1 NIST Internal Report

2 Publication Identifier

3 Recommended Cybersecurity 

4 Requirements for Consumer5 Grade Router Products

6 Second Preliminary Draft

7 Michael Fagan 

8 Katerina Megas 

9 Paul Watrobski 

10 Jeffrey Marron 

11 Barbara Cuthill

12 David Lemire

13 Brad Hoehn

14 Chris Evans

15
16 NIST Internal Report

17 Publication Identifier

18 Recommended Cybersecurity 

19 Requirements for Consumer20 Grade Router Products

21

22 Second Preliminary Draft

23 Michael Fagan 

24 Katerina Megas 

25 Paul Watrobski 

26 Jeffrey Marron 

27 Barbara Cuthill

28 Applied Cybersecurity Division

29 Information Technology Lab

30 David Lemire

31 Brad Hoehn

32 Chris Evans

33 HII

34

35 February 2024

36

37 U.S. Department of Commerce 

38 Gina M. Raimondo, Secretary

39 National Institute of Standards and Technology 

40 Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

41
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

ii

42 Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in 

43 this paper in order to specify the experimental procedure adequately. Such identification does not imply 

44 recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or 

45 equipment identified are necessarily the best available for the purpose.

46 There may be references in this publication to other publications currently under development by NIST in 

47 accordance with its assigned statutory responsibilities. The information in this publication, including concepts and 

48 methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, 

49 until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain 

50 operative. For planning and transition purposes, federal agencies may wish to closely follow the development of 

51 these new publications by NIST. 

52 Organizations are encouraged to review all draft publications during public comment periods and provide feedback 

53 to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at 

54 https://csrc.nist.gov/publications.

55 NIST Technical Series Policies

56 Copyright, Use, and Licensing Statements

57 NIST Technical Series Publication Identifier Syntax

58 Author ORCID iDs

59 Michael Fagan: 0000-0002-1861-2609 

60 Katerina N. Megas: 0000-0002-2815-5448 

61 Paul Watrobski: 0000-0002-6449-3030 

62 Jeffrey Marron: 0000-0002-7871-683X

63 Barbara B. Cuthill: 0000-0002-2588-6165

64 Preliminary Draft Release Period

65 February 15, 2024 to March 15, 2024

66 Submit Feedback and Comments

67 iotsecurity@nist.gov

68

69 National Institute of Standards and Technology

70 Attn: Applied Cybersecurity Division, Information Technology Laboratory

71 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

72 All comments are subject to release under the Freedom of Information Act (FOIA).

73 Abstract

74 Ensuring the security of routers is crucial for safeguarding not only individual privacy but also 

75 the integrity of entire networks. With the increasing prevalence of smart home IoT devices and 

76 remote work setups, the significance of consumer-grade router cybersecurity has expanded, as 

77 these devices and applications often rely on routers in the home to connect to the internet. This 

78 report presents the consumer-grade router profile, which includes cybersecurity outcomes for 

79 consumer-grade router products and associated requirements from router standards.
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

iii

80 Keywords

81 Cybersecurity; consumer-grade routers; network security; Internet of Things

82 Reports on Computer Systems Technology

83 The Information Technology Laboratory (ITL) at the National Institute of Standards and 

84 Technology (NIST) promotes the U.S. economy and public welfare by providing technical 

85 leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test 

86 methods, reference data, proof of concept implementations, and technical analyses to advance 

87 the development and productive use of information technology. ITL’s responsibilities include the 

88 development of management, administrative, technical, and physical standards and guidelines for 

89 the cost-effective security and privacy of other than national security-related information in 

90 federal information systems. 

91 Audience

92 The intended audience for this report consists of manufacturers of consumer-grade router

93 products (especially product security officers), internet service providers, retailers, and testing 

94 and certification bodies interested in establishing minimum cybersecurity requirements for 

95 consumer-grade routers.

96 Note to Reviewers

97 On July 18th, 2023, the White House announced the next steps for the Cybersecurity Labeling 

98 Program for Smart Devices to Protect American Consumers, referred to as the “U.S. Cyber Trust 

99 Mark.” [WHAnnouncement] In addition to announcing participation by the Federal 

100 Communications Commission and Departments of Energy and State, the White House also 

101 directed NIST to “immediately undertake an effort to define cybersecurity requirements for 

102 consumer-grade routers—a higher-risk type of product that, if compromised, can be used to 

103 eavesdrop, steal passwords, and attack other devices and high value networks.” In response, 

104 NIST worked to develop these requirements with a standards-based, transparent, community105 involved process. Two discussion essays, one including a standards crosswalk

106 [StandardsCrosswalk] were published for community feedback. This Second Preliminary Draft

NISTIR is based on an initial preliminary draft that was released in advance of a December 7th 107 , 

108 2023, discussion forum. NIST welcome feedback on this draft and particularly seeks any 

109 recommendations of standards or guidance that can apply to consumer-grade routers and seeks 

110 reviewers’ views on the appropriate requirements for default security configurations for 

111 consumer-grade routers provided to customers (see Appendix A, Section A.2). 

112 Comments and questions on this material should be directed to iotsecurity@nist.gov

113

114 Call for Patent Claims

115 This public review includes a call for information on essential patent claims (claims whose use 

116 would be required for compliance with the guidance or requirements in this Information 
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

iv

117 Technology Laboratory (ITL) draft publication). Such guidance and/or requirements may be 

118 directly stated in this ITL Publication or by reference to another publication. This call also 

119 includes disclosure, where known, of the existence of pending U.S. or foreign patent applications 

120 relating to this ITL draft publication and of any relevant unexpired U.S. or foreign patents.

121 ITL may require from the patent holder, or a party authorized to make assurances on its behalf, 

122 in written or electronic form, either:

123 a) assurance in the form of a general disclaimer to the effect that such party does not hold 

124 and does not currently intend holding any essential patent claim(s); or

125 b) assurance that a license to such essential patent claim(s) will be made available to 

126 applicants desiring to utilize the license for the purpose of complying with the guidance 

127 or requirements in this ITL draft publication either:

128 i. under reasonable terms and conditions that are demonstrably free of any unfair 

129 discrimination; or

130 ii. without compensation and under reasonable terms and conditions that are 

131 demonstrably free of any unfair discrimination.

132 Such assurance shall indicate that the patent holder (or third party authorized to make assurances 

133 on its behalf) will include in any documents transferring ownership of patents subject to the 

134 assurance, provisions sufficient to ensure that the commitments in the assurance are binding on 

135 the transferee, and that the transferee will similarly include appropriate provisions in the event of 

136 future transfers with the goal of binding each successor-in-interest.

137 The assurance shall also indicate that it is intended to be binding on successors-in-interest 

138 regardless of whether such provisions are included in the relevant transfer documents.

139 Such statements should be addressed to: iotsecurity@nist.gov

140
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

v

141 Table of Contents

142 Introduction ...................................................................................................................... 1

143 Scope of Consumer-Grade Routers................................................................................ 2

144 Conclusion........................................................................................................................ 3

145 References ............................................................................................................................... 4

146 Appendix A. Crosswalk between Technical Outcomes and Consumer-Grade Router 

147 Cybersecurity and Firmware Requirements........................................................................... 6

148 A.1. Asset Identification ..................................................................................................... 6

149 A.2. Product Configuration................................................................................................. 7

150 A.3. Data Protection........................................................................................................... 8

151 A.4. Interface Access Control 1.......................................................................................... 9

152 A.5. Interface Access Control 2.........................................................................................11

153 A.6. Software Update........................................................................................................12

154 A.7. Cybersecurity State Awareness.................................................................................13

155 Appendix B. Non-Technical Outcome Considerations......................................................13

156 Appendix C. Consumer-Grade Router Acquisition Scenarios Discussion......................16

157 Appendix D. Crosswalk Between Secure Software Development Tasks and Consumer158 Grade Router Product Software Type....................................................................................17

159 Appendix E. List of Symbols, Abbreviations, and Acronyms...........................................20

160 Appendix F. Glossary..........................................................................................................20

161 List of Tables

162 Table 1. Non-technical cybersecurity outcomes and requirements from consumer-grade router 

163 standards..................................................................................................................................14

164 Table 2. Scope Coverage of the Consumer-Grade Router Standards Analyzed.......................16

165 Table 3. Crosswalk between consumer-grade router product software types and SSDF tasks. 17

166 List of Figures

167 Fig. 1. An example consumer-grade router product that includes a smartphone application and 

168 backend server in addition to the router device. ......................................................................... 3

169
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

1

170 Introduction

171 Router cybersecurity is of paramount importance in today's interconnected world, where digital 

172 communication plays a central role in both personal and professional spheres. Routers serve as 

173 the gatekeepers of our networks, managing the flow of data between other devices and the 

174 internet. A compromised router opens the door to a host of potential threats, ranging from 

175 unauthorized access to sensitive information to the possibility of malicious attacks on connected 

176 devices. Ensuring the security of routers is crucial for safeguarding not only individual privacy 

177 and safety but also the integrity of entire networks. With the increasing prevalence of smart 

178 home IoT devices and remote work setups, the significance of consumer-grade router 

179 cybersecurity has expanded, as these devices and applications often rely on routers in the home

180 to connect to the internet. A secure home router (i.e., one that is consumer-grade) not only 

181 protects U.S. citizens against data theft and other cyberattacks but also contributes to the overall 

182 resilience of the global digital infrastructure. As technology advances, the need for robust router 

183 cybersecurity becomes ever more critical to maintain a safe and trustworthy digital environment.

184 This report presents the consumer-grade router profile, which recommends cybersecurity 

185 outcomes for consumer-grade router products and associated requirements from consumer-grade 

186 router standards. This profile was developed starting from the outcomes defined for consumer 

187 IoT products in Profile of the IoT Core Baseline for Consumer IoT Products, NISTIR 8425 

188 [IR8425]. Though developed for consumer IoT products the NISTIR 8425 outcomes are 

189 important cybersecurity guidance for any digital product. Outcomes can be technical (i.e., 

190 implemented through hardware/software) or non-technical (i.e., implemented as procedures and 

191 processes by organizations or individuals). In this context, outcomes are broad, flexible 

192 guidelines that can apply, albeit differently, to different use cases and contexts, while 

193 requirements are targeted specifications that can define meeting an outcome for a specific use 

194 case, context, technology, etc. The guidance in this document has been developed uniquely for 

195 consumer-grade routers using cybersecurity considerations and standards specific to that product 

196 type. NIST recommends the use of the following standards for the cybersecurity of 

197 consumer-grade router products:

198 1. Broadband Forum (BBF) TR-124 Issue 8 – Functional Requirements for Broadband 

199 Residential Gateway Devices [BBF]

200 2. CableLabs (CL) Security Gateway Device Security Best Common Practices [CableLabs]

201 3. Federal Office for Information Security (BSI) TR-03148: Secure Broadband Router -

202 Requirements for secure Broadband Routers [BSI]

203 4. Infocomm Media Development Authority (IMDA) Technical Specification Security 

204 Requirements for Residential Gateways [IMDA]

205 5. Platform Firmware Resiliency Guidelines, NIST Special Publication 800-193 

206 [SP800-193]

207 6. Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, 

208 SP 800-161 Rev. 1 [SP800-161r1]

209 7. Secure Software Development Framework (SSDF) Version 1.1: Recommendations for 

210 Mitigating the Risk of Software Vulnerabilities, SP 800-218 [SSDF]
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

2

211 8. Information technology — Security techniques — Vulnerability disclosure processes,

212 ISO/IEC 29147 [ISO29147]

213 9. Information technology — Security techniques — Vulnerability handling, ISO/IEC 30111

214 [ISO30111]

215 10. Risk management — Guidelines, ISO 31000 [ISO31000]

216 11. Systems and software engineering — Design and development of information for users,

217 ISO/IEC/IEEE 26514 [ISO26514]

NIST recommends use of four existing consumer-grade router standards1218 (i.e., items 1 through 4 

219 in the list above). Requirements from the standards for consumer-grade routers focused primarily 

220 on the router device, discussing many cybersecurity capabilities appropriate for this equipment.

221 Additional technical requirements for firmware are introduced by SP 800-193 (i.e., item 5). 

222 Appendix A provides a crosswalk between technical cybersecurity outcomes for consumer-grade 

223 router products and the technical requirements from these five standards.

224 The requirements from the four router standards address technical cybersecurity for consumer225 grade router devices but not the non-technical cybersecurity outcomes nor cybersecurity for 

226 product components other than the router device (e.g., backend, mobile application) since they 

227 contain few requirements for non-technical supporting capabilities and no requirements for other 

228 product components (e.g., mobile application). Therefore, additional standards (i.e., items 6

229 through 11) are recommended to help fill some of those gaps in the consumer-grade router 

230 standards, particularly for non-technical outcomes. Appendix B discusses some additional 

231 considerations and guidance for non-technical outcomes.

232 This list is intended as a minimum starting point and may not address all the cybersecurity 

233 considerations for every consumer-grade router product. Full support of all outcomes in this 

234 profile by all consumer-grade router product components is expected. To ensure cybersecurity 

235 consideration of all consumer-grade router product components, the Product Development 

236 Cybersecurity Handbook (in development) is recommended in addition to the standards 

237 indicated above. If a consumer-grade router product has additional product components, such as 

238 a smart phone mobile application, additional technical product cybersecurity capability 

239 requirements would also be necessary to meet the outcomes for the complete consumer-grade 

240 router product. These considerations are discussed generally for digital products in the handbook.

241 The rest of this document provides additional discussion of cybersecurity context and 

242 expectations related to consumer-grade router products, structured as follows:

243 • Section 2 states the recommended scope of consumer-grade router products.

244 • Section 3 concludes the document.

245 Scope of Consumer-Grade Routers

246 This profile identifies minimum cybersecurity for consumer-grade routers. Consumer-grade 

247 routers are defined as networking devices which are primarily intended for residential use and 

1 These standards primarily focused on technical capabilities for router devices. The Broadband Forum (BBF) TR-124 Issue 8 standard includes 

requirements outside of the purview of cybersecurity, while the other three standards focused exclusively on cybersecurity requirements. All 

cybersecurity requirements were examined to create the consumer-grade router profile. Non-cybersecurity requirements from the BBF standard 

were not analyzed as part of the profiling process.
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

3

248 can be installed by the customer. Routers forward data packets, most commonly Internet 

249 Protocol (IP) packets, between networked systems. The profile makes no distinction in its 

250 cybersecurity recommendations with regards to whether the product is owned by the 

251 customer or leased from an internet service provider.

252 The cybersecurity outcomes defined in this profile are valuable to 

253 manufacturers of consumer-grade routers regardless of how their 

254 products end up in a customer’s home. Routers leased from an internet 

255 service provider may be managed in part by both the customer and 

256 provider. Even in this scenario, the recommended requirements in this 

257 profile would be useful to both customers and providers in securing

258 routers. Additional discussion related to this scope can be found in 

259 Appendix A.

260 Cybersecurity outcomes and requirements for products should be scoped to all product 

261 components (e.g., smartphone applications) in addition to the router device. Fig. 1 below shows 

262 an example consumer-grade router product where the router device is supported by both a 

263 backend and smartphone application.

264

265 Fig. 1. An example consumer-grade router product that includes a smartphone application and backend 

266 server in addition to the router device.

267 Firmware is a critical foundation of many digital products, including consumer-grade routers and 

268 other consumer-grade router product components. Given the central role consumer-grade routers 

269 play in home networks, firmware vulnerabilities pose significant cybersecurity concerns. Other 

270 software that can access consumer-grade router data and manage the product (e.g., mobile 

271 applications or remote backends) also create threat vectors for home consumers if not 

272 appropriately mitigated in software and through the software development process. 

273 Conclusion

274 This consumer-grade router profile can help manufacturers determine adequate cybersecurity to 

275 develop into their products. These recommendations draw from current good practices and 

276 promote adoption of accepted and vetted cybersecurity for consumer-grade routers. As with any 

277 NIST report, as the referenced standards and best practices change over time, NIST may revisit 
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

4

278 this document and revise it. NIST welcomes on-going feedback and recommendations from the 

279 community as to standards and best practices for consumer-grade routers. That said, NIST 

280 encourages readers to identify if the standards referenced here have been updated 

281 asynchronously from this report. NIST reiterates the importance of a product-wide perspective to 

282 develop a comprehensive approach to providing cybersecurity for consumer-grade router 

283 products.

284 References

285 [WHAnnouncement] White House (2023) Biden-Harris Administration Announces 

286 Cybersecurity Labeling Program for Smart Devices to Protect American Consumers. (White 

287 House, Washington, DC). https://www.whitehouse.gov/briefing-room/statements288 releases/2023/07/18/biden-harris-administration-announces-cybersecurity-labeling-program289 for-smart-devices-to-protect-american-consumers/

290 [StandardsCrosswalk] National Institute of Standards and Technology (2023) Crosswalk of 

291 Consumer-Grade Router Cybersecurity Standards to NIST’s Baseline for Consumer IoT 

292 Products. (National Institute of Standards and Technology, Gaithersburg, MD). 

293 https://www.nist.gov/system/files/documents/2023/10/25/Consumer294 Grade%20Router%20Standards%20Crosswalk.pdf

295 [IR8425] Fagan M, Megas KN, Watrobski P, Marron J, Cuthill B (2022) Profile of the IoT Core 

296 Baseline for Consumer IoT Products. (National Institute of Standards and Technology, 

297 Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8425. 

298 https://doi.org/10.6028/NIST.IR.8425

299 [BBF] Walls, J, Editor (2022) Functional Requirements for Broadband Residential Gateway 

300 Devices. (Broadband Forum, Fremont, CA), Technical Report (TR) 124, Issue 8. 

301 https://www.broadband-forum.org/resources/tr-124-issue-8-functional-requirements-for302 broadband-residential-gateway-devices

303 [CableLabs] CableLabs Security (2021) Gateway Device Security Best Common Practices. 

304 (CableLabs, Louisville, CO), CL-GL-GDS-BCP-V01-211007. 

305 https://community.cablelabs.com/wiki/plugins/servlet/cablelabs/alfresco/download?id=1209

306 eea3-bd81-40cb-9a18-21bd6cfcd80d

307 [BSI] Federal Office for Information Security (2023) Secure Broadband Router: Requirements 

308 for Secure Broadband Routers. (Federal Office for Information Security, Bonn, Germany), 

309 BSI Technical Report (TR) 03148. https://www.bsi.bund.de/EN/Themen/Unternehmen-und310 Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema311 sortiert/tr03148/tr-03148.html

312 [IMDA] Info-communications Media Development Authority of Singapore (2020) Security 

313 Requirements for Residential Gateways. (Info-communications Media Development 

314 Authority, Singapore), IMDA Technical Specification (TS) RG-SEC. 

315 https://www.imda.gov.sg/-/media/imda/files/regulation-licensing-and-consultations/ict316 standards/telecommunication-standards/radio-comms/imda-ts-rg-sec.pdf

317 [SP800-193] Regenscheid, AR (2018) Platform Firmware Resiliency Guidelines. (National 

318 Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 

319 800-193. https://doi.org/10.6028/NIST.SP.800-193

320 [SP800-161r1] Boyens JM, Smith AM, Bartol N, Winkler K, Holbrook A, Fallon M (2022) 

321 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. 
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

5

322 (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special 

323 Publication (SP) 800-161r1. https://doi.org/10.6028/NIST.SP.800-161r1

324 [SSDF] Souppaya MP, Scarfone KA, Dodson DF (2022) Secure Software Development 

325 Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software 

326 Vulnerabilities. (National Institute of Standards and Technology, Gaithersburg, MD), NIST 

327 Special Publication (SP) 800-218. https://doi.org/10.6028/NIST.SP.800-218

328 [SbD] Cybersecurity and Infrastructure Security Agency, et al. Secure by Design: Shifting the 

329 Balance of Cybersecurity Risk. https://www.cisa.gov/sites/default/files/2023-

330 10/SecureByDesign_1025_508c.pdf

331 [ISO29147] International Organization for Standardization (2018) Information technology —

332 Security techniques — Vulnerability disclosure. (ISO Standard No. 29147:2018). 

333 https://www.iso.org/standard/72311.html

334 [ISO30111] International Organization for Standardization (2019) Information technology —

335 Security techniques — Vulnerability handling processes. (ISO Standard No. 30111:2019). 

336 https://www.iso.org/standard/69725.html

337 [ISO31000] International Organization for Standardization (2018) Risk management —

338 Guidelines. (ISO Standard No. 31000:2018). https://www.iso.org/standard/65694.html

339 [ISO26514] International Organization for Standardization (2022) Systems and software 

340 engineering — Design and development of information for users. (ISO Standard No. 

341 26514:2022). https://www.iso.org/standard/77451.html

342 [SP800-40r4] Souppaya MP, Scarfone KA (2022) Guide to Enterprise Patch Management 

343 Planning: Preventive Maintenance for Technology. (National Institute of Standards and 

344 Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-40, Rev. 4. 

345 https://doi.org/10.6028/NIST.SP.800-40r4 

346 [RFC6092] Woodyatt, J, Editor (2011) Recommended Simple Security Capabilities in 

347 Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service. 

348 (Internet Engineering Task Force), IETF Request for Comment (RFC) 6092. 

349 https://datatracker.ietf.org/doc/html/rfc6092

350 [IR8320] Bartock MJ, Souppaya MP, Savino R, Knoll T, Shetty U, Cherfaoui M, Yeluri R, 

351 Malhotra A, Banks D, Jordan M, Pendarakis D, Rao JR, Romness P, Scarfone KA (2022) 

352 Hardware-Enabled Security: Enabling a Layered Approach to Platform Security for Cloud 

353 and Edge Computing Use Cases. (National Institute of Standards and Technology, 

354 Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8320. 

355 https://doi.org/10.6028/NIST.IR.8320

356 [SP800-37r2] Joint Task Force (2018) Risk Management Framework for Information Systems 

357 and Organizations: A System Life Cycle Approach for Security and Privacy. (National 

358 Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 

359 800-37, Rev. 2. https://doi.org/10.6028/NIST.SP.800-37r2

360 [ParksRouterResearch] Parks Associates (2022) Parks Associates: 52% of Consumers Acquired 

361 Their Routers From Their ISP. (PRNewswire, Dallas, TX). 

362 https://www.prnewswire.com/news-releases/parks-associates-52-of-consumers-acquired363 their-routers-from-their-isp-301593338.html
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

6

364 Appendix A. Crosswalk between Technical Outcomes and Consumer-Grade 

365 Router Cybersecurity and Firmware Requirements

366 This Appendix provides additional information about how the requirements from the four router 

367 standards relate to the consumer-grade router profile outcomes. 

368 Sections A.1 to A.7 below show which requirements from the four consumer-grade router 

369 standards are related to the technical outcomes for consumer-grade routers. Each subsection from 

370 A.1 to A.7 states the high-level outcome along with each sub-outcome that defines the high-level 

371 outcome. The language for the consumer-grade router profile cybersecurity outcomes was 

372 developed by modifying the outcomes from NISTIR 8425. Two new sub-outcomes were also 

373 added based on review of the consumer-grade router standards, noted with a †.

374 For each sub-outcome, a set of related requirements from the four consumer-grade router 

375 standards is also included. The abbreviations used for the standards are:

376 BBF’s TR-124 Issue 8 [BBF]

377 CL’s Security Gateway Device Security Best Common Practices [CL]

378 BSI’s Secure Broadband Routers [BSI]

379 IMDA’s Security Requirements for Residential Gateways [IMDA]

380 In the development of firmware for consumer-grade routers and their components, NIST 

381 recommends the use of Special Publication 800-193 [SP800-193]. Section 4 of that document 

382 details technical cybersecurity capabilities to help mitigate firmware vulnerabilities. These 

383 capabilities are supportive of the outcomes for consumer-grade router products defined in this 

384 document. Thus, in addition to the four consumer-grade router standards, requirements from 

385 Section 4 of SP 800-193 are also included in the following sub-sections when applicable.

386 A.1. Asset Identification

387 The consumer-grade router product is uniquely identifiable and inventories all of the consumer388 grade router product’s components.

389 A.1.1. Asset Identification 1

390 The consumer-grade router product can be uniquely identified by the customer and other 

391 authorized entities via means including but not limited to: host name, service set identifier 

392 (SSID), and serial number.

393 Related Standards Requirements:

394 BBF GEN.DESIGN.12, GEN.DESIGN.13, MGMT.LOCAL.20, 

395 IF.LAN.WIRELESS.AP.20

396 CL OOB-011, KEY-006, OOB-007

397 BSI (3.1.2.1)

398 IMDA None
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

7

399 A.1.2. Asset Identification 2

400 The consumer-grade router product uniquely identifies each product component (e.g., router 

401 device, mobile app) and maintains an up-to-date inventory of connected product components.

402 No requirements from the consumer-grade router standards were mapped to this outcome. This 

403 outcome relates to a specifically product-wide concept (i.e., inventory of product components), 

404 and thus it is expected that standards with device-focused requirements would not address a 

405 product-focused outcome.

406 A.2. Product Configuration

407 While the configuration of the consumer-grade router product is changeable, it has default 

408 settings that “protect against the most prevalent threats and vulnerabilities without end-users 

409 having to take additional steps” [SbD, p.8]. In addition, it has the ability to restore a secure 

410 default setting, and any and all changes can only be performed by authorized individuals, 

411 services, and other consumer-grade router product components. Moving away from initial secure 

412 default settings for the router product requires actively changing the configuration. 

413 A.2.3. Product Configuration 1

414 Utilizing strong authentication mechanisms (e.g., multi-factor authentication), authenticated and 

415 authorized individuals (e.g., customer, ISP), services, and other consumer-grade router product 

416 components can access the consumer-grade router product’s configuration interfaces (e.g., 

417 administration page) and change the configuration settings of the consumer-grade router product 

418 via one or more consumer-grade router product components.

419 Related Standards Requirements:

420 BBF MGMT.LOCAL.2

421 CL OOB-007, DE-007, MI-002, MI-010, MI-011

422 BSI (3.1.2) (4), (4.1.1), (4.1.2), (4.2), (4.3), (4.4), (4.5), (4.8), (4.9), (4.10)

423 IMDA 4.2, 4.2.3, 4.4

424 A.2.4. Product Configuration 2

425 The consumer-grade router product is provided to customers with secure default configuration 

426 settings. Authorized individuals (i.e., customer), services, and other consumer-grade router 

427 product components have the ability to restore (i.e., factory reset) the consumer-grade router 

428 product to a secure default (i.e., uninitialized) configuration. In restoring the product to a secure 

429 default, all settings and data must be deleted.

430 Related Standards Requirements:

431 BBF MGMT.LOCAL.10

432 CL OOB-009, DE-003, DE-004, DE-006

433 BSI (4.6)
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

8

434 IMDA 4.1.1, 4.2.1, 4.2.3

435 SP 800-193 4.2.4(5), 4.4.2(5)

436 A.2.5. Product Configuration 3

437 The consumer-grade router product applies configuration settings to applicable consumer-grade 

438 router components.

439 No requirements from the consumer-grade router standards were mapped to this outcome. This 

440 outcome relates to a specifically product-wide concept (i.e., application of configuration across 

441 all product components), and thus it is expected that standards with device-focused requirements 

442 would not address a product-focused outcome.

443 A.3. Data Protection

444 The consumer-grade router product protects data stored across all consumer-grade router product 

445 components and transmitted both between consumer-grade router product components and 

446 outside the consumer-grade router product from unauthorized access, disclosure, and 

447 modification using strong encryption (e.g., FIPS 140-3 compliant modules).

448 A.3.6. Data Protection 1

449 Each consumer-grade router product component protects data it stores via secure means, such as 

450 strong encryption (e.g., FIPS 140 Rev. 3 compliant modules). All stored data, including data

451 used for authentication (e.g., salting and hashing stored passwords or passphrases) must be 

452 protected. Critical data (including firmware images) can be securely backed up and recovered.

453 Related Standards Requirements:

454 BBF SEC.FIRMWARE.2

455 CL DRP-001, KEY-001, KEY-002, KEY-003, HR-003, HR-004, SB-005, OOB-002

456 BSI (4.1.1)

457 IMDA 4.5

458 SP 800-193 4.1.1(1-4, 7), 4.1.4(1-2), 4.2.2, 4.2.3(1-2), 4.2.4(5), 4.4.1 (1, 2a, 7, 12), 

459 4.4.2(1-2, 4, 6-8, 10) 

460 A.3.7. Data Protection 2

461 The consumer-grade router product has the ability to delete or render inaccessible stored data 

462 that are either collected from or about the customer, home, family, etc.

463 Related Standards Requirements:

464 BBF None

465 CL OOB-009

466 BSI (4.6)
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

9

467 IMDA 4.2.3

468 A.3.8. Data Protection 3

469 When data are sent between consumer-grade router product components or outside the product,

470 strong protections (e.g., FIPS 140-3 compliant encryption modules) are used for the data 

471 transmission. This includes using HTTP over TLS for external communications via the

472 consumer-grade router product and for using device management interfaces or web portals for 

473 configuration management. 

474 Related Standards Requirements:

475 BBF MGMT.REMOTE.WEB.6, SEC.USERINTERFACE.1, SEC.FIRMWARE.1, 

476 SEC.FIRMWARE.2

477 CL OOB-003, DE-002, DE-004, DE-005, MI-001, NETS-001, NETS-003, SBOM-006

478 BSI (3.1.2.2), (4.1.1), (4.1.2), (4.4), (4.10)

479 IMDA 4.2.2, 4.2.5

480 A.4. Interface Access Control 1

Each consumer-grade router product component controls access to and from all interfaces2481 in 

482 order to limit access to only authorized entities.

483 A.4.9. Interface Access Control 1a

484 Use and have access only to interfaces necessary for the consumer-grade router product’s 

485 operation. All other channels and access to channels are removed or secured. For example, 

486 disable by default remote access to the router, especially via the WAN interface.

487 Related Standards Requirements:

488 BBF MGMT.LOCAL.1, MGMT.REMOTE.WEB.1, MGMT.REMOTE.WEB.5, 

489 MGMT.REMOTE.WEB.12, MGMT.REMOTE.WEB.13, SEC.GEN.5, SEC.GEN.6, 

490 SEC.GEN.10, SEC.GEN.11, SEC.USERINTERFACE.8

491 CL HR-001, HR-002, OOB-005, MI-003, NETS-004, NETS-005, MI-011

492 BSI (3), (3.1), (3.1.2), (3.2), (4.1.1)

493 IMDA 4.2, 4.2.1

494 SP 800-193 4.2.1.2

2

Interfaces are a boundary between the IoT device and entities where interactions take place. This includes digital/network interfaces, as well as 

local interfaces, such as graphical user interfaces.
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

10

495 A.4.10. Interface Access Control 1b

496 For all interfaces necessary for the consumer-grade router product’s use, access control measures 

are in place.3497 At a minimum this includes:

498 1. Assigning consumer-grade router products unique initial passwords that are required to 

499 be changed to a strong password or passphrase upon installation. Support for multifactor 

500 authentication is recommended.

501 2. Placing a timeout limit on account sessions.

502 3. Protecting against authentication brute force attacks (e.g., limiting failed log-in attempts).

503 4. Making physical developer interface ports inaccessible from the outside of a component.

504 5. Ensuring closed ports are not revealed during scans.

505 6. Prohibiting the reply to requests over a port for an API/Protocol that doesn't use that port.

Related Standards Requirements4506 :

507 BBF GEN.DESIGN.14, GEN.OPS.21, MGMT.LOCAL.1, MGMT.LOCAL.5, 

508 MGMT.LOCAL.11, MGMT.REMOTE.WEB.2, MGMT.REMOTE.WEB.9,

509 IF.LAN.WIRELESS.AP.20, SEC.GEN.1, SEC.GEN.8, SEC.USERINTERFACE.2, 

510 SEC.USERINTERFACE.3, SEC.USERINTERFACE.4, SEC.USERINTERFACE.5, 

511 SEC.USERINTERFACE.6, SEC.USERINTERFACE.7, SEC.USERINTERFACE.9

512 CL OOB-001, OOB-004, OOB-006, OOB-008, OOB-010, OOB-012, MI-004, MI-007, 

513 MI-008, MI-009, MI-010, MI-013, DIAG-002, NETS-007, NETS-008, NETA-001, 

514 NETA-002, NETA-003, MI-002

515 BSI (3.1), (3.1.2.1), (3.2), (4.1.1), (4.4)

516 IMDA 4.1.1, 4.1.2, 4.2, 4.2.1

517 SP 800-193 4.1.1(5), 4.2.4(3-4)

518 A.4.11. Interface Access Control 1c

519 For all interfaces, access and modification privileges are limited. For example, access to the 

520 administration page and changes to the configuration should be limited to authenticated users 

521 authorized to make such changes. 

522 Related Standards Requirements:

523 BBF MGMT.REMOTE.WEB.3, MGMT.REMOTE.WEB.4, SEC.GEN.7

524 CL MI-006

525 BSI (3.1), (3.1.2), (3.2)

526 IMDA 4.2

3

IETF RFC6092 Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet 

Service [RFC6092] is a relevant source for more specific guidance related to IPv6 interface cybersecurity.

4

IMDA 4.1.2 discusses password requirements, as does BSI (4.1.1)[1]. IMDA’s requirement is more stringent than BSIs (i.e., minimum 

password character length of 10 versus 8) and is recommended by the BSI requirement.
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

11

527 SP 800-193 4.2.3(3), 4.2.4(1)

528 A.5. Interface Access Control 2

529 Some, but not necessarily all, consumer-grade router product components have the means to 

530 protect and maintain interface access control.

531 A.5.12. Interface Access Control 2a

532 Validate data received by the consumer-grade router product and validate that data shared among 

533 consumer-grade router product components match specified definitions of format and content.

534 Related Standards Requirements:

535 BBF None

536 CL MI-012, NETS-006

537 BSI None

538 IMDA 4.6

539 SP 800-193 4.1.1(6, 8), 4.2.4(2)

540 A.5.13. Interface Access Control 2b

541 Prevent unauthorized transmissions or access to other product components.

542 Related Standards Requirements:

543 BBF WAN.DoS.1, WAN.DoS.2, WAN.DoS.3, WAN.DoS.4, WAN.DoS.5

544 CL MI-005, NETS-006

545 BSI (3.1.2), (4.3), (4.7), (4.9)

546 IMDA 4.2.1

547 A.5.14. Interface Access Control 2c

548 Maintain appropriate access control during initial connection (i.e., onboarding) and when 

549 reestablishing connectivity after disconnection or outage.

550 Related Standards Requirements:

551 BBF None

552 CL None

553 BSI (3.1.2.3), (3.2)

554 IMDA 4.1.1, 4.2, 4.2.1
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

12

555 A.6. Software Update

556 The software (including firmware) of all consumer-grade router product components can be 

557 updated by authenticated and authorized individuals, services, and other consumer-grade router

558 product components only by using a secure and configurable mechanism, as appropriate for each 

559 consumer-grade router product component.

560 A.6.15. Software Update 1

561 Each consumer-grade router product component can receive, verify, and apply verified software 

562 (including firmware) updates that are signed and encrypted.

563 Related Standards Requirements:

564 BBF GEN.OPS.22, GEN.OPS.23

565 CL KEY-004, KEY-005, SB-001, SU-001, SU-005, SBOM-009, SB-002, SU-003

566 BSI (4.2)

567 IMDA 4.3

568 SP 800-193 4.1.1(4), 4.1.2(1-4), 4.2.1.1, 4.2.1.2(1), 4.2.4(3, 5), 4.3.1(2), 4.4.1(2-6) 

569 A.6.16. Software Update 2

570 The consumer-grade router product implements measures to keep software (including firmware)

571 on consumer-grade router product components up to date (i.e., automatic application of updates 

572 or consistent customer notification of available updates via consumer-grade router components), 

573 including provisions to prevent firmware rollback attacks.

574 Related Standards Requirements:

575 BBF GEN.OPS.19, GEN.OPS.20, MGMT.LOCAL.15, MGMT.LOCAL.21, 

576 MGMT.LOCAL.22

577 CL SB-003, SU-002, SU-006, SBOM-003, SBOM-007, SBOM-008, SBOM-010

578 BSI (4.1.2), (4.2)

579 IMDA 4.3

580 SP 800-193 4.1.2(5), 4.2.1.3, 4.4.1(1, 10, 11, 13)

A.6.17. Software Update 3† 581

582 Integrity of data, including configuration, is preserved when an update is applied. In the case of a 

583 failed update, the product should revert to a usable state.

584 Related Standards Requirements:

585 BBF GEN.OPS.15, GEN.OPS.24

586 CL SU-004

587 BSI None
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

13

588 IMDA None

589 SP 800-193 4.3.1(3)

590 A.7. Cybersecurity State Awareness

591 The consumer-grade router product supports detection of cybersecurity incidents affecting or 

592 affected by consumer-grade router product components and the data they store and transmit. 

593 A.7.18. Cybersecurity State Awareness 1

594 The consumer-grade router product securely captures and records information about the state of 

595 consumer-grade router components that can be used to detect cybersecurity incidents affecting or 

596 affected by consumer-grade router product components and the data they store and transmit.

597 Information that the consumer-grade router product shall provide includes login attempts, 

598 administrative events, system status, firewall status, status of all consumer-grade router product 

599 components, other connected products, and timing synchronization.

600 Related Standards Requirements:

601 BBF GEN.OPS.18, LAN.FW.2, LAN.FW.3, LAN.FW.4, MGMT.LOCAL.18, 

602 MGMT.LOCAL.20

603 CL SB-004, LOG-001, LOG-002, LOG-003, LOG-004, LOG-005, SB-002, TS-001

604 BSI (4.1.2), (4.8)

605 IMDA None

606 SP 800-193 4.1.1(4), 4.1.3, 4.3.1(1, 5), 4.3.2(1-2, 4), 4.4.1(8), 4.4.2(3)

A.7.19. Cybersecurity State Awareness 2† 607

608 Where and when applicable, the consumer-grade router product may inform authorized entities 

609 about or respond directly to changes in cybersecurity information.

610 Related Standards Requirements:

611 BBF GEN.OPS.6

612 CL AR-002

613 BSI None

614 IMDA None

615 SP 800-193 4.1.3(3), 4.3.1(2-4, 6), 4.3.2(3, 5-6), 4.4.1(9, 11), 4.4.2(9)

616 Appendix B. Non-Technical Outcome Considerations

617 Table 1 below states the non-technical cybersecurity outcomes NIST has defined for the 

618 consumer-grade router profile with the requirements from the four consumer-grade router 

619 standards that related to these outcomes. 
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

14

620 Table 1. Non-technical cybersecurity outcomes and requirements from consumer-grade router standards

Consumer-Grade Router Profile Non-Technical Outcome Related Requirements

Documentation

The consumer-grade router product developer creates, gathers, and stores 

information relevant to cybersecurity of the consumer-grade router product and 

its product components prior to customer purchase, and throughout the 

development of a product and its subsequent lifecycle.

CL HR-005, MI-014, 

DIAG-001, SBOM004, SBOM-005

Information and Query Reception

The consumer-grade router product developer has the ability to receive 

information relevant to cybersecurity and respond to queries from the customer 

and others about information relevant to cybersecurity.

-

Information Dissemination

The consumer-grade router product developer broadcasts (e.g., to the public) 

and distributes (e.g., to the customer or others in the consumer-grade router 

product ecosystem) information relevant to cybersecurity.

CL AR-001, SBOM011

BSI (4.2)

IMDA 4.3e

Education and Awareness

The consumer-grade router product developer creates awareness of and 

educates customers and others in the consumer-grade router product ecosystem 

about cybersecurity-related information (e.g., considerations, features) related 

to the consumer-grade router product and its product components.

-

621 The standards do not thoroughly address the non-technical outcomes, but NIST reiterates that 

622 consumer-grade router products should be supported by all the non-technical outcomes included 

623 in this profile. Implementation of non-technical outcomes may not have to be tailored for a 

624 product type (i.e., consumer-grade routers) and may be deployed similarly for different digital 

625 products. For example, a vulnerability management program is not likely to vary significantly in 

626 implementation for consumer-grade routers, smart thermostats, personal computers, etc. Thus, 

627 product-agnostic approaches to the non-technical outcomes as discussed in the Product 

628 Development Cybersecurity Handbook (in development) are recommended in addition to the 

629 non-technical requirements included in the four consumer-grade router standards. The handbook 

630 guides a developer through important cybersecurity considerations when developing digital 

631 products. Though the handbook is generally contextualized around IoT products, the concepts 

632 discussed can apply to any digital product with a physical component in the customer’s 

633 environment (e.g., consumer-grade router device). There are many non-technical cybersecurity 

634 considerations discussed in the handbook, but the following are key considerations for

635 consumer-grade router products given the role these devices play in home networks:

636 Risk management in both planning and execution of consumer-grade router products 

637 will help identify and mitigate cybersecurity risks throughout the product lifecycle. Risks 

638 faced by consumer-grade router products can be significant. Consumer-grade router 

639 devices have a unique vantage and access to home networks. They also have robust 

640 networking capabilities, giving them utility for a wide range of attacks. Other consumer641 grade router product components present their own risks. Backends may aggregate data 

642 from one or more customers, making them attractive targets for attackers. Mobile 

643 applications may be installed in relatively hostile environments due to malware and other 

644 vectors of attack. ISO 31000 [ISO31000] is a foundational resource that developers 

645 should use for risk management. NIST’s Risk Management Framework for Information 

646 Systems and Organizations: A System Life Cycle Approach for Security and Privacy, SP 

647 800-37 Rev. 2 [SP800-37r2] may also be useful guidance for risk management.
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

15

648 Secure development processes for both hardware and software are also critical for the 

649 cybersecurity of consumer-grade router products. Hardware-Enabled Security: Enabling 

650 a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases, 

651 NISTIR 8320 [IR8320] may be a helpful resource for consumer-grade router product 

652 developers as they consider hardware in relation the cybersecurity of their products. A

653 recommended resource available to all software developers is NIST’s Secure Software 

654 Development Framework [SSDF], which includes fundamental, sound, and secure 

655 software development practices. The SSDF can help a software developer align and 

656 prioritize its secure software development activities with its business/mission 

657 requirements, risk tolerances, and resources. Like NISTIR 8425, the SSDF’s practices are 

658 outcome-based. The SSDF’s practices, tasks, and implementation examples represent a 

659 starting point to consider. In the context of consumer-grade router products, all SSDF 

660 practices are recommended to be implemented as part of the software development 

661 lifecycle of a consumer-grade router products’ firmware and other software. Some SSDF 

662 practices may be more applicable to certain types of software. Appendix B presents a 

663 detailed crosswalk listing all SSDF tasks and their applicability to three kinds of 

664 firmware or software commonly part of consumer-grade router products: router firmware, 

665 mobile applications, remote backend/web applications.

666 Vulnerability management is critical for consumer-grade router products and is 

667 addressed by portions of all four non-technical cybersecurity outcomes. Consumer grade 

668 router products should be developed to minimize known and foreseeable vulnerabilities. 

669 In addition, manufacturers should develop a robust vulnerability management plan for 

670 their products that will identify vulnerabilities to quickly and effectively mitigate them in 

671 their products. For this, they should use ISO/IEC 29147 [ISO29147] and ISO/IEC 30111

672 [ISO30111], which are important resources for vulnerability disclosure and handling, 

673 respectively. From NIST, Guide to Enterprise Patch Management Planning: Preventive 

674 Maintenance for Technology, SP 800-40 Rev. 4 [SP800-40r4] can also be a helpful 

675 resource for consumer-grade router product developers as they plan for, discover, 

676 prioritize, and respond to vulnerabilities in their products. 

677 Customer engagement on cybersecurity, which is called Education and Awareness in 

678 the non-technical outcomes, facilitates use of technical cybersecurity features and 

679 adoption of good cybersecurity by customers. ISO/IEC/IEEE 26514 [ISO26514] provides 

680 guidance on the design and development of information for users, which may be helpful 

681 to and is recommended for consumer-grade router product developers as they create the 

682 manual and other materials for the device that a customer may seek out for cybersecurity 

683 instructions related to the product. 

684 These are highlighted considerations. Manufacturers should implement robust non-technical 

685 cybersecurity support that includes all aspects of documenting cybersecurity pertinent 

686 information, establishing means to receive and disseminate cybersecurity pertinent information 

687 related to the product, and fostering cybersecurity education and awareness among customers 

688 related to the product.
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

16

689 Appendix C. Consumer-Grade Router Acquisition Scenarios Discussion

690 Routers are network devices that forward data packets, most commonly Internet Protocol (IP) 

691 packets, between networked systems. They may be wired (e.g., Ethernet), wireless (e.g., Wi-Fi), 

692 or both. Consumer-grade identifies those routers that may appear in an individual’s residence 

693 such that their primary use case is residential rather than enterprise, industrial, etc. However, 

694 some small businesses may choose to use consumer grade equipment given the limited 

695 performance needs of those businesses. The presumption for consumer equipment, or small 

696 businesses that use consumer grade equipment, is that the manufacturer cannot assume the user 

697 has cybersecurity expertise or an ability to take significant action to secure the product.

Consumer-grade routers may be acquired by households in at least two ways5698 :

699 1. Purchase of the equipment directly from a retailer.

700 2. Bundling and/or renting of the equipment from a service provider.

701 Each of these scenarios may have implications for how cybersecurity outcomes could be met by 

702 the consumer-grade router product. Consumer-owned equipment may be fully managed by the 

703 household or may have some security services provided externally. Alternatively, bundled/rental 

704 equipment will likely be managed in part by the service provider. 

705 Table 2. Scope Coverage of the Consumer-Grade Router Standards Analyzed

Applicable to...

Consumer-Grade Router Standard ConsumerOwned Routers?ISP-Owned, CustomerLeased Routers?

TR-124 Issue 8 [BBF] Yes Yes

Security Gateway Device Security Best Common Practices [CL] Yes Yes

Secure Broadband Routers [BSI] Yes Yes

Security Requirements for Residential Gateways [IMDA] Yes No

706

707 As summarized in Table 2, the scope statements of three of the four standards examined either 

708 make no distinction about how the router is acquired by customers or state that the guidance 

709 applies to both scenarios. 

710 BBF does not distinguish between the two methods of acquisition, stating “a Residential 

711 Gateway implementing the general requirements of TR-124 will incorporate at least one 

712 embedded WAN interface, routing, bridging, a basic or enhanced firewall, one or multiple LAN 

713 interfaces and home networking functionality that can be deployed as a consumer self-installable 

714 device.” It notably highlights that included are products that can be deployed as “consumer self715 installable,” which includes the customer purchased scenario, as well as most instances of 

716 service provider supplied routers.

717 CableLabs directly acknowledges both scenarios: “This Gateway Device Security document 

718 specifies best common practices to serve as an industry metric for retail and leased devices (both 

719 gateways and cable modems) for security—this includes manufacturing process, supply chain, 

720 hardware and firmware configuration procedures, software, and management protocols.”

5 As of 2022, about half of consumer-grade routers are received from ISPs rather than acquired by customers directly. [ParksRouterResearch]
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

17

721 The German Federal Office for Information Security (BSI) focuses its requirements on how the 

722 product is used rather than acquired, stating “In scope of this Technical Guideline are 

723 requirements on a router as a hardware component with an installed operating system and 

724 services provided to an end-user. The router serves the purpose of establishing a connection to 

725 the infrastructure of an Internet Access Provider (IAP) to gain internet access. From the end726 user’s perspective the router offers a gateway to the internet as well as management 

727 functionalities for the end-user’s private network. The Technical Guideline describes 

728 requirements on the router that should be implemented to offer a secure operation of the router 

729 for the end-user.” Thus, the requirements can be applied to the scenario of when customers 

730 purchase a router and when a router is provided by or rented from a service provider.

731 Unlike the others, the IMDA alludes to a focus on only routers purchased by customers, stating 

732 that the goal is “ensuring that these devices are better protected when purchased and deployed by 

733 consumers.”

734 Appendix D. Crosswalk Between Secure Software Development Tasks and 

735 Consumer-Grade Router Product Software Type

736 This appendix presents a detailed crosswalk listing all SSDF tasks and their applicability to three 

737 kinds of firmware or software commonly part of consumer-grade router products: router 

738 firmware, mobile applications, remote backend/web applications.

739 • Router firmware is a form of device firmware specific to consumer-grade router devices. 

740 Device firmware generally is “the collection of non-host processor firmware and 

741 Expansion ROM firmware that is only used by a specific device. This firmware is 

742 typically provided by the device manufacturer” [SP800-193]. 

743 • Mobile applications are software intended to be installed and/or executed on small profile 

744 platforms that can connect to cellular data networks. For example, applications made to 

745 run on Apple’s iOS or Alphabet’s Android operating systems.

746 • Remote backend/web applications are software intended to be hosted and executed on 

747 dedicated or shared servers that may provide services to many products at once. For 

748 example, code supporting consumer-grade routers that is hosted in a cloud environment.

749 Table 3 below indicates which SSDF tasks may be most appropriate for each kind of firmware 

750 or software. SSDF tasks that may be appropriate to a software type, but utilization of the task 

751 may be contextual to the development process or environment are noted with (parentheses). 

752 Table 3. Crosswalk between consumer-grade router product software types and SSDF tasks.

SSDF Task Recommended for Router...

PO.1.1: Identify and document all security requirements for the 

organization’s software development infrastructures and processes, 

and maintain the requirements over time.

Firmware, Mobile App., Web App.

PO.1.2: Identify and document all security requirements for 

organization-developed software to meet, and maintain the 

requirements over time.

Firmware, Mobile App., Web App.
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

18

SSDF Task Recommended for Router...

PO.1.3: Communicate requirements to all third parties who will 

provide commercial software components to the organization for reuse 

by the organization’s own software. [Formerly PW.3.1]

Firmware, Mobile App., Web App.

PO.2.1: Create new roles and alter responsibilities for existing roles as 

needed to encompass all parts of the SDLC. Periodically review and 

maintain the defined roles and responsibilities, updating them as 

needed.

Firmware, Mobile App., Web App.

PO.2.2: Provide role-based training for all personnel with 

responsibilities that contribute to secure development. Periodically 

review personnel proficiency and role-based training, and update the 

training as needed.

Firmware, Mobile App., Web App.

PO.2.3: Obtain upper management or authorizing official commitment 

to secure development, and convey that commitment to all with 

development-related roles and responsibilities.

(Firmware), (Mobile App.), (Web 

App.)

PO.3.1: Specify which tools or tool types must or should be included 

in each toolchain to mitigate identified risks, as well as how the 

toolchain components are to be integrated with each other.

Firmware, Mobile App., Web App.

PO.3.2: Follow recommended security practices to deploy, operate, 

and maintain tools and toolchains. Firmware, Mobile App., Web App.

PO.3.3: Configure tools to generate artifacts of their support of secure 

software development practices as defined by the organization.

(Firmware), (Mobile App.), (Web 

App.)

PO.4.1: Define criteria for software security checks and track 

throughout the SDLC.

(Firmware), (Mobile App.), (Web 

App.)

PO.4.2: Implement processes, mechanisms, etc. to gather and 

safeguard the necessary information in support of the criteria. Firmware, Mobile App., Web App.

PO.5.1: Separate and protect each environment involved in software 

development. Firmware

PO.5.2: Secure and harden development endpoints (i.e., endpoints for 

software designers, developers, testers, builders, etc.) to perform 

development-related tasks using a risk-based approach.

Firmware

PS.1.1: Store all forms of code – including source code, executable 

code, and configuration-as-code – based on the principle of least 

privilege so that only authorized personnel, tools, services, etc. have 

access.

Firmware, Mobile App., Web App.

PS.2.1: Make software integrity verification information available to 

software acquirers. (Web App.)

PS.3.1: Securely archive the necessary files and supporting data (e.g., 

integrity verification information, provenance data) to be retained for 

each software release.

Firmware, Mobile App.

PS.3.2: Collect, safeguard, maintain, and share provenance data for all 

components of each software release (e.g., in a software bill of 

materials [SBOM]).

Firmware, Mobile App.

PW.1.1: Use forms of risk modeling – such as threat modeling, attack 

modeling, or attack surface mapping – to help assess the security risk 

for the software.

Firmware, (Mobile App.), (Web 

App.)

PW.1.2: Track and maintain the software’s security requirements, 

risks, and design decisions. Firmware, Mobile App., Web App.
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

19

SSDF Task Recommended for Router...

PW.1.3: Where appropriate, build in support for using standardized 

security features and services (e.g., enabling software to integrate with 

existing log management, identity management, access control, and 

vulnerability management systems) instead of creating proprietary 

implementations of security features and services. [Formerly PW.4.3]

Firmware, Mobile App., Web App.

PW.2.1: Have 1) a qualified person (or people) who were not involved 

with the design and/or 2) automated processes instantiated in the 

toolchain review the software design to confirm and enforce that it 

meets all of the security requirements and satisfactorily addresses the 

identified risk information.

Firmware

PW.4.1: Acquire and maintain well-secured software components 

(e.g., software libraries, modules, middleware, frameworks) from 

commercial, open-source, and other third-party developers for use by 

the organization’s software.

Firmware, Mobile App., Web App.

PW.4.2: Create and maintain well-secured software components inhouse following SDLC processes to meet common internal software 

development needs that cannot be better met by third-party software 

components.

Firmware, Mobile App., Web App.

PW.4.4: Verify that acquired commercial, open-source, and all other 

third-party software components comply with the requirements, as 

defined by the organization, throughout their life cycles.

Firmware, Mobile App., Web App.

PW.5.1: Follow all secure coding practices that are appropriate to the 

development languages and environment to meet the organization’s 

requirements.

Firmware, Mobile App., Web App.

PW.6.1: Use compiler, interpreter, and build tools that offer features to 

improve executable security. Firmware, Mobile App., Web App.

PW.6.2: Determine which compiler, interpreter, and build tool features 

should be used and how each should be configured, then implement 

and use the approved configurations.

Firmware, Mobile App., Web App.

PW.7.1: Determine whether code review (a person looks directly at the 

code to find issues) and/or code analysis (tools are used to find issues 

in code, either in a fully automated way or in conjunction with a 

person) should be used, as defined by the organization.

Firmware, Mobile App., Web App.

PW.7.2: Perform the code review and/or code analysis based on the 

organization’s secure coding standards, and record and triage all 

discovered issues and recommended remediations in the development 

team’s workflow or issue tracking system.

Firmware, Mobile App., Web App.

PW.8.1: Determine whether executable code testing should be 

performed to find vulnerabilities not identified by previous reviews, 

analysis, or testing and, if so, which types of testing should be used.

Firmware, Mobile App., Web App.

PW.8.2: Scope the testing, design the tests, perform the testing, and 

document the results, including recording and triaging all discovered 

issues and recommended remediations in the development team’s 

workflow or issue tracking system.

Firmware, (Mobile App.), (Web 

App.)

PW.9.1: Define a secure baseline by determining how to configure 

each setting that has an effect on security or a security-related setting 

so that the default settings are secure and do not weaken the security 

functions provided by the platform, network infrastructure, or services.

Firmware, Mobile App., Web App.
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

20

SSDF Task Recommended for Router...

PW.9.2: Implement the default settings (or groups of default settings, 

if applicable), and document each setting for software administrators. Firmware, Mobile App., Web App.

RV.1.1: Gather information from software acquirers, users, and public 

sources on potential vulnerabilities in the software and third-party 

components that the software uses, and investigate all credible reports.

Firmware, Mobile App., Web App.

RV.1.2: Review, analyze, and/or test the software’s code to identify or 

confirm the presence of previously undetected vulnerabilities. Firmware, Mobile App., Web App.

RV.1.3: Have a policy that addresses vulnerability disclosure and 

remediation, and implement the roles, responsibilities, and processes 

needed to support that policy.

Firmware, Mobile App., Web App.

RV.2.1: Analyze each vulnerability to gather sufficient information 

about risk to plan its remediation or other risk response. Firmware, Mobile App., Web App.

RV.2.2: Plan and implement risk responses for vulnerabilities. Firmware, Mobile App., Web App.

RV.3.1: Analyze identified vulnerabilities to determine their root 

causes. Firmware, Mobile App., Web App.

RV.3.2: Analyze the root causes over time to identify patterns, such as 

a particular secure coding practice not being followed consistently. Firmware, Mobile App., Web App.

RV.3.3: Review the software for similar vulnerabilities to eradicate a 

class of vulnerabilities, and proactively fix them rather than waiting for 

external reports.

(Firmware), (Mobile App.), (Web 

App.)

RV.3.4: Review the SDLC process, and update it if appropriate to 

prevent (or reduce the likelihood of) the root cause recurring in 

updates to the software or in new software that is created.

(Firmware), (Mobile App.), (Web 

App.)

753 Appendix E. List of Symbols, Abbreviations, and Acronyms

754 BBF

755 Broadband Forum

756 BSI

757 Federal Office for Information Security

758 CL

759 CableLabs

760 IMDA

761 Infocomm Media Development Authority

762 IoT

763 Internet of Things

764 Appendix F. Glossary

765 Consumer-Grade Router Device

766 Networking devices which are primarily intended for residential use and can be installed by the customer. Routers

767 forward data packets, most commonly Internet Protocol (IP) packets, between networked systems.

768 Consumer-Grade Router Product

769 Consumer-grade router device and any additional product components (e.g., backend, smartphone application) that 

770 are necessary to use the consumer-grade router device beyond basic operational features. [IR8425, adapted]
Publication Identifier Recommended Cybersecurity Requirements for

February 2024 Consumer-Grade Router Products

21

771 Cybersecurity Outcome

772 Statement of what is expected either from a product or from an organization in support of a product related to the 

773 cybersecurity of that product. Can be technical, in the form of product cybersecurity capabilities or non-technical, in 

774 the form of non-technical supporting capabilities.

775 Non-technical Supporting Capability

776 Non-technical supporting capabilities are actions an organization performs in support of the cybersecurity of a 

777 product. [IR8425, adapted]

778 Product Cybersecurity Capability

779 Cybersecurity features or functions that computing devices provide through their own technical means (i.e., device 

780 hardware and software). [IR8425]