE
Threat ModelingThis practice aims at both revealing known and specific factors that may place the functioning of a given system atrisk and accurately describing these factors.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

ComprehensivenessLevel 4 (Formalized)

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Consider threats
related to offline
situations that
increase significanceof local vulnerabilities
and fraud.
Consider threats fromrisk of short wellidentified credit card
information andencryption key
management.
Consider threats toConsider markdown
barcode hacks andunauthorized pricemodifications forpromotions.
Cultivate a list of POS
Malware (e.g.,
BlackPOS) andvulnerabilities
Threats are sharedwith the retailer active
threat community.

Establish at least weak
Identity practices forManagers and Clerks
to POS devices
Use the Open Web
Application Security
Project (OWASP) andSANS institute Top 20
threat lists to identify
threats.
Consider barcode
hacks using moreresistant technology

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Threat Modelingsuch as RFID.
Consider threats fromtheft of IoT devices
such as shelf labels,
PDAs, barcode
scanners).

Transaction logs ifthey contain credit
card and customer
information.
Consider threats
related to thepotential loss,
Indicators of
unauthorized accessachievement
or use, destruction,
modification or
A vulnerability
unintended orassessment report isinappropriate
available anddisclosure ofidentifies common
personally identifiable
and typical threats
information (PII).
valid for the identified Consider threats fromretail use cases.
electronic jammersthat can disrupt store
operations (e.g., shelflabels and mobile
checkout)

What needs to bedone to achieve thislevel
Technologies such as
RFID deployed.
Lists of vulnerabilities
are managed andshared with the retail
community.

Indicators ofachievement
A vulnerability
assessment report isavailable andidentifies the specificthreats for theidentified retail use
cases.
Use of audit records
demonstrating securemanagement of
personally identifiable
information (PII).
Device Scope
Considerations

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Consider threats fromtheft scenarios
including the printingof barcode/QR codes
placed on packaging
and barcodes thatinterfere with proper
reader operations.

Consider threats
Cultivate a list of POS
related to PCI such as
Malware (e.g.,credit card skimming
BlackPOS) andand MSR overlay, RAM
vulnerabilities.
scraping attacks,
physical POS device
Indicators of
attacks andachievement
introduction of mobile
devices. Also consider
A vulnerability

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Threat Modeling
Indicators ofachievement

nefarious Bluetoothbeacons infections
and NFS or wirelessinterception.

A vulnerability
assessment report isavailable andIndicators ofidentifies mitigationachievement
for these barcode anddevice threats.
A vulnerability
assessment report isavailable andidentifies mitigation
for these threats.

Table 3-3: Threat Modelingassessment report isavailable andidentifies mitigation
for these threats.

IoT SMM: Retail Profile for Point-of-Sale Devices

3.3

RISK ATTITUDE PRACTICE

3: Profile Tables

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Risk Attitude
This practice enables an organization to establish a strategy for dealing with risks according to risk management
policy, including conditions for acceptance, avoidance, evaluation, mitigation and transference.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)
What needs to bedone to achieve thislevel
Consider impact fromthe June 2015 Federal
Trade Commission“Start with Security”
guidance. The April
2015 U.S. Departmentof Justice’s Best
Practices for Victim
Response andReporting of Cyber
Incidents (“DOJ Best
Practice Guidance”),
and Version 6.0 of theCouncil on
Cybersecurity CriticalControls for Effective
Cyber Defense,
released in October
2015
Consider the NIST
Cybersecurity
Framework Version
1.1
Consider the mapping
between SMM and
NIST framework.
Indicators ofachievement
Risk-handling strategy
describing avoidance,
mitigation,
acceptance, andtransference criteriawith appropriate
actions.

ComprehensivenessLevel 4 (Formalized)

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Risk Attitude
Device Scope
Considerations

Consider 3rd party riskfor printer software
libraries that enablesupport for many
printers.

Table 3-4: Risk Attitude

3.4

PRODUCT SUPPLY CHAIN RISK MANAGEMENT PRACTICE
Product Supply Chain Risk Management

This practice addresses the need to enable trust for contractors or suppliers and to ascertain the absence of hidden
threat sources, ensuring the integrity of the supply chain.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

ComprehensivenessLevel 4 (Formalized)

What needs to bedone to achieve thislevel
Deploy signed
firmware images withhash checking.
Indicators ofachievement
Procedures for thesigned images
deployment are
documented.

Device Scope
Considerations

Table 3-5: Product Supply Chain Risk Management

3.5

SERVICES THIRD-PARTY DEPENDENCIES MANAGEMENT PRACTICE
Services Third-Party Dependencies Management

This practice addresses the need to enable trust for partners and other third parties. The ability to have assurance ofthe trust of third parties requires understanding of the business and trust infrastructure and possible hidden threatsources.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

What needs to be

What needs to be

ComprehensivenessLevel 4 (Formalized)

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Services Third-Party Dependencies Management
done to achieve thisdone to achieve this
level
level
Include KPIs in SLAs
Ensure third parties
related to incident
conduct vulnerability
response, and reward assessments, are PCI
programs managed by compliant, and follow
3rd parties (such as
government
early identification
regulations forprior to checkout).
weights andEnsure adherence to measures.
Weights and Measurescalibration.
Indicators ofachievement
Indicators ofThird-party
achievement
assessment reports
SLAs, KPIs are defined are provided for theseper establishedprocesses andcontracts.
regulations.
Device Scope
Considerations

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Ensure adherence to Ensure third parties
Weights and Measures perform device
calibration.
software/firmware
Services for Video and patching for security
Audio recognition
vulnerabilities analysis.
required for PCI
ComplianceIndicators of
Monitor service
achievement
providers’ PCI DSS
compliance status at
SLAs, KPIs are defined
least annually (PCIper established
DSS).
contracts.
Indicators ofachievement
Third-party
assessment reports
are provided for theseprocesses andregulations.

Table 3-6: Services Third-Party Dependencies Management

IoT SMM: Retail Profile for Point-of-Sale Devices

3.6

3: Profile Tables

ESTABLISHING AND MAINTAINING IDENTITIES PRACTICE
Establishing and Maintaining Identities
This practice helps to identify and constrain who may access the system and their privileges.

Industry Scope
Considerations

ComprehensivenessLevel 1 (Minimum)

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

ComprehensivenessLevel 4 (Formalized)

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Ensure General Device Use shared Secretidentification is used
PINs when attachingconnected to POS with and connecting
Device manager. Basic devices (e.g.,store identifiers andBluetooth).
static names andThere is a Strong
passwords are
Password Policy andtypically used.
no shared passwords
for clerks/managers.
Indicators of
Use Passcards insteadachievementof simple PINs.

Use UPOS to Device
identification(OpenAuth "OAuth")
Use OpenID Connect
standards.
Authenticate users
and sessions.
Use secure device
onboarding andassociated standards(e.g., FIDO) and placedevices in secure
segment with POS
system. 802.1x
standard based.
Use PKI for device
certificates.
Identification should
be used if WiFi
networks exposed.

Per-transaction levelof re-authenticationfor every device
communication
call/message.
Short Expiration date
for authentication
tokens (5 events, or 60
seconds)
Notification of
revokedcertificates/tokens.
DDOS protection toensure reliability ofcentralized
authentications
services.
Highly reliable WAN
infrastructure toensure connectivity.

Indicators ofachievement

Indicators ofachievement

POS devices andstores are identified.

Indicators ofachievement
PIN and password
processes are
documented.

The mechanisms are
The appropriate
well established andstandards are used
implemented.
and documented.
Centralized identity isused if WiFi exposed.
WiFi access should be
on a separate network
than POS devices.
Device Scope
Considerations

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Identity is not

Use shared Secret PIN Retailers require

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Establishing and Maintaining Identities
required for directly
when attaching andconnected devices and connecting devices
for devices with no(e.g., Bluetooth)financial impact orthose that do not
Indicators ofhandle privileged or
achievement
private information.
Connecting devices
Indicators ofuse a shared secretachievement
PIN.

offline functionality
for a determined
period of time (1-day)- for business critical
Indicators ofachievement
Offline capabilities are
deployed and well
documented.

These devices may or
may not have unique
identities.

Table 3-7: Establishing and Maintaining Identities

3.7

ACCESS CONTROL PRACTICE
Access Control

This practice’s policy and implementation allow a business to limit access to resources to only the specific identities
that require access and only at the specific level needed to meet organizational requirements.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)
What needs to bedone to achieve thislevel
Follow practices for
PCI.
Indicators ofachievement
PCI use is
documented.

Device Scope
Considerations

What needs to bedone to achieve thislevel
Use PCI for payment
related devices.
Indicators ofachievement
PCI use isComprehensivenessLevel 4 (Formalized)

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Access Control
documented.

Table 3-8: Access Control

3.8

Asset, Change and Configuration Management Practice
Asset, Change and Configuration Management

This practice constrains the types of changes allowed, when those changes can be made, approval processes andhow to handle emergency change scenarios.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

ComprehensivenessLevel 4 (Formalized)

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Record and save
device component
changes.

Track device
component changes
and integrate andautomate within thedevice.
The change record istamper-proof (using
blockchain or similar).

Determine device
posture based oncomponents – forexample a device that
constantly connects
and disconnects.

Indicators ofachievement
A log of device
component changes
exists.

Indicators ofachievement
A log of device
component changes
exists and available
over time.

Indicators ofachievement
Device monitoring is
implemented to trackcomponent behavior.

Device Scope
Considerations

Table 3-9: Asset, Change and Configuration Management

3.9

PHYSICAL PROTECTION PRACTICE
Physical Protection

This practice’s policies address the physical security and safety of the premises, its people and its systems to prevent
theft and ensure the ongoing safe operation of equipment.

Industry Scope
Considerations

ComprehensivenessLevel 1 (Minimum)

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

ComprehensivenessLevel 4 (Formalized)

What needs to be

What needs to be

What needs to be

What needs to be

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Physical Protection
done to achieve thislevel
Protect equipment
minimally using Key
locks on doors. Shared
PIN or combinations
are used.
Indicators ofachievement
Key access ismanaged, and PINs
and combinations are
documented anddistributed toappropriate
personnel.
Upon personnel
departure or rolechange keys must be
returned and locks
changed.

done to achieve thislevel

done to achieve thislevel

Track device
Follow practices forcomponent changes
PCI.
through manual
Track sealed tamper
logging.
evident seals in a
Securely attach
database.
devices to fixtures
Use video surveillance(e.g., PIN pad to cashmonitoring or accesswrap counter).
control (or both) to
Devices are tampermonitor physicalevident seals areaccess to restrictedvisually inspected daily
areas (PCI-DSS).
for tampering.
Employees use a
Sensors are placed on
unique PIN/Badge
gates and doors andbased access.
anti-theft tags areplaced on high value,
Indicators ofor easily removable,
achievement
assets.
Anti-theft tags areTechnology isadded to store fixtures
deployed for video(shelf tags, PDAs,
surveillance andscanners, etc.)
tracking of tamperevident seals.
Indicators ofachievement
Tags are found on all
relevant devices, andprocedures forinspection are
documented.
Access is disabled
upon personnel orrole changes andpersonnel are forced
to change passwords
and PINs
intermittently.

Device Scope
Considerations

What needs to bedone to achieve thislevel
Protect card-reading
devices that capture
payment card data via

done to achieve thislevel
Use integrated device
alarm sensors forcovers and doors.
Segmented andrestricted badge/card
access for employees
to facility (time/role
based).
Deploy video Analytics
based alarming.
Indicators ofachievement
Technology is
deployed for video
analytics, integrated
sensors andbadge/card
segmentation.

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Physical Protection
direct physicalinteraction with thecard from tamperingand substitution (PCIDSS).
Indicators ofachievement
PCI use is
documented.

Table 3-10: Physical Protection

3.10 PROTECTION MODEL AND POLICY FOR DATA PRACTICE
Protection Model and Policy for Data
This practice identifies whether different categories of data exist and considers the specific objectives and rules fordata protection.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

ComprehensivenessLevel 4 (Formalized)

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Consider regulatory
guidelines relevant toretailers including:
PCIThe Open Web
Application Security
Project (OWASP)
HIPPA
GDPR
Children’s Online
Privacy Protection Act(COPPA)
Reward program agreements to early
identification prior tocheckout (mobile,
WiFi, IoT, video
analytics, othersensors)
Global Rules Engine
for Privacy Policies

Blacklist and wipe a
device when it leaves
the premises so it is
not useable if reintroduced.

Manage PII andsensitive data basedon consent,
transparency, data
minimization, use
limitations andconsider reuse andretention policies.
Indicators ofachievement
Data use policies are
documented andfollowed.

Indicators ofachievement
Procedures for device
deactivation are
documented andfollowed.

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Protection Model and Policy for Data
Indicators ofachievement
Complete set of
documents verifying
and assuring
compliance withsecurity-related
requirements.
Device Scope
Considerations

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Encryption ofprivileged informationsuch as credit card
numbers, credentials
and information used
to connect todatabase. Manage
keys and keep
equipment up to date.

Follow practices for
PCI-DSS
Indicators ofachievement
PCI-DSS use is
documented.

Indicators ofachievement
The identified
information is
encrypted.

Table 3-11: Protection Model and Policy for Data

3.11 IMPLEMENTATION OF DATA PROTECTION PRACTICES PRACTICE
Implementation of Data Protection Practices
This practice describes the preferred application of data protection mechanisms to address confidentiality, integrity
and availability.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Implement data
quality and integrity.
Encrypt privileged

Consider regulatory
guidelines andassociatedComprehensivenessLevel 4 (Formalized)

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Implementation of Data Protection Practices
information such as
credit card numbers.
Deploy practices forkey management.
Deploy signed
firmware images withhash checking.
Indicators ofachievement
Procedures for data
quality and integrityand key management
are documented.
Procedures for thesigned images
deployment are
documented.

frameworks relevant
to retailers including:
PCI (for payment
systems), HIPPA (forpharmacies andHR/employee data),
HiTrust Common
Security Framework(for HIPPA).
Follow general bestpractices and PCI-DSS
related to minimal
data collection andminimal retention
periods.
Follow Quarterly
Process to identify andsecurely delete
cardholder data held
beyond retention
period (PCI-DSS)
Ensure reward
programs managed by
3rd parties (such as
early identification
prior to checkout)
follow the required
regulations.
Indicators ofachievement
Procedures are
documented andcertifications areprovided for internaland 3rd party
compliance.

Device Scope
Considerations

What needs to bedone to achieve thislevel
Follow PCI practices
from PCI-DSS, PA-DSS,
PTS.
Indicators ofachievement

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Implementation of Data Protection Practices
PC practice use (PCIDSS, PA-DSS, PTS) is
documented.

Table 3-12: Implementation of Data Protection Practices

3.12 VULNERABILITY ASSESSMENT PRACTICE
Vulnerability Assessment
This practice helps identify vulnerabilities, determine the risk that each vulnerability places on the organization anddevelop a prioritized remediation plan.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Deploy signed
firmware images withhash checking.

Track device
component changes.
logging

Indicators ofachievement

Indicators ofachievement

Procedures for thesigned images
deployment are
documented.

A log exists ofcomponent changes.

ComprehensivenessLevel 4 (Formalized)

Device Scope
Considerations

Table 3-13: Vulnerability Assessment

3.13 PATCH MANAGEMENT PRACTICE
There are no retail-specific system- or device-scope considerations for the patch management
practice.
Patch Management
This practice clarifies when and how frequently to apply the software patches, sets up procedures for emergency
patches and proposes additional mitigations in the instance of constrained access to the system or other issues
involved with patching.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

ComprehensivenessLevel 4 (Formalized)

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Patch Management
Device Scope
Considerations

Table 3-14: Patch Management

3.14 MONITORING PRACTICE
Monitoring PracticeThis practice is used to monitor the state of the system, identify anomalies and aid in dispute resolution.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Deploy signed
firmware images withhash checking.

Follow practices for
PCI
Review on daily basis
logs of critical systemcomponents, thosethat perform security
functions, security
event logs, and logs ofsystem componentsthat store, process, ortransmit Cardholder
Data and/or Sensitive
Authentication Data
(PCI-DSS).
Include software andapplications in logmonitoring processes.

Indicators ofachievement
Procedures for thesigned images
deployment are
documented.

Indicators ofachievement
Processes are
documented.
Device Scope
Considerations

Review logs of systemcomponents that
store, process, ortransmit Cardholder
Data or Sensitive
Authentication Data
(PCI-DSS) daily.
Periodically inspect
card-reading device

ComprehensivenessLevel 4 (Formalized)

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Monitoring Practicesurfaces to detect
tampering (forexample, addition ofcard skimmers to
devices), or
substitution (forexample, by checking
the serial number orother device
characteristics toverify it has not beenswapped with afraudulent device).
(PCI-DSS).
Similarly, for reviewing
fiscal devices (e.g.,
fiscal printers).

Table 3-15: Monitoring Practice3.15 SITUATIONAL AWARENESS AND INFORMATION SHARING PRACTICE
Situational Awareness and Information Sharing
This practice helps organizations be better prepared to respond to threats. Sharing threat information keeps
systems up to date.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

ComprehensivenessLevel 4 (Formalized)

What needs to bedone to achieve thislevel
Follow practices forsharing breach
information from
GDPR and otherregulations.
Indicators ofachievement
Processes are
documented.

Device Scope
Considerations

Table 3-16: Situational Awareness and Information Sharing PracticeIoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

3.16 EVENT DETECTION AND RESPONSE PLAN PRACTICE
Event Detection and Response Plan
This practice defines what a security event is and how to detect and assign events for investigation, escalate themas needed and respond appropriately. It should also include a communications plan for sharing information
appropriately and in a timely manner with stakeholders.
ComprehensivenessLevel 1 (Minimum)

ComprehensivenessLevel 2 (Ad Hoc)

Industry Scope
Considerations

ComprehensivenessLevel 3 (Consistent)

ComprehensivenessLevel 4 (Formalized)

What needs to bedone to achieve thislevel
Follow practices for
PCI.

Device Scope
Considerations

Implement automatedaudit trails for all
system components toreconstruct thefollowing events: All
individual user
accesses to cardholder
data; All actions taken
by any individual withroot or administrative
privileges and others
noted in (PCI-DSS).

Table 3-17: Event Detection and Response Plan

3.17 REMEDIATION, RECOVERY AND CONTINUITY OF OPERATIONS PRACTICE
Remediation, Recovery and Continuity of Operations
This practice is a combination of technical redundancies whereby trained staff and business continuity policy help anorganization recover quickly from an event to expedite returning to business as usual.
ComprehensivenessLevel 1 (Minimum)
Industry Scope
Considerations

ComprehensivenessLevel 2 (Ad Hoc)

ComprehensivenessLevel 3 (Consistent)

ComprehensivenessLevel 4 (Formalized)

What needs to bedone to achieve thislevel

What needs to bedone to achieve thislevel

Retailers require
offline functionality
for a determined
period of time (1-day)for business-critical

Fallback gracefully to
selected (lower) levelof security whenoffline.

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables

Remediation, Recovery and Continuity of Operations
functionality.

Indicators ofachievement

Indicators ofachievement

Process for fallback to
a selected level of
Offline capabilities are security when offline
deployed and well
are documented anddocumented.
implemented.
Device Scope
Considerations

Table 3-18: Remediation, Recovery and Continuity of Operations

Annex A ACRONYMS
CAPECCommon Attack Pattern Enumeration and Classification

IIC

Industrial Internet Consortium

IIRA

Industrial Internet Reference Architecture

IISF

Industrial Internet Security Framework

IoT

Internet of Things

IT

Information Technology

OT

Operational Technology

OWASP

Open Web Application Security ProjectIoT SMM: Retail Profile for Point-of-Sale Devices Profile Tables

Annex B DEFINITIONS
The following terms, specific to the context of the SMM, are defined here:
Security Level: Security Level is a measure of confidence that the system is free of vulnerabilities
and functions in an intended manner.
Security Maturity: Security Maturity is a measure of an understanding of the current Security
Level, its necessity, benefits, and cost of its support.
Domain: Domains are the strategic level priorities for security maturity. In the SMM, there arethree domains: Governance, Enablement, and Hardening.
Sub Domain: Sub Domains refer to the basic means to address a domain at the planning level.
Each domain currently defines three sub domains.
Security Practice: Practices are the typical activities performed for a given sub domain; they
provide the deeper detail necessary for planning. Each sub domain has a set of practices.
Comprehensiveness: The model defines comprehensiveness levels as a measure of theComprehensiveness, consistent, and highly assured implementation of measures supporting thesecurity maturity domain, sub domain or practice.
Scope: The model defines scope as a measure for the customized, technically appropriate
approach to the implementation of measures supporting the security maturity domain, subdomain or practice, and fitting the needs and constraints of IoT sector or system.
Security Maturity Target: The Security Maturity Target is the desired “end state” Security
Maturity for an organization or system. The Security Maturity Target can apply to a new system
under development or an existing brownfield system. The Security Maturity Target is determinedbased upon the business objectives of the organization or group.
Industrial Internet Consortium: (IIC) an open membership, international not-for-profit
consortium that is setting the architectural framework and direction for the Industrial Internet.
Founded by AT&T, Cisco, GE, IBM and Intel in March 2014, the consortium’s mission is tocoordinate vast ecosystem initiatives to connect and integrate objects with people, processes
and data using common architectures, interoperability and open standards.

Annex C REFERENCES[ARTS-CYBERP2015] ARTS Cybersecurity Primer, December 2015, retrieved 2020-02-25
https://www.omg.org/cgi-bin/doc?retail/2019-02-06[ARTS-DATAP2015] ARTS Data Privacy Primer, December 2015, retrieved 2020-02-25
https://www.omg.org/cgi-bin/doc?retail/2019-02-07[ARTS-DATA2017] ARTS Privacy and Security Data, January 2017, retrieved 2020-02-25
https://www.omg.org/cgi-bin/doc?retail/2019-02-08

IoT SMM: Retail Profile for Point-of-Sale Devices

3: Profile Tables[IEC-62443-33]

IEC 62443-3-3:2013, Industrial communication networks - Network andsystem security - Part 3-3: System security requirements and security levels,
2013
https://webstore.iec.ch/publication/7033[IIC-IIRA2019]

Industrial Internet Consortium: The Industrial Internet, Volume G1:
Reference Architecture Technical Report, version 1.9, 2019-06-19, retrieved
2020-04-29
https://www.iiconsortium.org/IIRA.htm[IIC-IIV2019]

Industrial Internet Consortium: The Industrial Internet, Volume G8:
Vocabulary Technical Report, version 2.2, 2019-11-06, retrieved 2020-01-24
https://www.iiconsortium.org/vocab/index.htm[IIC-IISF2016]

Industrial Internet Consortium: The Industrial Internet of Things Volume G4:
Security Framework Version 1.0, 2016-September-26
http://www.iiconsortium.org/IISF.htm[IIC-SMMD2020] Industrial Internet Consortium: IoT Security Maturity Model: Description andIntended Use, version 1.2, 2020-05-05, retrieved 2020-05-05
https://www.iiconsortium.org/pdf/SMM_Description_and_Intended_Use_V1.
2.pdf[IIC-SMMP2020] Industrial Internet Consortium: IoT Security Maturity Model: Practitioner’s
Guide, Version 1.2, 2020-05-05, retrieved 202-05-05
https://www.iiconsortium.org/pdf/IoT_SMM_Practitioner_Guide_2020-0505.pdf[PCI-DSS]

Payment Card Industry Security Standards Council. (2018). Payment Card
Industry Data Security Standard. Version 3.2.1. Retrieved fromhttps://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf[PCI-PADSS]

Payment Card Industry Security Standards Council. (2018). Payment Card
Industry Payment Application Data Security Standard. Version 3.0. November
2013. Retrieved 19 May 2020 fromhttps://www.pcisecuritystandards.org/minisite/en/docs/PA-DSS_v3.pdf[PCI-PTS]

Payment Card Industry Security Standards Council. (2018). Payment Card
Industry PIN Transaction Security (PTS) Point of Interaction (POI). Version
4.0. June 2013. Retrieved 19 May 2020 fromhttps://www.pcisecuritystandards.org/documents/PCI_PTS_POI_SRs_v4_Final.pdf[PCI-MON]

Information Supplement: Effective Daily Log Monitoring, May 2016. PCI
Security Standards Council.
https://www.pcisecuritystandards.org/documents/Effective-Daily-LogMonitoring-Guidance.pdf

IoT SMM: Retail Profile for Point-of-Sale Devices[RFC 2119]

3: Profile Tables

S. Bradner. IETF. "Key Words for Use in RFCs To Indicate Requirement
Levels." March 1997. Best Current Practice. https://ietf.org/rfc/rfc2119.txt

Annex D AUTHORS AND LEGAL NOTICEThis document is a joint work product of the OMG Retail Task group chaired by Andy Mattice(Lexmark), Leonid Rubhakin (Aptos) and the Industrial Internet Consortium Security Applicability
Task Group, co-chaired by Ron Zahavi (Microsoft) and Jim Clardy (NetFoundry).
Authors: The following persons contributed substantial written content to this document:
Frederick Hirsch (Upham Security), Andy Mattice (Lexmark), Bart McGlothin (Cisco), Leonid
Rubhakin (Aptos), Ekaterina Rudina (Kaspersky), and Ron Zahavi (Microsoft).
Technical Editor: Stephen Mellor (IIC staff) oversaw the process of organizing the contributionsof the above Authors and Contributors into an integrated document.

Copyright© 2018-2020 Industrial Internet Consortium, a program of Object Management Group,
Inc. (“OMG”).
All copying, distribution and use are subject to the limited License, Permission, Disclaimer andother terms stated in the Industrial Internet Consortium Use of Information – Terms, Conditions& Notices, as posted at www.iiconsortium.org/legal/index. If you do not accept these Terms, you
are not permitted to use the document.