Monday, September 25, 2023 a t 12:39:43 P acific Daylight Time 

Subject: Opposi&on to Suppor&ng R ecommenda&on 3.8 on the f ederal government developing IoT sect or 

defini&ons 

Date: Monday, September 25, 2023 at 12:18:04 PM Pacific Daylight Time 

From: Mike Bergman 

To: Benson Chan, Dan Caprio 

CC: Ann Mehra, ashehabi@lbl.gov, datadiva@debbiereynoldsconsul&ng.com, 

debra.lam@innovate.gatech.edu, Kevin.Kornegay@morgan.edu, maria.rerecich@consumer.org, 

nick.e@cropx.com, Nicole.Coughlin@carync.gov, pete@dotsandbridges.com, 

ranveer@microsoR.com, robby.moss@gmail.com, Steve.Griffith@Nema.org, tomkat@archonds.com, Barbara Bell Cuthill (barbara.cuthill@nist.gov), Jeffrey Brewer, greg.wi[e@hii-tsd.com 

Benson and Dan, 

Regarding this proposed Suppor&ng Recommenda&on: 

SupporFng RecommendaFon 3.8: (Proposed Update) The federal government should promote and 

support the development of an overarching guideline developed in a mul&-stakeholder process that 

more clearly dis&nguishes the major sectors of the IoT for use when dealing with concerns such as 

cybersecurity. 

This overarching guideline would serve as a reference tool to dis&nguish the opera&ng environments 

for the major sectors of the IoT and how cybersecurity concerns or issues would be addressed in a 

par&cular sector. For the guideline to be relevant it needs to be developed in a mul&-stakeholder 

process that is open and includes industry par&cipa&on across the various sectors (i.e., consumer, 

industrial, healthcare, finance, transporta&on). This guideline would not necessarily define the major 

IoT sectors, it is be[er used as guidance when cybersecurity legisla&on or regula&ons are being 

considered. 

An example of a high-level writeup that would be included in this guideline that targets the industrial 

IoT sector is provided below: The Industrial IoT or OT sector leverages exis&ng cybersecurity 

standards such as the IEC 62443 series of interna&onal standards that define requirements and 

processes for implemen&ng and maintaining electronically secure industrial automa&on and control 

systems. Industrial automa&on and control systems are used in nearly every industrial sector such as 

manufacturing, transporta&on, energy, and water treatment industries. There are also several 

conformity assessment and cer&fica&on programs that exist for these standards. When legisla&ve or 

regulatory language is developed targe&ng this sector, ideally it should reference these standards. 

I oppose including this Recommenda&on in the IoTAB report. The markets overlap and morph. The US 

government is not adept or agile in this context. Having the USG define market sectors risks legislators using 

these defini&ons and wri&ng them into new laws. I cannot see a posi&ve outcome from providing slowmoving defini&ons developed outside the market experts in industry, to, e.g., the Hill. 

Further, regulatory agencies should view this with extreme cau&on. They have statutory authority over 

sectors already defined by Congress. Should these guidelines redefine automo&ve, medical, airborne (drone) 

IoT sectors, the results are either unnecessarily duplica&ve, or in conflict with, the exis&ng statutory 

authori&es. 

Because the intent of the goal is to develop such guidance, it cannot be fixed by changing the wording. I 

propose dele&ng this recommenda&on from the draR IoTAB report. 

Best Regards, 

Page 1 of 2 
 

 

 

___________________________________________ 

Mike Bergman 

Vice President, Technology & Standards 

Consumer Technology Associa&on, producer of CES® 

m: +1(609) 865-4402 

@mbergman42 

CTA.tech | CES.tech 

Page 2 of 2