October 6, 2021

National Institute of Standards and Technology (NIST)

Attn: Applied Cybersecurity Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

Email: iotsec@nist.gov

Submitted electronically

Re: Deloitte1 NIST Cybersecurity White Paper “Baseline Security Criteria for Consumer IoT 

Devices” comments

Dear Sir/Madam:

Deloitte appreciates this opportunity to submit comments regarding the cybersecurity whitepaper

entitled “Baseline Security Criteria for Consumer IoT Devices”. 

Deloitte is one of the largest professional services organizations in the US, and our presence is 

extended globally through the Deloitte Touche Tohmatsu Limited network of member firms. We 

provide a vast array of services to clients focused on the security of IoT devices in the marketplace.

We serve a well-rounded group of both US-based and global clients such as medical technology 

companies (including medical device manufacturers), consumer companies (including hospitality and 

manufacturing organizations), health care providers, automotive manufacturers, energy and gas 

providers, pharmaceutical/biotechnology companies, and other companies that are part of the IoT 

device security value chain at the intersection of technology, risk, and regulation. As a result, we 

have a specialized perspective on important issues that arise, such as cybersecurity in connected 

medical devices, and in-depth knowledge of the IoT device security landscape across industries. 

Deloitte supports NIST’s continued furtherance of cybersecurity in IoT Device Security. “Baseline 

Security Criteria for Consumer IoT Devices” should assist manufacturers, organizations, and 

companies in developing comprehensive IoT security programs to ensure their devices are

increasingly more secure in the face of rapidly evolving threats and vulnerabilities. Please see a full, 

detailed list of comments in the attached comment form.

1 As used in this document, “Deloitte” means Deloitte & Touche LLP, a subsidiary of Deloitte LLP. Please see 

www.deloitte.com/us/about for a detailed description of our legal structure. Certain services may not be available 

to attest clients under the rules and regulations of public accounting.
Deloitte NIST Cybersecurity Whitepaper comments

Page 2 of 2

Again, we appreciate the opportunity to comment on the “Baseline Security Criteria for Consumer 

IoT Devices” whitepaper. In the event that the provided comments will be circulated outside the 

NIST review group, we ask that Deloitte be notified prior to distributing materials. Should you have 

questions regarding our comments, please contact us.

Sincerely,

Veronica Lim, 

Principal, Deloitte & Touche LLP

This document contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business, financial, investment, legal, 

tax, or other professional advice or services. This document is not a substitute for such professional advice or services, nor should it be used as a basis for any 

decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified 

professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this document.

Copyright © 2021 Deloitte Development LLC. All rights reserved.