Internet of Things Advisory Board (IoTAB) Committee

Established by 9204(b)(5) of the William M. (Mac) Thornberry

National Defense Authorization Act for Fiscal Year 2021 (Pub. L. 116-283)

August 22 & 23, 2023

Virtual Meeting Platform: Webex

MEETING MINUTES

Board Members Present 

• Michael J. Bergman, Consumer Technology 

Association

• Dr. Ranveer Chandra, Microsoft

• Steven E. Griffith, National Electrical 

Manufacturers Association

• Tom Katsioulas, Global Semiconductor 

Alliance

• Debra Lam, Georgia Institute of Technology

• Robby Moss, Moviynt

• Nicole Coughlin, Town of Cary North Carolina

• Maria Rerecich, Consumer Reports

• Debbie A. Reynolds, Debbie Reynolds 

Consulting

• Dr. Arman Shehabi, Lawrence Berkeley 

National Laboratory

• Peter Tseronis, Dots and Bridges LLC

Board Members Absent

• Ann Mehra

• Nicholas Emanuel, CropX

• Prof. Kevin T. Kornegay, Morgan State 

University

Board Chairs and NIST Staff 

● Benson M. Chan, Strategy of Things Inc. (Chair)

● Daniel W. Caprio Jr., The Providence Group (Vice

Chair)

● Barbara Cuthill, NIST (Designated Federal 

Officer)

● Katerina Megas, NIST (Federal Working Group 

Co-Convener)

● Alison Kahn, NIST (Federal Working Group CoConvener)

● Greg Witte, NIST Contractor, (Report Editor)

● Brad Hoehn, NIST Contractor (Report Editor)

● David Lemire, NIST Contractor (Scribe)

Speaker(s):

● Manu Fontaine, Hushmesh
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 2

Action Items Over Both Days

Note: Names and roles are bolded to show ownership.

Report

In General

• Send Mr. Witte redline updates to the draft: All Board members

• Review the national standards strategy: All Board members

• Integrate themes into draft report: Mr. Witte

• A cross-reference will be established to enable tracking the relocation of specific recommendations: 

Mr. Witte

• Consider content approach for commentary sections, including adjacent technologies: Mr. Griffith, 

Ms. Rerecich, Mr. Katsioulas, Mr. Chan

• Reach out to person updating PPD-21 based on the Solarium Commission recommendations from the 

June meeting of the National infrastructure Advisory Council: Mr. Witte/NIST

Previous Speaker Recommendations:

• Collate speaker recommendations from previous speakers for Board review: Mr. Chan

• Board members to review the speaker’s recommendations from July:

o Chris Moore’s recommendations: Ms. Rerecich, Ms. Coughlin

o Ms. Fung’s recommendations: Ms. Mehra

o Chris Autrey’s recommendations: Mr. Chan

o Paul Eisler’s recommendations: Mr. Caprio, Mr. Bergman, Mr. Griffith

Specific Recommendations:

• An action to all subgroups to review and make recommendations as actionable as possible. 

o Mr. Witte suggested board members while reviewing should consider how they would act on a 

recommendation, or what their definition of “done” would be and suggested more “this is what you 

should do” is needed. 

• An action to public safety and healthcare subgroups to provide more clarity on what should be 

recommended (suggestions discussed were to suggest an alternative on what to investigate next or to 

start with the identification of barriers to identify clearer recommendations should be examined).

• By 8/31, Update intelligent traffic recommendations (including for small business): Mr. Griffith, Ms. 

Lam

• By 8/31, Create overarching carbon measurement recommendations and agricultural supply chain, 

sustainable infrastructure: Mr. Katsioulas, Mr. Griffith, Dr. Chandra (Dr. Chandra to send out 

initial recommendations copy)

• By 8/31, Update international recommendation 14.1: Mr. Bergman, Mr. Caprio

• By 8/31, Continue discussion on National Emerging Technology Office: Mr. Caprio, Mr. Bergman, 

Mr. Tseronis

• By 8/31, Update wording and split healthcare recommendation (2.7) into two recommendations: Ms. 

Rerecich, Ms. Reynolds

• By 8/31, Cybersecurity recommendation 6 – continue research and update: Mr. Katsioulas, Mr. 

Griffith

• By 8/31, Cybersecurity recommendation 7 – research VEX and update: Mr. Bergman

• By 8/31, Confirm with Dr. Chandra on generative AI recommendation: Mr. Chan
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 3

Personas / Use Cases / Examples

• By 9/20, all board members consider personas addressed by recommendation to make sure various 

personas are covered.

o Material related to industrial infrastructure: Mr. Griffith

o Input on consumer topics: Mr. Bergman and Ms. Rerecich

Report Graphics

• All board members to indicate or contribute graphics or statistics for the report where appropriate.

Schedule

● Review the draft IoTAB timeline. 

● Upcoming meeting dates: 

o September (26th-27th)

o October (24th-25th)

o Consensus needed on November and beyond with 60 days lead time to publish the FRN for the 

meeting.

● The IoTAB is looking at a one-year timeline with the following milestones:

o September: Board should target having all recommendations complete by end of this meeting.

o October: Board will review summaries and prioritizations.

o November: Board should target having a final draft report by the end of the meeting with some 

final adjustments being made in December. 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 4

IoTAB Meeting on Tuesday, August 22, 2023

Welcome and Chair’s Opening Remarks

Ms. Cuthill welcomed the attendees, opened the meeting, and introduced the chair, Mr. Benson Chan. 

Mr. Chan went over the agenda and goals for the meeting.

Slide deck: Chair Agenda Discussion Slides

● The discussion reviewed the expected outcomes for the day, the agenda, the draft report, and the 

logistics. 

Invited Speaker – Manu Fontaine, Hushmesh

Mr. Manu Fontaine, Hushmesh

Slide: Hushmesh IoTAB Slides

● Mr. Fontaine explained that his company was a “public benefit” cybersecurity startup. He stated that 

they have developed an approach to solve zero trust in a universal way, applying what he described as 

an “ambitious” concept. He described the concept as automating cryptographic security between any 

two points on the Internet, using what he called a Universal Naming System (UNS), which he was 

recommending the federal government should support. He said the UNS aligned with the concept of 

the domain name system but is for any kind of connected entity. 

● Mr. Fontaine explained the operating approach as never trusting, always verifying, and doing that in a 

global and automated way. This approach enables any two entities, be they people or non-person 

entities, to establish a pair-wise cryptographic relationship as needed.

● Mr. Fontaine stated that the Internet’s domain-centric architecture creates privileged insiders and 

precludes zero trust. He explained that the insiders manage keys, data, and security from a domaincentric viewpoint, with humans managing things at every level.

● Mr. Fontaine identified “confidential computing” as the enabling technology for the solution he is 

proposing. The use of confidential computing enables two critical features: attestation of hardware and 

software integrity and confidentiality of data in use even from system administrators. He said this 

technology is now virtually available in every cloud environment and in hardware implementations.

● Mr. Fontaine explained the approach as employing two types of enclaves (or actors). The first is an 

agent associated with an end entity, which may be a person, organization, device; anything that can be 

a communicating endpoint. The end entity is registered uniquely with its agent. The second actor type 

is a verifier that carries out the verification of attestation of the agent. End entities are connected with 

their agent. 

● Mr. Fontaine described the process that occurs when two end entities want to communicate. A verifier 

can run code and carry out a remote attestation that the agent is not leaking secrets and is behaving as 

expected. Verifiers can connect hierarchically in a recursive manner, so that a parent verifier higher in 

the hierarchy can confirm the attestation of both entities’ agents. Higher level verifiers perform 

verification of those lower in the hierarchy. The parent verifier attesting to the individual verifiers 

creates a secure channel through which public keys from the end entities can be exchanged in a trusted 

manner, providing a basis for a pair-wise connection between the end entities’ agents. 

● Mr. Fontaine then described how this concept can be generalize by connecting to Universal Name 

System servers as verifiers. He said that UNS servers would be positioned similarly to how DNS 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 5

servers are positioned today. He explained the important difference is that with UNS there are no 

humans with access to the key materials or the names exchanged between the actors, enabling the 

creation of artificially complex chains of custody. He explained that this was a naming system because 

it can handle publishing random names generated by the agents associated with end entities. He said 

such names can be shared offline and looked up through the UNS.

● Mr. Fontaine stated that a proof-of-concept system currently exists and will be demonstrated soon to 

the NIST identity team. He acknowledged that the scalability has not been demonstrated but the other 

properties have.

● Mr. Fontaine said that because UNS is hierarchical and recursive like DNS, it is globally decentralized, 

and some companies may just want to deploy a limited number of servers while others may to do more. 

Countries may want to deploy entire subnets by chaining many different servers. 

● Mr. Fontaine describe that with this approach, code is a digital asset that can be assigned a universal 

name and be wrapped and encrypted. Those pieces of codes can be moved around under the authority 

of specific humans or organizations and pushed to specific machines. He said Hushmesh is leveraging 

this mechanism to deploy agents virtually anywhere.

Group Discussion

● Mr. Chan asked about the current state of the proof of concept.

o Mr. Fontaine explained the proof-of-concept is deployed in an Azure cloud, saying it has all the 

pieces, includes chains of UNS servers and is functional. He described the first product as an 

identity provider where humans can register themselves and receive identity tokens (digital assets), 

signed using keys generated from within the infrastructure and completely shielded from humans. 

These identity tokens can be used to “mesh in” to a web application and get keys to encrypt data. 

He said the primary application at present was software supply chain security, which he described 

as at an alpha stage and can be deployed in the cloud with all of the necessary cryptographic 

primitives and exhibiting the principles he had explained.

o He said is scaling out across continents has not been proven. He stated they believe it is inherently 

scalable, because once you establish it you do not have to go back to the root. The commonality 

between specific agents can keep a copy of the keys to secure the connection between the two 

entities. He said the UNS behaves like a one-time meeting point, after which key exchanges can be 

direct once established. He also noted that while the universe of devices is “gigantic”, the number 

of connections between any two devices is limited, so there is a universe of sparse connections that 

don’t rely on continued connections to the UNS.

● Mr. Chan asked what aspects of this are proprietary?

o Mr. Fontaine repeated that Hushmesh is a public benefit company and wants the UNS to be 

operated as a public benefit. He said he wants to find a coalition of government or institutions to 

run the root UNS. He said the technology can be transformative, enabling a range of related 

businesses such a data security and identity. He said they are looking for a governance solution for 

the UNS, such as the UN or W3C, and described the situation as akin to the early days of DNS: 

Who is operating the DNS/UNS and should it be the government or a corporation? He stated 

Hushmesh is putting it out there for everyone to use it and governance needs to be determined.

● Mr. Chan asked if there are other companies working on a similar concept?

o Mr. Fontaine replied none that he was aware of. He described his company as a small startup 

implementing ideas that have been building for about 20 years. He said the key technology of 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 6

confidential computing only became available commercially a few years ago and enabled the ability 

to manage keys without exposing them. He noted there are other companies employing confidential 

computing for secure messaging and data vaults but that those are still domain oriented.

o Mr. Fontaine emphasized that the absence of domain authority is the key to the UNS concept. He 

noted there can still be domains of authorities, such as automakers over their cars, or law 

enforcement organizations, but their operating model would leverage the concepts of the UNS.

● Mr. Chan asked when Hushmesh would have something for the board to consider?

o Mr. Fontaine replied that the timeline is challenging due to the public nature of the board’s 

operations, meaning decisions must be made regarding how much information to expose.

Chair/Vice Chair Comments

Mr. Benson Chan, Chair & Mr. Dan Caprio, Vice Chair

Slide deck: Chair Agenda Discussion Slides

● Mr. Chan opened a session to discuss the progress of the board. He stated there has been a lot of progress 

since April while noting that some topic areas still needed to provide additional material. He invited 

board members to identify additional speakers the board should consider.

● Mr. Chan encouraged board members to provide bold recommendations, recognizing that some may 

not be immediately actionable but would still be worth considering. He pointed to the concept of a 

national emerging technology office as an example of a bold recommendation.

● Mr. Bergman suggested that the board should consider the draft report and ask whether they were 

missing the big picture. He suggested that subgroups should focus their efforts around the draft report, 

with the big picture as a topic to discuss at the next meeting; several board members indicated 

agreement.

● Ms. Lam suggested that the presentation needs to be more “public facing” and readable by those less 

familiar with the technology. She suggested board members read the draft for what’s missing, and for 

readability and impact, noting that the executive summary would probably be the main focus for many 

readers.

● Mr. Chan noted that the charter calls for considering the impact on small businesses and noted Mr. 

Griffith had recommendation in that area that should be taken into consideration.

● Mr. Katsioulas identified several aspects he felt were missing:

o A good justification for how the recommendations would lift barriers and enable growth;

o International aspects, particularly regarding connectivity, cybersecurity, and traceability;

o Critical infrastructure. 

● Mr. Witte concurred with many of the points raised and cited the value of having a template for 

providing key recommendations for each area. He suggested the report needs to “tell the story” and 

suggested the potential for more use cases. He noted that for many people IoT has become “routine”, 

even if they don’t resonate with that label.

● Ms. Kahn concurred with the points raised, noting there have been similar discussion in the Federal 

Working Group (FWG). She emphasized the need for the report to be readable and understandable, and 

the recommendations to be actionable.

● Ms. Megas emphasized the need to address how the Board’s recommendations will actually remove 

barriers and catalyze adoption of IoT. She stated her expectation that the FWG will have questions 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 7

about how the Board anticipates the recommendations being applied and the outcomes they will 

achieve. What problems will be solved, and how?

● Mr. Katsioulas suggested that a focus on use cases and identifying the “killer app” would help provide 

context to develop guidance on lifting barriers.

● Mr. Witte reviewed the timeline, noting that the Board was on track having an interim report by this 

meeting, and suggesting that remaining recommendations needed to be solidified by the end of 

September to leave time to work on messaging, tone, themes, and key takeaways. 

● Mr. Katsioulas asked whether the recommendation should include specific agencies.

o Mr. Witte replied there was considerable inconsistency across recommendations and suggested the 

Board should come to some agreement regarding level of detail.

o Mr. Chan concurred, saying he thought the original idea for the details was to provide context.

Potential Themes

● Mr. Chan displayed a proposed organization for the report content around selected themes.

● Mr. Bergman discussed an ongoing process dating back to March to collect themes to aggregate report 

content. Referring to the slide he pointed to themes on the left and potential content on the right. 

● Mr. Bergman described an example, where the theme is creating trust in IoT and the activities are 

making things more transparent, more secure, enhance privacy protections, explain data use and 

management. He walked through a number of other examples:
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 8

● Mr. Bergman noted that the FWG preliminary update on their web page included an additional theme 

that the Board hasn’t considered of “adjacent technologies”. These are technologies that could help 

deployment and adoption of IoT if the overlaps are handled properly. He suggested that the board 

should be on the lookout for adjacent technologies that could be flagged for the FWG’s attention.

Group Discussion

● Mr. Katsioulas discussed the theme of facilitating technology leadership. He suggested leadership was 

not just about technologies but also about platforms of aggregation and modernization that benefit all 

stakeholders.

● Ms. Rerecich stated she likes the idea of organizing by themes but doesn’t want to lose detailed 

recommendations in the process. She described the themes as high level and needing to be connected 

to specifics.

● Mr. Chan suggested the Board members consider potential additional themes.

● Mr. Witte asked if the themes would take the place of the umbrella recommendations currently in 

Section 9? Be the basis of a new set of subsections? And if so, would the report continue to have topical 

recommendations. 

o Mr. Chan agreed with that approach, but Mr. Caprio requested this decision be deferred until the 

current draft report was discussed. Mr. Chan agreed.

● Ms. Reynolds stated the report needed to include data provenance for lineage and suggested it could be 

woven into existing recommendations. 

● Mr. Chan asked if there was general consensus for applying the themes in the report and received no 

objections. There was agreement to use the themes in place of the existing section 9 umbrella 

recommendations and reorganize supporting recommendations as necessary. 

Discussion of the Draft Report

Mr. Witte shared the draft report for discussion: 18 August 2023 Draft Report

Comments on Draft Report

● Mr. Witte stated that there had been considerable progress, and reminded the members that the draft 

report is a point-in-time snapshot. He briefly reviewed the structure of the document:
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 9

o The Executive Summary will be drafted toward the end of the process.

o The new summary table of recommendations (Section 4) gives readers immediate access to the 

overall picture. 

o A description of the board’s work process will be provided in Section 5. 

o Section 6 will provide a discussion of related emerging technologies that are relevant to the success 

of IoT. He noted this section would also include the discussion on personas. 

o Section 7 describes umbrella topics derived from reviewing previous recommendations. He 

explained those recommendations show clear areas of overlap. 

o Section 8 will provide overarching findings.

o Section 9 will provide the details of all of the board’s recommendations.

● Mr. Witte then presented the summary table. He pointed out that it currently indicates supporting 

recommendations traceability to original recommendations from the May and July meetings, and a 

legend column to indicate the mechanism(s) associated with a recommendation. He noted that there 

aren’t graphics yet for the legend, and that the subgroup traceability column would eventually be 

removed. He said the summary table recommendations would be hyperlinked to the details for each 

recommendation. He also said that information on personas would be added to the table to see if that is 

beneficial, saying this would help to ensure that various stakeholders have been addressed.

● Section 6 provides discussion of the “adjacent” or “converging” technologies related to IoT: AI, 

blockchain, etc. He noted that the board would need to decide how to label those technologies.

● Section 7 discusses over-arching topics areas; it currently provides overviews, benefits, barriers, and 

justifications.

● Section 8 provides similar discussion as Section 7 but focuses on the topic areas called out in the 

enabling legislation. Mr. Witte noted that the approach to Sections 7 and 8 might be revised as the 

themes discussed earlier in the meeting are integrated into the report, including the possibility of 

combining the material into a single section.

● Section 9 is the recommendations section, with the detailed discussion of each recommendation. Mr. 

Witte noted the potential to put in front material describing how the presentation of recommendations 

is organized, along with using icons associated with mechanisms that can be associated with the 

recommendations. 

● Mr. Witte encouraged the board members to supply candidate graphics, saying there was support 

available to convert rough drafts to usable graphics, although he suggested that more camera-ready 

graphics were preferrable. He also requested statistics that could help support recommendations.

Organizing Themes

● Mr. Witte described how the sections for the themes discussed earlier would be organized. Each section 

would start with a summary, identifying the key and supporting recommendations, each linked to the 

detailed specifics. He said that recommendations should be actionable: things an agency should start 

doing, stop doing, or study. There would be introductory text, and information about the 

recommendation, including potential barriers to carrying out the recommendation. He noted the 

possibility that barriers might be grouped and moved earlier in the report.

● Mr. Witte said he had removed material regarding agencies that should be involved for each 

recommendation due to varying levels of input in the original recommendations, and that he would be 

restoring that material.

o Ms. Cuthill noted that recommendations regarding agencies should be from the Board, rather than 

from subgroups, particularly if choosing a lead agency from a list developed by a subgroup.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 10

o Mr. Witte suggested an alternative was to only identify lead agencies for overarching areas and 

noted that such identifications could only be suggestions.

● Mr. Witte reviewed the organization of Section 9. He explained that a number of overarching 

recommendations (e.g., data framework) had been created based on significant overlap of specific 

recommendations; these make up the first seven subsections of Section 9 in the report. The remaining 

seven subsections contain recommendations associated with more specific topics. He noted that the 

draft report included recommendations that would be discussed in this meeting.

● Mr. Witte invited the board to identify references to generate a bibliography. He pointed to a 

compliance matrix tagging specific recommendations back to the topics identified in the enabling 

NDAA. He expected to populate that matrix after the next round of revisions to the organization of 

recommendations and have it available in the next version.

● Mr. Caprio inquired where the recommendation for a White House office dealing with emerging 

technologies had been placed.

o Mr. Witte replied it is currently under sustainable infrastructure, along with related 

recommendations, but could move. 

o Mr. Chan stated he believed that would be moved, noting the recommendation had expanded since 

its origination in the sustainable infrastructure subgroup. He added that many recommendations 

may move as the themes are integrated into the report.

o Mr. Katsioulas described that recommendation as an umbrella for many things.

o Mr. Witte suggested it could be moved under the topic of the nation taking leadership and pointed 

out other recommendations might also be moved.

● Mr. Witte turned to questions regarding certain recommendations that he hoped to resolve during this 

meeting.

Supporting 

recommendation 1.3

Conformance to any specific set of requirements should be voluntary.

● Mr. Witte said, regarding the recommendation that conformance to specific sets of requirements should 

be voluntary, the draft report offers a revised wording that removes the reference to specific programs.

o Mr. Bergman stated he believed the proposed words were the correct interpretation.

o Mr. Caprio noted there is a similar recommendation for public/private partnerships in the 

international recommendations.

Supporting 

recommendation 1.4

The government should examine opportunities to use the notional IoT Data 

Framework to support and document privacy considerations.

● Mr. Witte noted various framework recommendations, and the opportunity to integrate the discussions 

from cybersecurity and privacy. He asked whether the Board was advocating for the creation of a 

schema / taxonomy / model for how data should be used and shared.

o Ms. Reynolds stated she believed Mr. Witte’s statement was accurate.

o Mr. Bergman pointed out that the term framework could be problematic, given the existence of 

other frameworks such as the NIST Privacy Framework, and recalled the Board discussing moving 

away from the term. He suggested that the term should be avoided unless the Board is advocating 

for a “NIST type” framework.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 11

o There was consensus for using “model”.

o Mr. Witte suggested a more complete description would be appropriate. He summarized as the 

Board is identifying a need to understand how data should be used, shared, and stored, and for a 

taxonomy for the data.

o Mr. Griffith noted that there is both machine data, which could be used for process improvement, 

and personal data with privacy implications, and suggested a taxonomy that addressed these 

distinctions was needed.

o Mr. Katsioulas suggested a reference model with a taxonomy underneath it. 

Supporting 

recommendation 1.6

The government can encourage and foster data policies that drive economic 

growth, such as through this framework.

SSC-R19 (from May 

minutes)

Establish data policies that drive economic growth via frameworks that facilitates 

Data Monetization Security, Privacy, Data Sharing, Ownership, Control, 

Licensing etc.

● Mr. Witte noted the potential for overlap among recommendations. He pointed to recommendation 1.3 

as potentially overlapping with SSC-R19. He suggested that Board members reviewing the report 

should look for opportunities to eliminate redundancy. He pointed to workforce as an area where there 

are recommendations to improve the workforce for almost every topic area. It is important to find the 

right level for individual recommendations versus a single recommendation that addresses multiple 

topics while retaining nuance regarding the needs of individual topic areas, particularly with regard to 

barriers and mechanisms. He encouraged the board to consider opportunities for combining 

recommendations.

o Mr. Chan noted there wasn’t a workforce subgroup, so multiple similar recommendations surfaced. 

He suggested that once the recommendations were substantially complete, they could be reexamined with a “workforce lens”. He said he was starting to see some of the gaps.

o Mr. Witte suggested the potential for a recommendation for the government to establish how we 

would provide the training and education and write better job descriptions in this field. He 

suggested that during the September meeting the Board could review the recommendations for 

opportunities to bundle, separate or converge, and to draft better content for Sections 6, 7, and 8.

o Mr. Katsioulas pointed out that Board members need to review the entire report draft to prepare for 

the activity that Mr. Witte had described.

● Mr. Witte called attention to highlights he had placed in the table for board members to review potential 

overlap across requirements. He noted that some recommendations were connected back to the 

recommendations discussed in May.

Supporting 

recommendation 2.4

The federal government can facilitate and support the adoption of smart city and 

sustainable infrastructure standards.

SUS-R05 (from 

May minutes)

The federal government should facilitate and support the development and use of 

smart city and sustainable infrastructure reference models.

Supporting 

recommendation 2.6

Agencies should advocate for the implementation and adoption of interoperable 

data standards for public safety IoT.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 12

● Regarding the recommendation for supporting interoperable data standards, Mr. Witte noted there had

been discussion about clarifying the scope. 

o Mr. Katsioulas described this recommendation as “too general” and suggested that defining the 

sub-bullets of the reference model could be a tool to clarify the scope. 

o Mr. Witte concurred.

Supporting 

recommendation 2.7

Agencies can promote and, if necessary, develop a protocol for data exchange 

standards for IoMT (Internet of Medical Things) for interoperability, and promote 

the adoption of these standards. Solutions might include protection for medical 

data in mobile apps and IoT devices that is similar to the current Health Insurance 

Portability and Accountability (HIPAA) Act provisions.

● Mr. Witte described recommendation 2.7 as “pending” and needs feedback from the healthcare team. 

Supporting 

recommendation 3.6

The Federal Government should update Presidential Policy Directive 21 

(PPD-21): Critical Infrastructure Security and Resilience requiring a sectorspecific Internet of Things (IoT) data strategy.

● Mr. Witte asked what the Board’s intent was regarding the recommendation to update PPD-21. There

was a broad discussion about a range of federal policy documents in need of updating. NIST was 

requested to ask the participants in the IoT FWG if they are aware of efforts to update PPD-21, and if 

those efforts included mention of IoT. 

● Ms. Megas asked for clarification on what barriers result from IoT not being included.

Supporting 

recommendation 4.2

The federal government should actively promote and support the adoption of 

satellite narrowband IoT systems for agricultural IoT, with the aim of improving

connectivity, data collection, and decision-making in rural and remote agricultural 

areas.

● Mr. Witte requested the status of this recommendation, recalling a discussion from July over 

harmonizing standards. 

o Mr. Bergman advocated changing the language: He suggested appropriate language would focus 

on adopting communications technologies for IoT more suitable for precision agriculture 

applications, with narrowband satellite communications as an example.

Key 

recommendation 

10.0

Develop a comprehensive national strategy for agricultural IoT to establish a clear 

vision and roadmap for the integration of IoT in agriculture, addressing current 

challenges, fostering innovation, and promoting long-term sustainability and 

competitiveness of the agricultural sector.

● Mr. Witte noted that this requirement regarding a comprehensive strategy needed refinement and 

greater specificity, and that additional input is needed.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 13

Supporting 

recommendation 

10.3

The federal government should actively promote and support the adoption of 

Generative AI applications for agricultural IoT, with the aim of improving 

decision-making, optimizing resource utilization, and enhancing productivity in 

the agricultural sector through innovative and data-driven solutions.

● Mr. Witte noted a question from the previous meeting whether it was premature for the government to 

promote generative AI for agriculture. 

o Mr. Chan stated that generative AI is coming, and the government should plan for it, not just for 

agriculture but across many sectors. Government leadership would include establishing capabilities 

and policies. 

o Mr. Katsioulas described the recommendations as “very general”, saying more specific guidance 

is need that itemizes the activities that are needed.

o Mr. Witte requested status on this recommendation, and Mr. Chan directed him to check the 

meeting minutes. 

● Mr. Witte noted the need for expanding on the recommendations for healthcare and public safety. He 

said a benefit of having the consolidated table is the ability to see the coverage for various topics.

Supporting 

recommendation 

11.2

The federal government should facilitate and support the research, development 

and deployment of low cost air quality sensors.

● Mr. Witte suggested that during their review Board members can also look for opportunities to broaden 

the recommendations. He used the example of the environmental monitoring recommendation 

regarding air quality sensors, saying that could expand to water quality, noise pollution, earthquake 

monitoring, etc.

● Mr. Witte acknowledged that he is already aware of additions to the table. He stated he will process

redlines, comments, and additional material from Board members.

o Ms. Cuthill proposed a deadline of 31 August to return comments on the draft report to NIST.

o Mr. Chan asked Board members to also consider where individual recommendations should go 

relative to the themes discussed earlier in the session.

o There was consensus to move the leadership theme to be first in the list.

o Mr. Witte stated he would include a cross-reference to enable tracking the relocation of specific 

recommendations.

Report Takeaways

● Mr. Chan called for a discussion of Board members’ takeaways from the draft report review.

● Mr. Witte stated there are many good ideas in the recommendations but that a fair number are not 

actionable or sufficiently specific. He suggested board members while reviewing should consider how 

they would act on a recommendation, or what their definition of “done” would be. He was positive 

about the breadth of ideas but suggested more “this is what you should do” is needed. Mr. Witte 

suggested using the S.M.A.R.T.1 goals approach but acknowledged that may not apply to every 

recommendation. 

1 Specific; Measurable; Achievable, Realistic; Time-based.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 14

● Mr. Witte observed that in some areas (e.g., public safety, healthcare) there was apparently lack of 

clarity about what to recommend. He suggested an alternative for those cases would be to recommend 

what should be investigated next.

o Mr. Katsioulas suggested for those cases it would be helpful to start with identification of barriers, 

which should lead to recommendations. 

o Mr. Chan said there will be different types of recommendations and while some are not easily 

actionable, the Board should try to get as actionable as possible. 

Specific Sections / Topics (Editor’s walkthrough)

● Mr. Witte asked for input regarding the legend. Preferences from the discussion were to use icons to 

create a visual snapshot and place them after each recommendation since there might be multiple icons.

Supporting 

recommendation 1.6

The government can encourage and foster data policies that drive economic 

growth, such as through this framework.

● Mr. Witte pointed to a wording change he had made from “establish policies” to “encourage policies” 

and requested feedback. There was concern the recommending the creation of policies isn’t actionable, 

compared to recommending creating guidance or regulations. A decision was deferred pending further 

discussion. Mr. Witte noted that there are several recommendations that discuss policies, and he would 

review those further.

Key 

recommendation 2.0

The Federal Government should establish methods to foster interoperability for 

IoT technology, including through the use of consistent models, protocols, and 

schemas

● Mr. Witte stated that all of the recommendations regarding standards are about promoting existing 

standards for interoperability, reliability, and security, rather than a call for new standards.

Supporting 

recommendation 3.5

The Administration should encourage Congressional support to deploy IoT 

cybersecurity labeling initiatives, including establishing incentives for 

manufacturers to participate.

● Mr. Witte asked whether the recommendation to encourage congressional support for cybersecurity 

labeling initiatives has changed now that the Cyber Trust Mark work has been announced. 

o Mr. Bergman noted that he had submitted relevant edits, included in the draft, that generalized the 

recommendation beyond the consumer IoT in line with government activity in this area.

Key 

recommendation 6.0

The Federal Government should lead in the adoption and integration of sustainable 

infrastructure and emerging technologies into the US economy and infrastructure.

● Mr. Witte noted the recommendations pertaining to the use of energy efficient technologies in new 

construction and government building operations. He suggested that there are opportunities to be more 

specific about energy efficiency and addressing climate change and encouraged Board members to 

provide additional clarity and detail in their comments.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 15

Key 

recommendation 7.0

The federal government should invest in and promote education and workforce. 

Workforce and education are broad topics. Specialized training programs could 

start as early as high school and include cybersecurity topics. Inclusion of yearly 

certifications is encouraged.

● Mr. Witte pointed out that the workforce recommendations could include Mr. Chan’s observations 

about the impact of the overall shortage of labor, and the limits it creates for manufacturing and 

deploying IoT. He suggested that Board members think about how to provide more clarity on the 

challenges and benefits associated with workforce especially in increasing efficiencies through IoT 

deployment.

Supporting 

recommendation 

10.1

The federal government should consider subsidizing the use of IoT in farms.

● Mr. Witte noted that the write-up for this recommendation is fairly brief, whereas other 

recommendations may have the justification taking an entire page. The question to the board - what is 

the right level of detail? 

o Mr. Chan replied that it could be different for each recommendation, and as long as someone can 

identify the context behind the recommendation that is sufficient. He expressed confidence that Mr. 

Witte is a good judge of the understandability of a recommendation and said that more complex 

recommendations require more support.

o Mr. Witte contrasted this to the level of detail in the supply chain traceability recommendations. 

He expressed the desire for guidance from the board to find the balance between recommendations 

expressed in a few sentences versus a few pages. 

o Ms. Cuthill stated that disagreement among comments on a section of the report will need to be 

resolved by the board. 

Commentary Section

● Mr. Chan pointed to the Section 6 (Commentary and Discussion Topics), which was created early on 

for topics that didn’t fit into recommendations. He noted that many of the subsections could be 

considered as “adjacent technologies” and described the section as containing topics that the Board, as 

industry representatives, want to call to the FWG’s attention. Mr. Chan said the section is currently 

mostly a placeholder and there is a need for individuals to lead each subsection and develop content.

o Mr. Witte added that additional topics could be added to this section. He described it as an 

opportunity for the Board to lead the FWG.

● Mr. Katsioulas asked for clarity on the approach for framing content for this section in order to present 

it in a consistent manner.

o Mr. Chan said this may differ by topic. He suggested that use cases could go into Sections 7 and 8. 

● Mr. Katsioulas described a list of examples he had provided to Mr. Chan and Ms. Cuthill regarding the 

convergence of IoT with a number of the adjacent technologies. Mr. Witte asked what Mr. Kat

Katsioulas meant by a use case?
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 16

o Mr. Chan suggested those examples would fit in the opportunity section, and that AI could be 

discussed both in specific use cases and more broadly in Section 6.

o Mr. Katsioulas indicated he felt it would be helpful to use these examples to discuss adjacent 

technologies in the context of an application. He expressed the need to consider technology in 

relation to specific application markets. 

o Mr. Griffith stated he could provide material related to industrial infrastructure.

● Mr. Chan called for volunteers. 

o Mr. Griffith took an action to do some research on the topics identified in Section 6.

o Mr. Bergman and Ms. Rerecich said they could provide input on consumer topics.

o Mr. Witte suggested the regulations and standards were well-covered elsewhere and could be 

removed from Section 6. Mr. Bergman concurred.

o Mr. Griffith suggested adding industrial as a topic in parallel with consumers and smart homes.

● Ms. Rerecich asked for clarification on the desired deliverable.

o Mr. Chan described it as an opportunity to discuss topics the Board feels the federal government 

should know about. He said it can present context about these topics or possibly use cases or 

describe challenges and issues unique to those topic areas. He discouraged adding 

recommendations in this section.

Graphics

● Mr. Witte discussed the potential for using graphics in the report. He encouraged the contribution of 

graphics to convey ideas visually and break up the extensive text of the report. He also suggested 

statistics as another useful way of providing variety and strengthening the justifications. He noted that 

NIST can produce infographics if the Board has ideas for such. 

Recommendations from Speakers at July Meeting

Mr. Chan, Chair

Document: Outside Speaker Recommendations

● Mr. Chan explained that the recommendations from July meeting outside speakers, as well as from 

previous meetings, had been extracted and sent to Board members as part of the pre-read materials.

o Ms. Cuthill clarified that recommendations in the table from Ms. Fung’s presentation were crafted 

for an IEEE committee, and that Ms. Fung wanted to bring them to the board’s attention. She said 

the goals was to make the recommendations easily accessible to the board for individual 

consideration. She pointed out that the presentations from the meeting, available on the Board’s 

website, provide context for better understanding the recommendations.

● Mr. Chan assigned Board members to consider the recommendations:

o Chris Moore’s recommendations: Ms. Rerecich and Ms. Coughlin

o Ms. Fung’s recommendations: Ms. Mehra 

o Chris Autrey’s recommendations: Mr. Chan took an action to consult further with Mr. Autrey.

o Paul Eisler’s recommendations: Mr. Bergman noted he was involved in developing these 

recommendations. He suggested:
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 17

▪ US hosting of standards meetings (#1) and efforts at reforming standards body governance (#2) 

should be taken up by the International subgroup.

▪ Reforming standards body governance (#2) 

▪ Incentives for small business participation in standards work (#3) could go into the commentary 

write-up about small business.

Action Items and Wrap Up

Slide deck: Chair Agenda Discussion Slides

● Mr. Chan shared the Day 2 agenda.

● Mr. Chan asked which subgroups have recommendations.

o Privacy, International, Cybersecurity, Transportation, possibly Agriculture

● Mr. Chan announced there was consensus to end the Day 1 meeting.

Closing

Ms. Cuthill adjourned the meeting. 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 18

IoTAB Meeting on Wednesday, August 23, 2023

Opening Remarks

Ms. Cuthill opened the day’s meeting. She thanked people for attending and turned the meeting over to 

the chair, Mr. Chan.

Mr. Chan reviewed the agenda and introduced the invited speakers.

● Shared slides of the agenda for Day 2.

● Today will go through recommendations that were new that were not in the report as well as ones that 

needed an update. Some may have been incorporated, but today we will go through them today.

● Noted that some board members were not with us today and would need to shift around 

recommendations.

Recommendations Requiring Discussion – Not currently included in draft 

Report

Smart Transportation

Mr. Steve Griffith

Document: Smart Transportation Draft Recommendations

Smart 

Transportation: 

Recommendation 6

The federal government should promote the development and adoption of policies, 

procedures, and funding methods that can accelerate the adoption of smart, 

connected, and electrified transportation technologies. Many of these technologies

incorporate the use of IoT.

Moving Forward Issues:

• Provide more specificity regarding funding sources that might be applied.

● Mr. Griffith described the challenges for small businesses and local governments to afford investments

in such technologies, which can improve safety, reduce emissions, assist in finding charging stations 

for electric vehicles, improve traffic flow, and provide other benefits.

Smart 

Transportation: 

Recommendation 

XX

The federal government should promote the development and adoption of policies, 

procedures, and funding methods that can accelerate the adoption of IoT 

technologies manufactured by small business and startup organizations.

Held back for 

further work

Issues:

• Not enough clarity on the recommendation, may apply to a broader 

recommendation outside of just transportation.

● Mr. Griffith described some of the challenges small business face getting capital funding for projects, 

and their difficulties competing against larger organizations. He said his discussions were with 

transportation sector businesses, but the recommendation was broader.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 19

● Ms. Lam noted the potential overlap with the previous recommendation and suggested perhaps one 

should focus on local government and the other on small businesses, noting that the goals are similar,

but the tactics would be different. For example, business have to gain access to government 

procurement processes to bid as vendors. She agreed both were broader than transportation.

● Dr. Chandra noted that customers often have concerns about the longevity of small businesses and 

startups to support the technology they provide.

o Mr. Chan suggested this should be identified as a barrier.

Environmental Monitoring

Dr. Ranveer Chandra

Document: Environmental Monitoring Draft Recommendations

Environmental 

Monitoring 

Recommendation 4

Implement a nationwide IoT water monitoring infrastructure.

Approved to move 

forward

Issues:

• Develop supporting recommendations with additional specifics

● Dr. Chandra explained that NOAA has a water model based on satellite images driving simulations. He 

described this as providing a “macro level” understanding of water use, but that micro level information 

is unavailable. He described the recommendation as adding transparency to supplement the NOAA 

data. He noted that many companies have made commitments around water and other environmental 

concerns, and the type of monitoring recommended could measure progress against those 

commitments. 

● Mr. Bergman suggested recommending a study and pilot programs to determine the most effective 

approach to micro-level water monitoring, leading to broader deployment.

o Dr. Chandra said he would develop a corresponding recommendation.

Environmental 

Monitoring 

Recommendation 4

Encourage sharing of IoT Technologies to Estimate and Mitigate Carbon 

Emissions in Farms

Approved to move 

forward

Issues:

• Develop overarching recommendation regarding use of IoT for 

monitoring various types of systems (e.g., environmental, transportation)

• Group this and other similar recommendations as supporting

● Dr. Chandra explained the difficulties in measuring the generation of greenhouse gases from 

agriculture, saying the recommendation included both the use of IoT for measurement and the sharing 

of data since the data system today is “closed”. He described this as a two-part recommendation, 

covering both monitoring for data collection and data sharing. He said that data doesn’t need to be 

shared for free but there is a need to be more granular understanding carbon emissions from farms.

● Dr. Chandra acknowledged the need to anonymize data and protect trade secrets. He also related this 

recommendation to transparency requirements that are becoming common in Europe. He also noted 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 20

incentive funding provided by USDA to promote particular agriculture practices, saying right now there 

is no way to monitor the results.

● The Board concluded this recommendation should be kept, and an overarching recommendation drawn 

from it.

International Considerations

Mr. Dan Caprio

Slides: International Draft Recommendations

International 

Recommendation 

14.1

The IoTAB strongly supports the voluntary public/private partnership that created 

the US Cyber Trust Mark.

Held back for 

further work

Issues:

• Mr. Bergman and Mr. Caprio to develop revised language

● Mr. Caprio noted the language from the White House announcement and explained that the 

international element is a State Department commitment to engage partners and allies and pursuing 

mutual recognition. He acknowledged this recommendation is not covering new ground but said it is 

important for the board to agree to this, saying there is both industry and international interest. 

● Mr. Bergman noted that many government agencies would have a role related to this recommendation 

and suggested alternative language:

o The US Department of State must be committed to supporting the sector relevant agency and NIST 

for each of the mark programs, and industry, to engage allies and partners ... (Mr. Bergman’s 

proposal was incomplete).

● Mr. Bergman and Mr. Caprio agreed to work offline to refine and complete Mr. Bergman’s phrasing.

International 

Recommendation 

14.2

The government should create internationally compatible data minimization 

guidance related to IoT devices, aligning with the NIST Privacy Framework and 

NIST Cybersecurity Framework principles.

Approved to move 

forward

Issues:

• None

● Ms. Reynolds explained this recommendation had been revised from the version presented at the July 

meeting, with recommendation to create a data minimization international standard changed to creating 

international-compatible data minimization guidance. She said that data minimization is inherently

supportive of privacy-by-design, which is addressed in a separate recommendation.

Privacy Recommendations

Ms. Debbie Reynolds

Slides: Privacy Recommendations

Document: Privacy Draft Recommendations
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 21

Ms. Reynolds shows the list of privacy recommendations, noting that #4 had been updated since the July 

meeting and #8 (privacy by design) is new.

Privacy 

Recommendation 4

Include IoT in US Federal Privacy Regulation Proposal

Approved to move 

forward

Issues:

• None

● Ms. Reynolds explained that there is a push toward getting some type of federal data privacy law or 

regulation, noting there are at least proposals before Congress. She pointed to increased enforcement 

of existing laws, for example by the FTC, and increasing friction internationally. She said the proposal 

in this recommendation is to ensure IoT is included in any proposed federal privacy legislation, and the 

rewording had removed references to any specific legislation.

Privacy 

Recommendation 8

Promote "Privacy by Design" in IoT device development, deployment, and 

implementation

Approved to move 

forward

Issues:

• None

● Ms. Reynolds stated this recommendation aligns with the U.S. national strategy for advancing privacypreserving data sharing and analytics. She also related it to the national cybersecurity strategy 

implementation plan call to drive development of secure-by-design and secure-by-default hardware and 

software. She stated that privacy-by-design will also with international data standards, noting the 

concept’s presence in the EU GDPR and ISO standards. 

Sustainable Infrastructure

Mr. Dan Caprio, Mr. Benson Chan

Slides: Recommendations – Sustainable Infrastructure – July 18-19, 2023

Sustainable 

Infrastructure R11

Establish a National Emerging Technology Office

Held back for 

further work

Issues:

• Mr. Caprio and Mr. Bergman to refine, focusing on the outcome rather 

than the mechanism.

• Consider the potential impacts of S.18.73 and S.1577.

● Mr. Chan explained this had relates to the recommendation for an emerging technology office point of 

contact in federal agencies (Sustainable Infrastructure R08).

● Mr. Caprio described this proposal as one of the overarching themes, related to the opportunity for the 

federal government, especially the White House and the OSTP, to lead on emerging technologies. He 

said that without leadership things don’t get appropriate attention. He described the goal as providing

for an early warning system for emerging technologies to ensure there is coordination with federal 

agencies and state and local governments. He said this was a way of applying lessons learned from the 

IoT to future emerging technologies. Mr. Caprio said the recommendation avoids specific technologies 

in order to be forward-looking.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 22

● Mr. Caprio clarified this would be a supporting recommendation under the theme of emerging 

technologies.

Group Discussion

● Mr. Bergman suggested an alternative approach of recommending that OSTP add a critical emerging 

technology focus to their charter and identifying that IoT should be viewed as a critical emerging 

technology. He noted that OSTP staffing has been restored under the current administration. He noted 

that having two offices in the White House with overlapping responsibilities can be problematic.

● Mr. Caprio said he wanted to make sure the proposal was “emphatic”. He expressed concern that OSTP 

has not been performing the coordination function but acknowledged that the creation of a new office 

could take a very long time.

● Ms. Reynolds emphasized the need to recognize the gap in ownership for emerging technologies, 

whether or not a new office is created.

● Mr. Bergman suggested focusing on the outcome, rather than the mechanism to achieve it. He described 

the outcome as the federal government establishing more priority for emerging technologies, including 

IoT, within the executive office. 

● Mr. Chan noted that the proposed legislation listed on slide2should be considered. He also suggested 

considering S.1577.

3

 He suggested that how the legislation plays out may impact how the board talks 

about it. 

Cybersecurity Recommendations 

Mr. Michael Bergman

Slides: Cybersecurity Slide Deck

Document: Cybersecurity Draft Recommendations

Mr. Bergman shared two new recommendations from the cybersecurity subgroup.

Cybersecurity R.06

The federal government should promote and support the development of an 

overarching guideline developed in a multi-stakeholder process that more clearly 

distinguishes the major sectors of the IoT for use when dealing with concerns 

such as cybersecurity. 

Held back for 

further work

Issues:

• Intent and goals of recommendation remain unclear

• Concerns about conflict with already-defined statutory authorities of 

federal agencies

● Mr. Griffith explained the subgroup sees a need for guidance that distinguishes the types of IoT (e.g., 

consumer, industrial, process sensors) since each sector has distinctive risk criteria. He emphasized the 

subgroup was not trying to define the sector but rather looking for guidance from a multi-stakeholder 

process looking across sectors to create guidance. He noted that the standards applied in each sector are 

distinctive, along with other variations such as attack surfaces, privacy concerns, and degree of physical 

and life safety implications. He suggested the results could also be helpful for international alignment.

2 S.1873 - Global Technology Leadership Act

3 S.1577 - Oversee Emerging Technology Act
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 23

He acknowledged the challenges in implementing this recommendation, given the mix of existing 

regulations, and said the subgroup was looking to the board to help refine it.

● Mr. Katsioulas added that the main goal was to define categories and allow different agencies to set 

appropriate criteria for their areas of responsibility.

● Mr. Bergman pointed out that agencies already have statutory authorities, which aren’t easily changed. 

He did concur with a goal of keeping regulations regarding consumer IoT from intruding into other 

areas.

● Mr. Witte suggested that the concepts in this recommendation could be discussed in Section 6 of the 

report, saying they could be presented as context for the report.

Cybersecurity R.07 The government should consider additional ways to highlight those 

vulnerabilities most likely to be applicable to IoT product developers.

Held back for 

further work

Issues:

• Concerns about ability to establish and maintain IoT-oriented 

vulnerability lists or tags from existing vulnerability databases.

• Uncertainty about appropriate mechanisms to publish this information.

● Mr. Bergman described the intent as to highlight security vulnerabilities most relevant for IoT product 

developers. He noted the extensive guidance on vulnerabilities from many sources but explained that 

presently it is incumbent on developers to identify, and address, known and critical vulnerabilities in 

their designs and there is no guidance to focus on vulnerabilities relevant to IoT. He stated that more 

focused guidance or a set of usable filter criteria for the long lists would help an IoT developer address 

critical and known vulnerabilities. He suggested that either flags on vulnerabilities in existing databases 

or dedicated lists of IoT-relevant vulnerabilities could be an implementation approach and

acknowledged that it would need to be maintained.

● Mr. Katsioulas suggested that the sector risk management agencies should identify the most critical 

vulnerabilities for their sectors. He also suggested that VEX4 might be applicable to this need.

o Mr. Bergman replied that VEX relates to information exchange and probably isn’t applicable to 

this recommendation.

Healthcare Recommendations

Ms. Maria Rerecich

Document: 18 August 2023 Draft Report

Ms. Rerecich requested updates on two recommendations contained in the draft report.

Report 

Recommendation 

2.7

Agencies can promote and, if necessary, develop a protocol for data exchange 

standards for IoMT (Internet of Medical Things) for interoperability, and promote 

the adoption of these standards.

Held back for 

further work

Issues:

• Ms. Rerecich and Ms. Reynolds to rework into separate interoperability 

and privacy recommendations.

4 Vulnerability Exploitability eXchange; see CISA VEX Use Cases.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 24

● Ms. Rerecich inquired about the status of health recommendations for “HIPAA-like protection of 

medical data in mobile apps and IoT devices”.

o Mr. Witte stated it is recommendation #2.7 in the draft report, grouped with the data 

recommendations and tagged as “(Under Review)”. He noted the potential for reorganization under 

the new themes.

o Ms. Rerecich stated this recommendation was intended to be more about privacy of the data than 

interoperability, saying that it would be possible to be interoperable without protecting privacy and 

vice versa.

o Mr. Bergman noted that the “if necessary, develop” language was counter to the goal of using 

industry standards wherever possible. He noted that government agencies don’t normally develop 

protocols, rather they are developed by industry consensus.

Draft Report 

Recommendation 

13.1

Raise Priority for IoMT to Healthcare Facilities’ Executive Leadership Teams

Moving forward in 

principle

Issues:

• Reword to emphasize the government’s role in advising healthcare 

organization leadership.

● Mr. Witte stated that his notes from the May meeting regarding recommendation 13.1 indicated that 

what remained to be resolved was to whom it should be directed, specifically what is mean by 

“healthcare facilities’ executive leadership teams”. He indicated there was consensus in May on raising 

the priority.

o Ms. Rerecich said the intent was to affect how a healthcare facility’s or corporation’s leadership 

focuses time, attention, and budget with regard to IoMT versus IT, and to make IoMT equally 

important. The focus is the people making those decisions.

● Mr. Chan asked what the federal government’s role in this would be?

o Mr. Witte suggested an FDA or HHS advisory to remind healthcare leaders to consider this in their 

priorities. Ms. Rerecich concurred.

o Mr. Witte suggested rewording to focus on the government advising healthcare leadership with 

regard to the priority of IoMT.

Other Business

● Mr. Witte referred to the day 1 discussions regarding updating PPD-21 and pointed to a report from the 

June meeting of the National Infrastructure Advisory Council that says they are working on an update 

to PPD-21 based on Solarium Commission recommendations. Mr. Witte stated he had a CISA contact 

the board could contact. He stated he was confirming a rumor that had been discussed on day 1.

● Mr. Chan opened the floor for other topics the board should discuss.

o Mr. Witte stated he will reorganize the recommendations using the themes, and said he believes

the meeting had addressed most of the concerns highlighted in the current draft. He asked for 

feedback on the existing report, especially pointers on reducing redundancy or adding crossreferences.

o Mr. Witte asked about the board’s resolution regarding the recommendation promoting generative 

AI. He noted the recommendation was written in support of precision agriculture but could be 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 25

applied more broadly. He recalled discussion from the May meeting regarding concerns about the 

maturity of generative AI.

▪ Mr. Chan stated he believed it was premature to promote generative AI. He acknowledged that 

the government would have a role in the application of AI in general.

▪ Mr. Reynolds noted that the White House has a “blueprint” for an AI bill of rights.

▪ Mr. Chan created an action to revisit this recommendation with Dr. Chandra.

Action Items and Wrap-up

Mr. Chan, Chair

● Mr. Chan shared the action items below on screen during the meeting:

Meeting Schedule

● The next meetings are set as: 

o September 26th and 27th

o October 24th and 25th
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, August 22-23, 2023

Page 26

● No consensus was reached regarding meeting dates for November and beyond. Ms. Cuthill reminded 

the board that 60 days lead time is needed to publish the FRN for the meeting.

o Mr. Chan will coordinate additional meeting dates via email.

Ms. Cuthill adjourned the meeting.