Withdrawn Draft
Warning Notice
The attached draft document has been withdrawn and is provided solely for historical purposes.
It has been followed by the document identified below.
Withdrawal Date September 10, 2024
Original Release Date April 17, 2024

The attached draft document is followed by:
Status Final
Series/Number NIST IR 8425A
Title Recommended Cybersecurity Requirements for Consumer-Grade
Router Products
Publication Date September 2024
DOI https://doi.org/10.6028/NIST.IR.8425A
CSRC URL https://csrc.nist.gov/pubs/ir/8425/a/final
Additional Information https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurityiot-program

NIST Internal Report
NIST IR 8425A ipd

Recommended Cybersecurity
Requirements for Consumer-Grade
Router Products
Initial Public Draft
Michael Fagan
Katerina Megas
Paul Watrobski
Jeffrey Marron
Barbara CuthillDavid Lemire
Brad Hoehn
Chris Evans
This publication is available free of charge from:https://doi.org/10.6028/NIST.IR.8425A.ipd

NIST Internal Report
NIST IR 8425A ipd

Recommended Cybersecurity
Requirements for Consumer-Grade
Router Products
Initial Public Draft
Michael Fagan
Katerina Megas
Paul Watrobski
Jeffrey Marron
Barbara CuthillDavid Lemire
Brad Hoehn
Chris Evans
HII

Applied Cybersecurity Division
Information Technology Lab

This publication is available free of charge from:https://doi.org/10.6028/NIST.IR.8425A.ipd
April 2024

U.S. Department of Commerce
Gina M. Raimondo, Secretary
National Institute of Standards and Technology
Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

1
2
3
4

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified
in this paper in order to specify the experimental procedure adequately. Such identification does not imply
recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or
equipment identified are necessarily the best available for the purpose.

5
6
7
8
9
10

There may be references in this publication to other publications currently under development by NIST in
accordance with its assigned statutory responsibilities. The information in this publication, including concepts andmethodologies, may be used by federal agencies even before the completion of such companion publications.
Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist,
remain operative. For planning and transition purposes, federal agencies may wish to closely follow thedevelopment of these new publications by NIST.

11
12
13

Organizations are encouraged to review all draft publications during public comment periods and provide feedback
to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available athttps://csrc.nist.gov/publications.

14
15
16

NIST Technical Series Policies
Copyright, Use, and Licensing Statements
NIST Technical Series Publication Identifier Syntax

17
18

Publication History
Approved by the NIST Editorial Review Board on YYYY-MM-DD [Will be added in final release of publication]

19
20
21
22
23

How to Cite this NIST Technical Series Publication:
Fagan M, Megas K, Watrobski P, Marron J, Cuthill B, Lemire D, Hoehn B, Evans C (2024) Recommended
Cybersecurity Requirements for Consumer-Grade Router Products. (National Institute of Standards andTechnology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8425A ipd.
https://doi.org/10.6028/NIST.IR.8425A.ipd

24
25
26
27
28
29

Author ORCID iDs
Michael Fagan: 0000-0002-1861-2609
Katerina N. Megas: 0000-0002-2815-5448
Paul Watrobski: 0000-0002-6449-3030
Jeffrey Marron: 0000-0002-7871-683X
Barbara B. Cuthill: 0000-0002-2588-6165

30
31

Public Comment Period
April 17, 2024 – May 17, 2024

32
33
34
35
36
37

Submit Comments
iotsecurity@nist.gov
National Institute of Standards and Technology
Attn: Applied Cybersecurity Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

38

All comments are subject to release under the Freedom of Information Act (FOIA).

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

39

Abstract

40
41
42
43
44
45
46

Ensuring the security of routers is crucial for safeguarding not only individuals’ data but also theintegrity and availability of entire networks. With the increasing prevalence of smart home IoT
devices and remote work setups, the significance of consumer-grade router cybersecurity has
expanded, as these devices and applications often rely on routers in the home to connect to theinternet. This report presents the consumer-grade router profile, which includes cybersecurity
outcomes for consumer-grade router products and associated requirements from router
standards.

47

Keywords

48

cybersecurity; consumer-grade routers; network security; Internet of Things

49

Reports on Computer Systems Technology

50
51
52
53
54
55
56
57

The Information Technology Laboratory (ITL) at the National Institute of Standards andTechnology (NIST) promotes the U.S. economy and public welfare by providing technicalleadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test
methods, reference data, proof of concept implementations, and technical analyses to advancethe development and productive use of technology. ITL’s responsibilities include thedevelopment of management, administrative, technical, and physical standards and guidelines
for the cost-effective security and privacy of other than national security-related information infederal information systems.

58iNIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

59

Audience

60
61
62
63

The intended audience for this report consists of manufacturers of consumer-grade router
products (especially product security officers), internet service providers, retailers, and testing
and certification bodies interested in establishing minimum cybersecurity requirements for
consumer-grade routers.

64

Note to Reviewers

65
66
67
68
69
70
71
72
73
74
75

On July 18th, 2023, the White House announced the next steps for the Cybersecurity Labeling
Program for Smart Devices to Protect American Consumers, referred to as the “U.S. Cyber Trust
Mark.” [WHAnnouncement] In addition to announcing participation by the Federal
Communications Commission and Departments of Energy and State, the White House also
directed NIST to “immediately undertake an effort to define cybersecurity requirements for
consumer-grade routers—a higher-risk type of product that, if compromised, can be used toeavesdrop, steal passwords, and attack other devices and high value networks.” In response,
NIST worked to develop these requirements with a standards-based, transparent, communityinvolved process. NIST welcomes any feedback on this draft. In particular, we seek any
recommendations of standards or guidance that can apply to consumer-grade routers and seek
feedback about the cybersecurity techniques discussed in Section 2.1 and noted in Appendix A.

ii

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

76

Call for Patent Claims

77
78
79
80
81
82
83

This public review includes a call for information on essential patent claims (claims whose use
would be required for compliance with the guidance or requirements in this Information
Technology Laboratory (ITL) draft publication). Such guidance and/or requirements may bedirectly stated in this ITL Publication or by reference to another publication. This call also
includes disclosure, where known, of the existence of pending U.S. or foreign patentapplications relating to this ITL draft publication and of any relevant unexpired U.S. or foreign
patents.

84
85

ITL may require from the patent holder, or a party authorized to make assurances on its behalf,in written or electronic form, either:8687a) assurance in the form of a general disclaimer to the effect that such party does not holdand does not currently intend holding any essential patent claim(s); or

88
89
90

b) assurance that a license to such essential patent claim(s) will be made available toapplicants desiring to utilize the license for the purpose of complying with the guidanceor requirements in this ITL draft publication either:

91
92

i.

under reasonable terms and conditions that are demonstrably free of any unfair
discrimination; or

93
94

ii.

without compensation and under reasonable terms and conditions that aredemonstrably free of any unfair discrimination.

95
96
97
98
99

Such assurance shall indicate that the patent holder (or third party authorized to makeassurances on its behalf) will include in any documents transferring ownership of patents
subject to the assurance, provisions sufficient to ensure that the commitments in the assurance
are binding on the transferee, and that the transferee will similarly include appropriate
provisions in the event of future transfers with the goal of binding each successor-in-interest.

100
101

The assurance shall also indicate that it is intended to be binding on successors-in-interest
regardless of whether such provisions are included in the relevant transfer documents.

102

Such statements should be addressed to: iotsecurity@nist.gov

103

iii

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

104

Table of Contents

105

1. Introduction ...................................................................................................................................1106

2. Scope of Consumer-Grade Routers .................................................................................................4

107
108

3. Conclusion .....................................................................................................................................7

109

References.........................................................................................................................................8

110
111

Appendix A. Crosswalk between Technical Outcomes and Consumer-Grade Router Cybersecurity andFirmware Requirements ...................................................................................................................11

112
113
114
115
116
117
118
119

Appendix B. Non-Technical Outcome Considerations ........................................................................20120

Appendix C. Consumer-Grade Router Acquisition Scenarios Discussion .............................................23

121
122

Appendix D. Crosswalk Between Secure Software Development Tasks and Consumer-Grade Router
Product Software Type .....................................................................................................................25

123

Appendix E. List of Symbols, Abbreviations, and Acronyms ...............................................................29

124

Appendix F. Glossary ........................................................................................................................30

125

List of Tables

126
127

Table 1. Non-technical cybersecurity outcomes and requirements from consumer-grade router
standards ........................................................................................................................................20

128

Table 2. Scope Coverage of the Consumer-Grade Router Standards Analyzed ....................................23

129

Table 3. Crosswalk between consumer-grade router product software types and SSDF tasks. ............ 25

130

List of Figures

131

Fig. 1. Most requirements from the four consumer-grade router standards do not repeat ...................2

132
133

Fig. 2. Recommended guidance documents and standards support cybersecurity outcomes for all partsof consumer-grade router products throughout their development lifecycle. ......................................3

134
135

Fig. 3. An example consumer-grade router product that includes a smartphone application andbackend server in addition to the router device. .................................................................................4

136

iv

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

137

1. Introduction

138
139
140
141
142
143
144
145
146
147
148
149
150
151

Router cybersecurity is of paramount importance in today's interconnected world, where digitalcommunication plays a central role in both personal and professional spheres. Routers serve as
the gatekeepers of our networks, managing the flow of data between devices in the home oroffice and the internet. A compromised router opens the door to a host of potential exploitedvulnerabilities and impacts, ranging from unauthorized access, sensitive information
dissemination, to the possibility of malicious attacks on connected devices. Ensuring thesecurity of routers is crucial for safeguarding not only individual privacy and safety, but also theintegrity and availability of entire networks. With the increasing prevalence of smart home IoT
devices and remote work setups, the significance of consumer-grade router cybersecurity has
expanded, as these devices and applications often rely on routers in the home to connect to theinternet. A secure home router (i.e., one that is consumer-grade) not only protects U.S. citizens
against data theft and other cyberattacks but also contributes to the overall resilience of the
global digital infrastructure. As technology advances, the need for robust router cybersecurity
becomes ever more critical to maintain a safe and trustworthy digital environment.

152
153
154
155
156
157
158
159
160
161
162
163
164
165

This report presents the consumer-grade router profile, which recommends cybersecurity
outcomes for consumer-grade router products and associated requirements from consumergrade router standards. This profile was developed starting from the outcomes defined for
consumer IoT products in Profile of the IoT Core Baseline for Consumer IoT Products, NISTIR
8425 [IR8425]. Though developed for consumer IoT products the NISTIR 8425 outcomes areimportant cybersecurity guidance for any digital product. Outcomes can be technical (i.e.,
implemented through hardware and/or software) or non-technical (i.e., implemented asprocedures and processes by organizations or individuals). In this context, outcomes are broad,flexible guidelines that can apply, albeit differently, to different use cases and contexts, while
requirements are targeted specifications that can define meeting an outcome for a specific use
case, context, technology, etc. The guidance in this document has been developed uniquely for
consumer-grade routers using cybersecurity considerations and standards specific to that
product type. NIST recommends the use of the following standards for the cybersecurity of
consumer-grade router products:

166
167

1. Broadband Forum (BBF) TR-124 Issue 8 – Functional Requirements for Broadband
Residential Gateway Devices [BBF]168

2. CableLabs (CL) Security Gateway Device Security Best Common Practices [CableLabs]

169
170

3. Federal Office for Information Security (BSI) TR-03148: Secure Broadband Router Requirements for secure Broadband Routers [BSI]

171
172

4. Infocomm Media Development Authority (IMDA) Technical Specification Security
Requirements for Residential Gateways [IMDA]

173

5. Platform Firmware Resiliency Guidelines, SP 800-193 [SP800-193]

174
175

6. Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations,
SP 800-161 Rev. 1 [SP800-161r1]

1

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

176
177

7. Secure Software Development Framework (SSDF) Version 1.1: Recommendations for
Mitigating the Risk of Software Vulnerabilities, SP 800-218 [SSDF]

178
179

8. Information technology — Security techniques — Vulnerability disclosure processes,
ISO/IEC 29147 [ISO29147]

180
181

9. Information technology — Security techniques — Vulnerability handling, ISO/IEC 30111[ISO30111]

182

10. Risk management — Guidelines, ISO 31000 [ISO31000]

183
184

11. Systems and software engineering — Design and development of information for users,
ISO/IEC/IEEE 26514 [ISO26514]

185
186
187
188
189
190
191
192
193
194

NIST recommends the use of four existing consumer-grade router standards 1 (i.e., items 1
through 4 in the list above). Requirements from the standards for consumer-grade routers
focused primarily on the router device, discussing many cybersecurity capabilities appropriate
for this equipment. Figure 1 notionally 2 depicts that requirements of the four consumer-graderouter device standards were mostly unique and had minimal overlap. Few requirements fromthe different standards repeat, and each standard’s requirements offer useful details about
how cybersecurity outcomes can be met by consumer-grade router devices. Additional
technical requirements for firmware are introduced by SP 800-193 (i.e., item 5). Appendix A
provides a crosswalk between technical cybersecurity outcomes for consumer-grade router
products and the technical requirements from these five standards.

195
196

Fig. 1. Most requirements from the four consumer-grade router standards do not repeat.

197
198
199

The requirements from the four router standards address technical cybersecurity for consumergrade router devices but not the non-technical cybersecurity outcomes nor cybersecurity for
product components other than the router device (e.g., backend, mobile application) since they
1 These standards primarily focused on technical capabilities for router devices. The Broadband Forum (BBF) TR-124 Issue 8 standard includes
requirements outside of the purview of cybersecurity, while the other three standards focused exclusively on cybersecurity requirements. All
cybersecurity requirements were examined to create the consumer-grade router profile. Non-cybersecurity requirements from the BBF
standard were not analyzed as part of the profiling process.
2 The overlap between standards in the graphic is not necessarily equal or proportional to the true overlap (i.e., the number of requirements
between each standard that are the same or otherwise redundant).

2

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

200
201
202
203
204

contain few requirements for non-technical supporting capabilities and no requirements forother product components (e.g., mobile application). Therefore, additional standards (i.e.,
items 6 through 11) are recommended to help fill some of those gaps in the consumer-graderouter standards, particularly for non-technical outcomes. Appendix B discusses some
additional considerations and guidance for non-technical outcomes.

205
206
207
208
209
210
211
212
213
214
215
216

This list is intended as a minimum starting point and may not address all the cybersecurity
considerations for every consumer-grade router product. Full support of all outcomes in thisprofile by all consumer-grade router product components is expected. To ensure cybersecurity
consideration of all consumer-grade router product components, the Product Development
Cybersecurity Handbook [CSWP33] is recommended in addition to the standards indicatedabove. If a consumer-grade router product has additional product components, such as a smart
phone mobile application, additional technical product cybersecurity capability requirements
would also be necessary to meet the outcomes for the complete consumer-grade router
product. These considerations are discussed generally for digital products in the handbook.
Figure 2 shows how the standards listed above relate to cybersecurity outcomes (i.e., thetechnical vs. non-technical outcomes) and components of consumer-grade router products (i.e.,
consumer-grade router device vs. other consumer-grade router product components).

217
218
219

Fig. 2. Recommended guidance documents and standards support cybersecurity outcomes for all parts ofconsumer-grade router products throughout their development lifecycle.

220
221

The rest of this document provides additional discussion of cybersecurity context andexpectations related to consumer-grade router products, structured as follows:

222•

Section 2 states the recommended scope of consumer-grade router products.

223•

Section 3 concludes the document.

3

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

224

2. Scope of Consumer-Grade Routers

225
226
227
228
229
230

This profile identifies minimum cybersecurity for consumer-grade routers. Consumer-graderouters are defined as networking devices which are primarily intended for residential use andcan be installed by the customer. Routers forward data packets, most commonly Internet
Protocol (IP) packets, between networked systems. The profile makes no distinction in its
cybersecurity recommendations with regards to whether the product is owned by thecustomer or leased from an internet service provider.

231
232
233
234
235
236

The cybersecurity outcomes defined in this profile are valuable to manufacturers ofconsumer-grade routers regardless of how their products end up in a customer’s home.
Routers leased from an internet service provider may be managed in part by both thecustomer and provider. Even in this scenario, the recommended requirements in thisprofile would be useful to both customers and providers in securing routers. Additional
discussion related to this scope can be found in Appendix C.

237
238
239
240
241

Cybersecurity outcomes and requirements for products should be scoped to all productcomponents (e.g., smartphone applications) developed to be used with the router device.
Third-party applications are not generally considered in the product’s scope, unless designatedby the product manufacturer as such. Figure 3 below shows an example consumer-grade router
product where the router device is supported by both a backend and smartphone application.

242
243
244

Fig. 3. An example consumer-grade router product that includes a smartphone application and backend server in
addition to the router device.

245
246
247
248
249
250

Firmware is a critical foundation of many digital products, including consumer-grade routersand other consumer-grade router product components. Given the central role consumer-graderouters play in home networks, firmware vulnerabilities pose significant cybersecurity concerns.
Other software that can access consumer-grade router data and manage the product (e.g.,mobile applications or remote backends) also create attack vectors for home consumers if not
appropriately mitigated in software and through the software development process.

4

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

251

2.1. Cybersecurity Utilizing the Full Product

252
253
254
255
256

The standards referenced in Section 1, particularly the four that are specific to consumer-graderouters reflect general, minimal cybersecurity for this equipment. Manufacturers of consumergrade router products should look beyond these technical requirements for cybersecurity
features. The following concepts are examples of emerging techniques that may help improvethe cybersecurity provided by consumer-grade routers and of the products themselves:

257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291

•

•

•

Machine-readable asset identification support from consumer-grade router products.
Consumer-grade routers serve as a central connection point for networks, where many
types of devices will gain access to the local network and usually internet. These devices
having machine-readable asset identifiers that are utilized by consumer-grade routers
can enable more proactive cybersecurity management of the network through better
identification and inventory of connected devices. Home users could utilize thesefeatures, but they are more likely to be useful to small businesses or for routers leased
from internet service providers (ISPs), where ISPs may make use of this information.
Identification can also go beyond simple inventorying when extended by concepts likedevice intent signaling (e.g., the “manufacturer usage description” [MUD]). Machinereadable asset identifiers must be developed and used in ways that is privacy
preserving, particularly if they are to be used by organizations (e.g., ISPs) to help protect
the cybersecurity of individuals.
Interface and functionality minimization for consumer-grade router devices. “Secureby-design” principles [SecureByDesign] applied to consumer-grade routers should guidemanufacturers to minimize the number of interfaces and general functionality provided
by the consumer-grade router device. The purpose of this product component should beto perform routing capabilities. Extraneous functions should not be included in thiscomponent. For example, configuration may be better managed by another consumergrade router product component (e.g., mobile application). This is not to suggest a
consumer-grade router product composed of only a consumer-grade router device isnecessarily less secure than those that can offload functions to other components. Thatsaid, in the case there is only a consumer-grade router device, the cybersecurity
capabilities of that component should be reasonably maximized.
Robust network onboarding support from consumer-grade router product.
Cybersecurity when provisioning new devices to the networks of consumer-graderouters can go beyond a single password. When a consumer-grade router product iscomposed of components such as mobile applications or backends, those components
can be used as part of a more robust onboarding mechanism. For example, when adevice is attempting to connect to the consumer-grade router device with (or without)the password, the mobile application can notify the owner and ask for explicit approval
for the device to onboard. Though reliability needs to be considered to ensure
individuals can always access and use their routers, onboarding mechanisms for
consumer-grade routers that give individuals more access control over their networks isbeneficial.

5

NIST IR 8425A ipd (Initial Public Draft)April 2024

292
293
294
295
296
297
298
299

•

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

Multiple signatures for software update packages when possible. At a minimum, allsoftware update packages should be signed by the source of the update (e.g.,
manufacturer), but when applicable (e.g., when routers are leased from ISPs) otherentities may also cryptographically sign updates, adding another layer of security.

Several of these examples highlight ways consumer-grade router products can take advantage
of all product components to deliver cybersecurity capabilities. These and other cybersecurity
techniques should be considered by manufacturers to continually improve the cybersecurity of
consumer-grade routers as risks shift and new mitigations become available.

6

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

300

3. Conclusion

301
302
303
304
305
306
307
308
309
310

This consumer-grade router profile can help manufacturers determine adequate cybersecurity
to develop into their products. These recommendations draw from current effective practices
and promote adoption of accepted and vetted cybersecurity for consumer-grade routers. As
with any NIST report, as the referenced standards and effective practices change over time,
NIST may revisit this document and revise it. NIST welcomes ongoing feedback andrecommendations from the community as to standards and effective practices and solutions for
consumer-grade routers. That said, NIST encourages readers to identify if the standards
referenced here have been updated asynchronously from this report. NIST reiterates theimportance of a product-wide perspective to develop a comprehensive approach to providing
cybersecurity for consumer-grade router products.

7

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

311

References

312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352

[WHAnnouncement] White House (2023) Biden-⁠Harris Administration Announces Cybersecurity
Labeling Program for Smart Devices to Protect American Consumers. (White House,
Washington, DC). https://www.whitehouse.gov/briefing-room/statementsreleases/2023/07/18/biden-harris-administration-announces-cybersecurity-labelingprogram-for-smart-devices-to-protect-american-consumers/[IR8425] Fagan M, Megas KN, Watrobski P, Marron J, Cuthill B (2022) Profile of the IoT Core
Baseline for Consumer IoT Products. (National Institute of Standards and Technology,
Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8425.
https://doi.org/10.6028/NIST.IR.8425[BBF] Walls, J, Editor (2022) Functional Requirements for Broadband Residential Gateway
Devices. (Broadband Forum, Fremont, CA), Technical Report (TR) 124, Issue 8.
https://www.broadband-forum.org/resources/tr-124-issue-8-functional-requirements-forbroadband-residential-gateway-devices[CableLabs] CableLabs Security (2021) Gateway Device Security Best Common Practices.
(CableLabs, Louisville, CO), CL-GL-GDS-BCP-V01-211007.
https://community.cablelabs.com/wiki/plugins/servlet/cablelabs/alfresco/download?id=1
209eea3-bd81-40cb-9a18-21bd6cfcd80d[BSI] Federal Office for Information Security (2023) Secure Broadband Router: Requirements for
Secure Broadband Routers. (Federal Office for Information Security, Bonn, Germany), BSI
Technical Report (TR) 03148. https://www.bsi.bund.de/EN/Themen/Unternehmen-undOrganisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Themasortiert/tr03148/tr-03148.html[IMDA] Info-communications Media Development Authority of Singapore (2020) Security
Requirements for Residential Gateways. (Info-communications Media Development
Authority, Singapore), IMDA Technical Specification (TS) RG-SEC.
https://www.imda.gov.sg/-/media/imda/files/regulation-licensing-and-consultations/ictstandards/telecommunication-standards/radio-comms/imda-ts-rg-sec.pdf[SP800-193] Regenscheid, AR (2018) Platform Firmware Resiliency Guidelines. (National
Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP)
800-193. https://doi.org/10.6028/NIST.SP.800-193[SP800-161r1] Boyens JM, Smith AM, Bartol N, Winkler K, Holbrook A, Fallon M (2022)
Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special
Publication (SP) 800-161r1. https://doi.org/10.6028/NIST.SP.800-161r1[SSDF] Souppaya MP, Scarfone KA, Dodson DF (2022) Secure Software Development Framework(SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special
Publication (SP) 800-218. https://doi.org/10.6028/NIST.SP.800-218[ISO29147] International Organization for Standardization (2018) Information technology —Security techniques — Vulnerability disclosure. (ISO Standard No. 29147:2018).
https://www.iso.org/standard/72311.html

8

NIST IR 8425A ipd (Initial Public Draft)April 2024

353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products[ISO30111] International Organization for Standardization (2019) Information technology —Security techniques — Vulnerability handling processes. (ISO Standard No. 30111:2019).
https://www.iso.org/standard/69725.html[ISO31000] International Organization for Standardization (2018) Risk management —Guidelines. (ISO Standard No. 31000:2018). https://www.iso.org/standard/65694.html[ISO26514] International Organization for Standardization (2022) Systems and software
engineering — Design and development of information for users. (ISO Standard No.
26514:2022). https://www.iso.org/standard/77451.html[CSWP33] Fagan M, Megas KN, Watrobski P, Marron J, Cuthill B, Lemire D, Hoehn B (2024).
Product Development Cybersecurity Handbook: Concepts and Considerations for IoT
Product Manufacturers. (National Institute of Standards and Technology, Gaithersburg,
MD), Draft NIST Cybersecurity White Paper (CSWP) 33.
https://doi.org/10.6028/NIST.CSWP.33.ipd[SecureByDesign] Cybersecurity and Infrastructure Security Agency (2023). Secure-by-Design
Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design
Software. (Cybersecurity and Infrastructure Security, Washington, DC).
https://www.cisa.gov/sites/default/files/2023-10/SecureByDesign_1025_508c.pdf[MUD] Lear E, Droms R, Romascano D (2019) Manufacturer Usage Description Specification.
(Internet Engineering Taskforce), IETF Request for Comments (RFC) 8520.
https://datatracker.ietf.org/doc/html/rfc8520[SP800-40r4] Souppaya MP, Scarfone KA (2022) Guide to Enterprise Patch Management
Planning: Preventive Maintenance for Technology. (National Institute of Standards andTechnology, Gaithersburg, MD), NIST Special Publication (SP) 800-40, Rev. 4.
https://doi.org/10.6028/NIST.SP.800-40r4[RFC6092] Woodyatt, J, Editor (2011) Recommended Simple Security Capabilities inCustomer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service.
(Internet Engineering Task Force), IETF Request for Comment (RFC) 6092.
https://datatracker.ietf.org/doc/html/rfc6092[IR8320] Bartock MJ, Souppaya MP, Savino R, Knoll T, Shetty U, Cherfaoui M, Yeluri R, Malhotra
A, Banks D, Jordan M, Pendarakis D, Rao JR, Romness P, Scarfone KA (2022) HardwareEnabled Security: Enabling a Layered Approach to Platform Security for Cloud and Edge
Computing Use Cases. (National Institute of Standards and Technology, Gaithersburg, MD),NIST Interagency or Internal Report (IR) 8320. https://doi.org/10.6028/NIST.IR.8320[SP800-37r2] Joint Task Force (2018) Risk Management Framework for Information Systems
and Organizations: A System Life Cycle Approach for Security and Privacy. (National
Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP)
800-37, Rev. 2. https://doi.org/10.6028/NIST.SP.800-37r2[RFC6092] Woodyatt J, Ed. (2011) Recommended Simple Security Capabilities in Customer
Premises Equipment (CPE) for Providing Residential IPv6 Internet Service. (Internet
Engineering Taskforce), IETF Request for Comments (RFC) 6029.
https://datatracker.ietf.org/doc/rfc6092/[ParksRouterResearch] Parks Associates (2022) Parks Associates: 52% of Consumers Acquired
Their Routers From Their ISP. (PRNewswire, Dallas, TX).

9

NIST IR 8425A ipd (Initial Public Draft)April 2024

396
397

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

https://www.prnewswire.com/news-releases/parks-associates-52-of-consumers-acquiredtheir-routers-from-their-isp-301593338.html

10NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

398
399

Appendix A. Crosswalk between Technical Outcomes and Consumer-Grade Router
Cybersecurity and Firmware Requirements

400
401

This Appendix provides additional information about how the requirements from the fourrouter standards relate to the consumer-grade router profile outcomes.

402
403
404
405
406
407
408

Sections A.1 to A.7 below show which requirements from the four consumer-grade router
standards are related to the technical outcomes for consumer-grade routers. Each subsection
from A.1 to A.7 states the high-level outcome along with each sub-outcome that defines thehigh-level outcome. The language for the consumer-grade router profile cybersecurity
outcomes was developed by modifying the outcomes from NISTIR 8425. Two new suboutcomes were also added based on review of the consumer-grade router standards, notedwith a †.

409
410

For each sub-outcome, a set of related requirements from the four consumer-grade router
standards is also included. The abbreviations used for the standards are:411

BBF’s TR-124 Issue 8 [BBF]412

CL’s Security Gateway Device Security Best Common Practices [CableLabs]

413

BSI’s Secure Broadband Routers [BSI]414

IMDA’s Security Requirements for Residential Gateways [IMDA]

415
416
417
418
419
420

In the development of firmware for consumer-grade routers and their components, NIST
recommends the use of Special Publication 800-193 [SP800-193]. Section 4 of that document
details technical cybersecurity capabilities to help mitigate firmware vulnerabilities. These
capabilities are supportive of the outcomes for consumer-grade router products defined in thisdocument. Thus, in addition to the four consumer-grade router standards, requirements from
Section 4 of SP 800-193 are also included in the following sub-sections when applicable.

421
422
423
424

Finally, for some outcomes and sub-outcomes, commentary is also included indicating example
cybersecurity enhancements of consumer-grade router products that may go beyond what isreflected in the current standards or may not be applicable to all consumer-grade router
products, but should be considered by consumer-grade router product manufacturers.

425

A.1. Asset Identification

426
427

The consumer-grade router product is uniquely identifiable and inventories all of the consumergrade router product’s components.

428

A.1.1. Asset Identification 1

429
430
431

The consumer-grade router product can be uniquely identified by the customer and otherauthorized entities via means including but not limited to: host name, service set identifier(SSID), and serial number.

432

Related Standards Requirements:

11

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

433

BBF GEN.DESIGN.12, GEN.DESIGN.13, MGMT.LOCAL.20, IF.LAN.WIRELESS.AP.20434

CL OOB-011, KEY-006, OOB-007

435

BSI (3.1.2.1)

436

IMDA None

437

A.1.2. Asset Identification 2

438
439

The consumer-grade router product uniquely identifies each product component (e.g., routerdevice, mobile app) and maintains an up-to-date inventory of connected product components.

440
441
442
443
444

No requirements from the consumer-grade router standards were mapped to this outcome.
Consumer-grade router products composed of only a consumer-grade router device would
natively meet this outcome. When a consumer-grade router product is composed of othercomponents (e.g., mobile application, backend), those components may need to support thisoutcome.

445
446
447
448
449

The asset identification outcome is focused on the ability to identify the consumer-graderouter and the router’s management of its product components, but routers may also
assist customers in managing their connected devices. Machine-readable asset identifiers
for all connected products could enable routers to use these identifiers for the purpose of
asset management in support of customers’ cybersecurity.

450

A.2. Product Configuration

451
452
453

The configuration of the consumer-grade router product is changeable, there is the ability torestore a secure default setting, and any and all changes can only be performed by authorizedindividuals, services, and other consumer-grade router product components.

454
455
456
457
458

Configuration control of networking equipment, including consumer-grade router
products is critical to network cybersecurity. If possible, configuration may be better
managed by another consumer-grade router product component (e.g., mobile
application) to minimize interfaces (and thus attack surface) of the consumer-graderouter device specifically.

459

A.2.3. Product Configuration 1

460
461
462
463
464

Utilizing strong authentication mechanisms (e.g., multi-factor authentication), authenticatedand authorized individuals (e.g., customer, ISP), services, and other consumer-grade router
product components can access the consumer-grade router product’s configuration interfaces(e.g., administration page) and change the configuration settings of the consumer-grade router
product via one or more consumer-grade router product components.

465

Related Standards Requirements:

466

BBF MGMT.LOCAL.2

12

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products467

CL OOB-007, DE-007, MI-002, MI-010, MI-011

468

BSI (3.1.2) (4), (4.1.1), (4.1.2), (4.2), (4.3), (4.4), (4.5), (4.8), (4.9), (4.10)

469

IMDA 4.2, 4.2.3, 4.4

470

A.2.4. Product Configuration 2

471
472
473
474

Authorized individuals (i.e., customer), services, and other consumer-grade router productcomponents have the ability to restore (i.e., factory reset) the consumer-grade router productto a secure default (i.e., uninitialized) configuration. In restoring the product to a securedefault, all settings and data must be deleted.

475

Related Standards Requirements:

476

BBF MGMT.LOCAL.10

477

CL OOB-009, DE-003, DE-004, DE-006

478

BSI (4.6)

479

IMDA 4.1.1, 4.2.1, 4.2.3

480

SP 800-193 4.2.4(5), 4.4.2(5)481

A.2.5. Product Configuration 3

482
483

The consumer-grade router product applies configuration settings to applicable consumergrade router components.

484
485
486
487
488

No requirements from the consumer-grade router standards were mapped to this outcome.
Consumer-grade router products composed of only a consumer-grade router device would
natively meet this outcome via configuration on that component. When a consumer-graderouter product is composed of other components (e.g., mobile application, backend), thosecomponents may need to support this outcome.

489

A.3. Data Protection

490
491
492
493

The consumer-grade router product protects data stored across all consumer-grade router
product components and transmitted both between consumer-grade router productcomponents and outside the consumer-grade router product from unauthorized access,disclosure, and modification using strong encryption (e.g., FIPS 140-3 compliant modules).

494

A.3.6. Data Protection 1

495
496
497
498

Each consumer-grade router product component protects data it stores via secure means, suchas strong encryption (e.g., FIPS 140 Rev. 3 compliant modules). All stored data, including data
used for authentication (e.g., salting and hashing stored passwords or passphrases) must be
protected. Critical data (including firmware images) can be securely backed up and recovered.

13

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

499

Related Standards Requirements:

500

BBF SEC.FIRMWARE.2

501

CL DRP-001, KEY-001, KEY-002, KEY-003, HR-003, HR-004, SB-005, OOB-002

502

BSI (4.1.1)

503

IMDA 4.5504
505

SP 800-193 4.1.1(1-4, 7), 4.1.4(1-2), 4.2.2, 4.2.3(1-2), 4.2.4(5), 4.4.1 (1, 2a, 7, 12),4.4.2(1-2, 4, 6-8, 10)506

A.3.7. Data Protection 2

507
508

The consumer-grade router product has the ability to delete or render inaccessible stored datathat are either collected from or about the customer, home, family, etc.

509

Related Standards Requirements:

510

BBF None511

CL OOB-009

512

BSI (4.6)

513

IMDA 4.2.3

514

A.3.8. Data Protection 3

515
516
517
518
519

When data are sent between consumer-grade router product components or outside theproduct, strong protections (e.g., FIPS 140-3 compliant encryption modules) are used for thedata transmission. This includes using HTTP over TLS for external communications via theconsumer-grade router product and for using device management interfaces or web portals forconfiguration management.

520

Related Standards Requirements:

521
522

BBF MGMT.REMOTE.WEB.6, SEC.USERINTERFACE.1, SEC.FIRMWARE.1,
SEC.FIRMWARE.2523

CL OOB-003, DE-002, DE-004, DE-005, MI-001, NETS-001, NETS-003, SBOM-006

524

BSI (3.1.2.2), (4.1.1), (4.1.2), (4.4), (4.10)

525

IMDA 4.2.2, 4.2.5

14

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

526

A.4. Interface Access Control 1

527
528

Each consumer-grade router product component controls access to and from all interfaces3 inorder to limit access to only authorized entities.

529

A.4.9. Interface Access Control 1a

530
531
532

Use and have access only to interfaces necessary for the consumer-grade router product’s
operation. All other channels and access to channels are removed or secured. For example,
disable by default remote access to the router, especially via the WAN interface.

533

Related Standards Requirements:

534
535
536

BBF MGMT.LOCAL.1, MGMT.REMOTE.WEB.1, MGMT.REMOTE.WEB.5,
MGMT.REMOTE.WEB.12, MGMT.REMOTE.WEB.13, SEC.GEN.5, SEC.GEN.6, SEC.GEN.10,
SEC.GEN.11, SEC.USERINTERFACE.8

537

CL HR-001, HR-002, OOB-005, MI-003, NETS-004, NETS-005, MI-011

538

BSI (3), (3.1), (3.1.2), (3.2), (4.1.1)

539

IMDA 4.2, 4.2.1

540

SP 800-193 4.2.1.2

541
542
543
544
545

Interfaces should be minimized for the consumer-grade router product overall, butparticularly attention should be given to minimizing the interfaces included on the
consumer-grade router devices. Extraneous interfaces unnecessary to the core featuresof the router device should be implemented via other consumer-grade router products,
be turned off by default, or be removed entirely.

546

A.4.10. Interface Access Control 1b

547
548

For all interfaces necessary for the consumer-grade router product’s use, access control
measures are in place. 4 At a minimum this includes:

549
550
551

1. Assigning consumer-grade router products unique initial passwords that are required to
be changed to a strong password or passphrase upon installation. Support for
multifactor authentication is recommended.

552

2. Placing a timeout limit on account sessions.

553
554

3. Protecting against authentication brute force attacks (e.g., limiting failed log-in
attempts).

555
556

4. Making physical developer interface ports inaccessible from the outside of acomponent.
Interfaces are a boundary between the IoT device and entities where interactions take place. This includes digital or network interfaces, aswell as local interfaces, such as graphical user interfaces.
4 IETF RFC6092 Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet
Service [RFC6092] is a relevant source for more specific guidance related to IPv6 interface cybersecurity.
3

15

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

557

5. Ensuring closed ports are not revealed during scans.

558
559

6. Prohibiting the reply to requests over a port for an API or Protocol that doesn't use that
port.

560

Related Standards Requirements 5:

561
562
563
564
565

BBF GEN.DESIGN.14, GEN.OPS.21, MGMT.LOCAL.1, MGMT.LOCAL.5, MGMT.LOCAL.11,
MGMT.REMOTE.WEB.2, MGMT.REMOTE.WEB.9, IF.LAN.WIRELESS.AP.20, SEC.GEN.1,
SEC.GEN.8, SEC.USERINTERFACE.2, SEC.USERINTERFACE.3, SEC.USERINTERFACE.4,
SEC.USERINTERFACE.5, SEC.USERINTERFACE.6, SEC.USERINTERFACE.7,
SEC.USERINTERFACE.9

566
567
568

CL OOB-001, OOB-004, OOB-006, OOB-008, OOB-010, OOB-012, MI-004, MI-007, MI008, MI-009, MI-010, MI-013, DIAG-002, NETS-007, NETS-008, NETA-001, NETA-002,
NETA-003, MI-002

569

BSI (3.1), (3.1.2.1), (3.2), (4.1.1), (4.4)

570

IMDA 4.1.1, 4.1.2, 4.2, 4.2.1

571

SP 800-193 4.1.1(5), 4.2.4(3-4)

572
573
574
575
576

Control of access to the consumer-grade router’s network is critical to the cybersecurity it
provides to customers. Generally, on-boarding to the consumer-grade router’s network
uses a single factor, password-based authentication method (e.g., WPA key). This onboarding process can incorporate explicit network owner approval or some otheradditional factor to reduce unauthorized access to the network.

577

A.4.11. Interface Access Control 1c

578
579
580

For all interfaces, access and modification privileges are limited. For example, access to theadministration page and changes to the configuration should be limited to authenticated users
authorized to make such changes.

581

Related Standards Requirements:

582

BBF MGMT.REMOTE.WEB.3, MGMT.REMOTE.WEB.4, SEC.GEN.7

583

CL MI-006

584

BSI (3.1), (3.1.2), (3.2)

585

IMDA 4.2

586

SP 800-193 4.2.3(3), 4.2.4(1)5 IMDA 4.1.2 discusses password requirements, as does BSI (4.1.1). IMDA’s requirement is more stringent than BSIs (i.e., minimum password

character length of 10 versus 8) and is recommended by the BSI requirement.

16

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

587

A.5. Interface Access Control 2

588
589

Some, but not necessarily all, consumer-grade router product components have the means toprotect and maintain interface access control.

590

A.5.12. Interface Access Control 2a

591
592
593

Validate data received by the consumer-grade router product and validate that data shared
among consumer-grade router product components match specified definitions of format andcontent.

594

Related Standards Requirements:

595

BBF None596

CL MI-012, NETS-006

597

BSI None

598

IMDA 4.6

599

SP 800-193 4.1.1(6, 8), 4.2.4(2)600

A.5.13. Interface Access Control 2b

601

Prevent unauthorized transmissions or access to other product components.

602

Related Standards Requirements:

603

BBF WAN.DoS.1, WAN.DoS.2, WAN.DoS.3, WAN.DoS.4, WAN.DoS.5604

CL MI-005, NETS-006

605

BSI (3.1.2), (4.3), (4.7), (4.9)

606

IMDA 4.2.1

607

A.5.14. Interface Access Control 2c

608
609

Maintain appropriate access control during initial connection (i.e., onboarding) and whenreestablishing connectivity after disconnection or outage.

610

Related Standards Requirements:

611

BBF None612

CL None613

BSI (3.1.2.3), (3.2)

614

IMDA 4.1.1, 4.2, 4.2.1

17

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

615

A.6. Software Update

616
617
618
619

The software (including firmware) of all consumer-grade router product components can be
updated by authenticated and authorized individuals, services, and other consumer-graderouter product components only by using a secure and configurable mechanism, as appropriate
for each consumer-grade router product component.

620

A.6.15. Software Update 1

621
622

Each consumer-grade router product component can receive, verify, and apply verified
software updates that are signed and firmware updates that are signed and encrypted.

623

Related Standards Requirements:

624

BBF GEN.OPS.22, GEN.OPS.23

625

CL KEY-004, KEY-005, SB-001, SU-001, SU-005, SBOM-009, SB-002, SU-003

626

BSI (4.2)

627

IMDA 4.3

628

SP 800-193 4.1.1(4), 4.1.2(1-4), 4.2.1.1, 4.2.1.2(1), 4.2.4(3, 5), 4.3.1(2), 4.4.1(2-6)

629
630
631

All software update packages should be signed by the source of the update (e.g.,
manufacturer), but when applicable (e.g., when routers are leased from ISPs) otherentities may also cryptographically sign updates, adding another layer of security.

632

A.6.16. Software Update 2

633
634
635
636
637

The consumer-grade router product implements measures to keep software (including
firmware) on consumer-grade router product components up to date (i.e., automatic
application of updates or consistent customer notification of available updates via consumergrade router components), including provisions to prevent firmware rollback attacks (e.g., notallowing the rollback of firmware to a version with known vulnerabilities).

638

Related Standards Requirements:

639

BBF GEN.OPS.19, GEN.OPS.20, MGMT.LOCAL.15, MGMT.LOCAL.21, MGMT.LOCAL.22640

CL SB-003, SU-002, SU-006, SBOM-003, SBOM-007, SBOM-008, SBOM-010

641

BSI (4.1.2), (4.2)

642IMDA 4.3643

SP 800-193 4.1.2(5), 4.2.1.3, 4.4.1(1, 10, 11, 13)644

A.6.17. Software Update 3†

645
646

Integrity of data, including configuration, is preserved when an update is applied. In the case ofa failed update, the product should revert to a usable state.
18

NIST IR 8425A ipd (Initial Public Draft)April 2024

647

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

Related Standards Requirements:

648

BBF GEN.OPS.15, GEN.OPS.24

649

CL SU-004

650

BSI None

651

IMDA None652

SP 800-193 4.3.1(3)653

A.7. Cybersecurity State Awareness

654
655

The consumer-grade router product supports detection of cybersecurity incidents affecting or
affected by consumer-grade router product components and the data they store and transmit.

656

A.7.18. Cybersecurity State Awareness 1

657
658
659
660
661
662

The consumer-grade router product securely captures and records information about the stateof consumer-grade router components that can be used to detect cybersecurity incidents
affecting or affected by consumer-grade router product components and the data they store
and transmit. Information that the consumer-grade router product shall provide includes login
attempts, administrative events, system status, firewall status, status of all consumer-graderouter product components, other connected products, and timing synchronization.

663

Related Standards Requirements:

664

BBF GEN.OPS.18, LAN.FW.2, LAN.FW.3, LAN.FW.4, MGMT.LOCAL.18, MGMT.LOCAL.20

665

CL SB-004, LOG-001, LOG-002, LOG-003, LOG-004, LOG-005, SB-002, TS-001

666

BSI (4.1.2), (4.8)

667

IMDA None668

SP 800-193 4.1.1(4), 4.1.3, 4.3.1(1, 5), 4.3.2(1-2, 4), 4.4.1(8), 4.4.2(3)669

A.7.19. Cybersecurity State Awareness 2†

670
671

The consumer-grade router product informs authorized entities about or responds directly tochanges in cybersecurity information.

672

Related Standards Requirements:

673

BBF GEN.OPS.6

674

CL AR-002

675

BSI None

676

IMDA None677

SP 800-193 4.1.3(3), 4.3.1(2-4, 6), 4.3.2(3, 5-6), 4.4.1(9, 11), 4.4.2(9)19NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

678

Appendix B. Non-Technical Outcome Considerations

679
680
681

Table 1 below states the non-technical cybersecurity outcomes NIST has defined for the
consumer-grade router profile with the requirements from the four consumer-grade router
standards that related to these outcomes.

682

Table 1. Non-technical cybersecurity outcomes and requirements from consumer-grade router standards
Consumer-Grade Router Profile Non-Technical Outcome

Related Requirements

Documentation
The consumer-grade router product developer creates, gathers, and storesinformation relevant to cybersecurity of the consumer-grade router productand its product components prior to customer purchase, and throughout thedevelopment of a product and its subsequent lifecycle.
Information and Query Reception
The consumer-grade router product developer has the ability to receive
information relevant to cybersecurity and respond to queries from thecustomer and others about information relevant to cybersecurity.
Information Dissemination
The consumer-grade router product developer broadcasts (e.g., to the public)
and distributes (e.g., to the customer or others in the consumer-grade router
product ecosystem) information relevant to cybersecurity.
Education and AwarenessThe consumer-grade router product developer creates awareness of andeducates customers and others in the consumer-grade router productecosystem about cybersecurity-related information (e.g., considerations,features, risks) related to the consumer-grade router product and its productcomponents.

CL HR-005, MI-014,
DIAG-001, SBOM-004,
SBOM-005-

CL AR-001, SBOM-011
BSI (4.2)
IMDA 4.3e
-

683
684
685
686
687
688
689
690
691
692
693
694
695
696
697

The standards do not thoroughly address the non-technical outcomes, but NIST reiterates that
consumer-grade router products should be supported by all the non-technical outcomes
included in this profile. Implementation of non-technical outcomes may not have to be tailored
for a product type (i.e., consumer-grade routers) and may be deployed similarly for different
digital products. For example, a vulnerability management program is not likely to varysignificantly in implementation for consumer-grade routers, smart thermostats, personal
computers, etc. Thus, product-agnostic approaches to the non-technical outcomes as discussed
in the Product Development Cybersecurity Handbook are recommended in addition to the nontechnical requirements included in the four consumer-grade router standards. The handbook
guides a developer through important cybersecurity considerations when developing digitalproducts. Though the handbook is generally contextualized around IoT products, the concepts
discussed can apply to any digital product with a physical component in the customer’s
environment (e.g., consumer-grade router device). There are many non-technical cybersecurity
considerations discussed in the handbook, but the following are key considerations for
consumer-grade router products given the role these devices play in home networks:

698
699
700

Risk management in both planning and execution of consumer-grade router products
will help identify and mitigate cybersecurity risks throughout the product lifecycle. Risks
faced by consumer-grade router products can be significant. Consumer-grade router

20

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

701
702
703
704
705
706
707
708
709

devices have a unique vantage and access to home networks. They also have robust
networking capabilities, giving them utility for a wide range of attacks. Other consumergrade router product components present their own risks. Backends may aggregate
data from one or more customers, making them attractive targets for attackers. Mobile
applications may be installed in relatively hostile environments due to malware andother vectors of attack. ISO 31000 [ISO31000] is a foundational resource that developers
should use for risk management. NIST’s Risk Management Framework for Information
Systems and Organizations: A System Life Cycle Approach for Security and Privacy, SP
800-37 Rev. 2 [SP800-37r2] may also be useful guidance for risk management.

710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727

Secure development processes for both hardware and software are also critical for the
cybersecurity of consumer-grade router products. Hardware-Enabled Security: Enablinga Layered Approach to Platform Security for Cloud and Edge Computing Use Cases,
NISTIR 8320 [IR8320] may be a helpful resource for consumer-grade router productdevelopers as they consider hardware in relation the cybersecurity of their products. A
recommended resource available to all software developers is NIST’s Secure Software
Development Framework [SSDF], which includes fundamental, sound, and secure
software development practices. The SSDF can help a software developer align andprioritize its secure software development activities with its business and mission
requirements, risk tolerances, and resources. Like NISTIR 8425, the SSDF’s practices areoutcome-based. The SSDF’s practices, tasks, and implementation examples represent a
starting point to consider. In the context of consumer-grade router products, all SSDF
practices are recommended to be implemented as part of the software development
lifecycle of a consumer-grade router products’ firmware and other software. Some SSDF
practices may be more applicable to certain types of software. Appendix B presents a
detailed crosswalk listing all SSDF tasks and their applicability to three kinds of firmware
or software commonly part of consumer-grade router products: router firmware,
mobile applications, remote backend or web applications.

728
729
730
731
732
733
734
735
736
737

Vulnerability management is critical for consumer-grade router products and isaddressed by portions of all four non-technical cybersecurity outcomes. Manufacturers
should develop a robust vulnerability management plan for their products that will
identify vulnerabilities to quickly and effectively mitigate them in their products. For
this, they should use ISO/IEC 29147 [ISO29147] and ISO/IEC 30111 [ISO30111], which
are important resources for vulnerability disclosure and handling, respectively. From
NIST, Guide to Enterprise Patch Management Planning: Preventive Maintenance forTechnology, SP 800-40 Rev. 4 [SP800-40r4] can also be a helpful resource for consumergrade router product developers as they plan for, discover, prioritize, and respond tovulnerabilities in their products.

738
739
740
741

Customer engagement on cybersecurity, which is called Education and Awareness inthe non-technical outcomes, facilitates use of technical cybersecurity features andadoption of good cybersecurity by customers. ISO/IEC/IEEE 26514 [ISO26514] provides
guidance on the design and development of information for users, which may be helpful

21

NIST IR 8425A ipd (Initial Public Draft)April 2024

742
743
744
745
746
747
748
749

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

to and is recommended for consumer-grade router product developers as they create
the manual and other materials for the device that a customer may seek out forcybersecurity instructions related to the product.
These are highlighted considerations. Manufacturers should implement robust non-technicalcybersecurity support that includes all aspects of documenting cybersecurity pertinent
information, establishing means to receive and disseminate cybersecurity pertinent information
related to the product, and fostering cybersecurity education and awareness among customers
related to the product.

22

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

750

Appendix C. Consumer-Grade Router Acquisition Scenarios Discussion

751
752
753
754
755
756
757
758

Routers are network devices that forward data packets, most commonly Internet Protocol (IP)packets, between networked systems. They may be wired (e.g., Ethernet), wireless (e.g., Wi-Fi),or both. Consumer-grade identifies those routers that may appear in an individual’s residence
such that their primary use case is residential rather than enterprise, industrial, etc. However,some small businesses may choose to use consumer grade equipment given the limited
performance needs of those businesses. The presumption for consumer equipment, or small
businesses that use consumer grade equipment, is that the manufacturer cannot assume theuser has cybersecurity expertise or an ability to take significant action to secure the product.

759

Consumer-grade routers may be acquired by households in at least two ways 6:760

1. Purchase of the equipment directly from a retailer.

761

2. Bundling and/or renting of the equipment from a service provider.

762
763
764
765

Each of these scenarios may have implications for how cybersecurity outcomes could be met by
the consumer-grade router product. Consumer-owned equipment may be fully managed by thehousehold or may have some security services provided externally. Alternatively, bundled
and/or rental equipment will likely be managed in part by the service provider.

766

Table 2. Scope Coverage of the Consumer-Grade Router Standards Analyzed
Applicable to…
Consumer-Grade Router Standard

767

TR-124 Issue 8 [BBF]
Gateway Device Security Best Common Practices [CableLabs]
Secure Broadband Routers [BSI]
Security Requirements for Residential Gateways [IMDA]

ConsumerOwned Routers?
Yes
Yes
Yes
Yes

ISP-Owned, CustomerLeased Routers?
Yes
Yes
Yes
No

768
769
770

As summarized in Table 2, the scope statements of three of the four standards examined either
make no distinction about how the router is acquired by customers or state that the guidance
applies to both scenarios.

771
772
773
774
775
776
777

BBF does not distinguish between the two methods of acquisition, stating “a Residential
Gateway implementing the general requirements of TR-124 will incorporate at least one
embedded WAN interface, routing, bridging, a basic or enhanced firewall, one or multiple LANinterfaces and home networking functionality that can be deployed as a consumer selfinstallable device.” It notably highlights that included are products that can be deployed as“consumer self-installable,” which includes the customer purchased scenario, as well as most
instances of service provider supplied routers.

778
779
780

CableLabs directly acknowledges both scenarios: “This Gateway Device Security document
specifies best common practices to serve as an industry metric for retail and leased devices(both gateways and cable modems) for security—this includes manufacturing process, supply
6 As of 2022, about half of consumer-grade routers are received from ISPs rather than acquired by customers directly. [ParksRouterResearch]

23

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

781
782

chain, hardware and firmware configuration procedures, software, and management
protocols.”

783
784
785
786
787
788
789
790
791
792
793

The German Federal Office for Information Security (BSI) focuses its requirements on how the
product is used rather than acquired, stating “In scope of this Technical Guideline are
requirements on a router as a hardware component with an installed operating system andservices provided to an end-user. The router serves the purpose of establishing a connection to
the infrastructure of an Internet Access Provider (IAP) to gain internet access. From the enduser’s perspective the router offers a gateway to the internet as well as management
functionalities for the end-user’s private network. The Technical Guideline describes
requirements on the router that should be implemented to offer a secure operation of therouter for the end-user.” Thus, the requirements can be applied to the scenario of whencustomers purchase a router and when a router is provided by or rented from a service
provider.

794
795
796

Unlike the others, the IMDA alludes to a focus on only routers purchased by customers, statingthat the goal is “ensuring that these devices are better protected when purchased anddeployed by consumers.”

24

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

797
798

Appendix D. Crosswalk Between Secure Software Development Tasks and Consumer-Grade
Router Product Software Type

799
800
801
802
803

This appendix presents a informational crosswalk listing all SSDF tasks, copied directly from the
SSDF. To provide additional insight into NIST’s thinking of how the SSDF can be used in thecontext of consumer-grade routers, applicability of each SSDF task to three kinds of codecommonly part of consumer-grade router products: router firmware, mobile applications,remote backend or web applications.

804
805
806
807

•

Router firmware is a form of device firmware specific to consumer-grade router devices.
Device firmware generally is “the collection of non-host processor firmware andExpansion ROM firmware that is only used by a specific device. This firmware is typicallyprovided by the device manufacturer” [SP800-193].

808
809
810

•

Mobile applications are software intended to be installed and/or executed on small
profile platforms that can connect to cellular data networks. For example, applications
made to run on Apple’s iOS or Alphabet’s Android operating systems.

811
812
813
814

•

Remote backend or web applications are software intended to be hosted and executedon dedicated or shared servers that may provide services to many products at once. For
example, code supporting consumer-grade routers that is hosted in a cloudenvironment.

815
816
817

Table 3 below indicates which SSDF tasks may be most appropriate for each kind of firmware orsoftware. SSDF tasks that may be appropriate to a software type, but utilization of the task may
be contextual to the development process or environment are noted with (parentheses).

818

Table 3. Crosswalk between consumer-grade router product software types and SSDF tasks.
SSDF Task

Recommended for Router…

PO.1.1: Identify and document all security requirements for theorganization’s software development infrastructures and processes,
and maintain the requirements over time.

Firmware, Mobile App., Web App.

PO.1.2: Identify and document all security requirements fororganization-developed software to meet, and maintain therequirements over time.
PO.1.3: Communicate requirements to all third parties who will
provide commercial software components to the organization forreuse by the organization’s own software. [Formerly PW.3.1]
PO.2.1: Create new roles and alter responsibilities for existing roles asneeded to encompass all parts of the SDLC. Periodically review andmaintain the defined roles and responsibilities, updating them as
needed.
PO.2.2: Provide role-based training for all personnel withresponsibilities that contribute to secure development. Periodicallyreview personnel proficiency and role-based training, and update thetraining as needed.
PO.2.3: Obtain upper management or authorizing official
commitment to secure development, and convey that commitment to
all with development-related roles and responsibilities.

25

Firmware, Mobile App., Web App.

Firmware, Mobile App., Web App.

Firmware, Mobile App., Web App.

Firmware, Mobile App., Web App.

(Firmware), (Mobile App.), (WebApp.)

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

SSDF Task

Recommended for Router…

PO.3.1: Specify which tools or tool types must or should be includedin each toolchain to mitigate identified risks, as well as how thetoolchain components are to be integrated with each other.

Firmware, Mobile App., Web App.

PO.3.2: Follow recommended security practices to deploy, operate,
and maintain tools and toolchains.
PO.3.3: Configure tools to generate artifacts of their support of secure
software development practices as defined by the organization.
PO.4.1: Define criteria for software security checks and track
throughout the SDLC.
PO.4.2: Implement processes, mechanisms, etc. to gather andsafeguard the necessary information in support of the criteria.
PO.5.1: Separate and protect each environment involved in softwaredevelopment.
PO.5.2: Secure and harden development endpoints (i.e., endpoints forsoftware designers, developers, testers, builders, etc.) to perform
development-related tasks using a risk-based approach.
PS.1.1: Store all forms of code – including source code, executablecode, and configuration-as-code – based on the principle of leastprivilege so that only authorized personnel, tools, services, etc. haveaccess.
PS.2.1: Make software integrity verification information available tosoftware acquirers.
PS.3.1: Securely archive the necessary files and supporting data (e.g.,
integrity verification information, provenance data) to be retained foreach software release.

Firmware, Mobile App., Web App.
(Firmware), (Mobile App.), (WebApp.)
(Firmware), (Mobile App.), (WebApp.)
Firmware, Mobile App., Web App.
Firmware, Mobile App., Web App.
FirmwareFirmware, Mobile App., Web App.

(Web App.)Firmware, Mobile App.

PS.3.2: Collect, safeguard, maintain, and share provenance data for allcomponents of each software release (e.g., in a software bill ofmaterials).

Firmware, Mobile App.

PW.1.1: Use forms of risk modeling – such as threat modeling, attack
modeling, or attack surface mapping – to help assess the security risk
for the software.

Firmware, (Mobile App.), (WebApp.)

PW.1.2: Track and maintain the software’s security requirements,
risks, and design decisions.
PW.1.3: Where appropriate, build in support for using standardized
security features and services (e.g., enabling software to integratewith existing log management, identity management, access control,and vulnerability management systems) instead of creating
proprietary implementations of security features and services.
[Formerly PW.4.3]
PW.2.1: Have 1) a qualified person (or people) who were not involved
with the design and/or 2) automated processes instantiated in the
toolchain review the software design to confirm and enforce that itmeets all of the security requirements and satisfactorily addresses theidentified risk information.
PW.4.1: Acquire and maintain well-secured software components(e.g., software libraries, modules, middleware, frameworks) fromcommercial, open-source, and other third-party developers for use by
the organization’s software.

26

Firmware, Mobile App., Web App.

Firmware, Mobile App., Web App.

FirmwareFirmware, Mobile App., Web App.

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

SSDF Task

Recommended for Router…

PW.4.2: Create and maintain well-secured software components inhouse following SDLC processes to meet common internal softwaredevelopment needs that cannot be better met by third-party
software components.

Firmware, Mobile App., Web App.

PW.4.4: Verify that acquired commercial, open-source, and all otherthird-party software components comply with the requirements, as
defined by the organization, throughout their life cycles.

Firmware, Mobile App., Web App.

PW.5.1: Follow all secure coding practices that are appropriate to thedevelopment languages and environment to meet the organization’s
requirements.

Firmware, Mobile App., Web App.

PW.6.1: Use compiler, interpreter, and build tools that offer features
to improve executable security.
PW.6.2: Determine which compiler, interpreter, and build toolfeatures should be used and how each should be configured, thenimplement and use the approved configurations.

Firmware, Mobile App., Web App.
Firmware, Mobile App., Web App.

PW.7.1: Determine whether code review (a person looks directly at
the code to find issues) and/or code analysis (tools are used to findissues in code, either in a fully automated way or in conjunction witha person) should be used, as defined by the organization.

Firmware, Mobile App., Web App.

PW.7.2: Perform the code review and/or code analysis based on theorganization’s secure coding standards, and record and triage all
discovered issues and recommended remediations in thedevelopment team’s workflow or issue tracking system.

Firmware, Mobile App., Web App.

PW.8.1: Determine whether executable code testing should be
performed to find vulnerabilities not identified by previous reviews,
analysis, or testing and, if so, which types of testing should be used.

Firmware, Mobile App., Web App.

PW.8.2: Scope the testing, design the tests, perform the testing, anddocument the results, including recording and triaging all discovered
issues and recommended remediations in the development team’s
workflow or issue tracking system.

Firmware, (Mobile App.), (WebApp.)

PW.9.1: Define a secure baseline by determining how to configure
each setting that has an effect on security or a security-related setting
so that the default settings are secure and do not weaken the security
functions provided by the platform, network infrastructure, orservices.
PW.9.2: Implement the default settings (or groups of default settings,
if applicable), and document each setting for software administrators.
RV.1.1: Gather information from software acquirers, users, and public
sources on potential vulnerabilities in the software and third-party
components that the software uses, and investigate all credible
reports.
RV.1.2: Review, analyze, and/or test the software’s code to identify or
confirm the presence of previously undetected vulnerabilities.
RV.1.3: Have a policy that addresses vulnerability disclosure andremediation, and implement the roles, responsibilities, and processes
needed to support that policy.
RV.2.1: Analyze each vulnerability to gather sufficient information
about risk to plan its remediation or other risk response.

27

Firmware, Mobile App., Web App.

Firmware, Mobile App., Web App.
Firmware, Mobile App., Web App.
Firmware, Mobile App., Web App.
Firmware, Mobile App., Web App.
Firmware, Mobile App., Web App.

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

SSDF Task

Recommended for Router…

RV.2.2: Plan and implement risk responses for vulnerabilities.

Firmware, Mobile App., Web App.

RV.3.1: Analyze identified vulnerabilities to determine their root
causes.
RV.3.2: Analyze the root causes over time to identify patterns, such asa particular secure coding practice not being followed consistently.
RV.3.3: Review the software for similar vulnerabilities to eradicate aclass of vulnerabilities, and proactively fix them rather than waitingfor external reports.
RV.3.4: Review the SDLC process, and update it if appropriate toprevent (or reduce the likelihood of) the root cause recurring in
updates to the software or in new software that is created.

28

Firmware, Mobile App., Web App.
Firmware, Mobile App., Web App.
(Firmware), (Mobile App.), (WebApp.)
(Firmware), (Mobile App.), (WebApp.)

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

819

Appendix E. List of Symbols, Abbreviations, and Acronyms

820
821

BBF
Broadband Forum

822
823

BSI
Federal Office for Information Security

824
825

CL
CableLabs

826
827

IMDA
Infocomm Media Development Authority

828
829

IoT
Internet of Things

29

NIST IR 8425A ipd (Initial Public Draft)April 2024

Recommended Cybersecurity Requirements for
Consumer-Grade Router Products

830

Appendix F. Glossary

831
832
833

consumer-grade router device
Networking devices which are primarily intended for residential use and can be installed by the customer. Routers
forward data packets, most commonly Internet Protocol (IP) packets, between networked systems.

834
835
836

consumer-grade router productConsumer-grade router device and any additional product components (e.g., backend, smartphone application)that are necessary to use the consumer-grade router device beyond basic operational features. [IR8425, adapted]

837
838
839
840

cybersecurity outcome
Statement of what is expected either from a product or from an organization in support of a product related to thecybersecurity of that product. Can be technical, in the form of product cybersecurity capabilities or non-technical,
in the form of non-technical supporting capabilities.

841
842
843

non-technical supporting capability
Non-technical supporting capabilities are actions an organization performs in support of the cybersecurity of a
product. [IR8425, adapted]

844
845
846

product cybersecurity capability
Cybersecurity features or functions that computing devices provide through their own technical means (i.e., device
hardware and software). [IR8425]

30