1 NIST Internal Report

2 Publication Identifier

3 Recommended Cybersecurity 

4 Requirements for Consumer5 Grade Router Products

6 Initial Preliminary Draft

7 Michael Fagan 

8 Katerina Megas 

9 Paul Watrobski 

10 Jeffrey Marron 

11 Barbara Cuthill

12 David Lemire

13 Brad Hoehn

14 Chris Evans
15 NIST Internal Report

16 Publication Identifier

17 Recommended Cybersecurity 

18 Requirements for Consumer19 Grade Router Products

20

21 Initial Preliminary Draft

22 Michael Fagan 

23 Katerina Megas 

24 Paul Watrobski 

25 Jeffrey Marron 

26 Barbara Cuthill

27 Applied Cybersecurity Division

28 Information Technology Lab

29 David Lemire

30 Brad Hoehn

31 Chris Evans

32 HII

33

34 December 2023

35

36 U.S. Department of Commerce 

37 Gina M. Raimondo, Secretary

38 National Institute of Standards and Technology 

39 Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology
ii

40 Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in 

41 this paper in order to specify the experimental procedure adequately. Such identification does not imply 

42 recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or 

43 equipment identified are necessarily the best available for the purpose.

44 There may be references in this publication to other publications currently under development by NIST in 

45 accordance with its assigned statutory responsibilities. The information in this publication, including concepts and 

46 methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, 

47 until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain 

48 operative. For planning and transition purposes, federal agencies may wish to closely follow the development of 

49 these new publications by NIST. 

50 Organizations are encouraged to review all draft publications during public comment periods and provide feedback 

51 to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at 

52 https://csrc.nist.gov/publications.

53 NIST Technical Series Policies

54 Copyright, Use, and Licensing Statements

55 NIST Technical Series Publication Identifier Syntax

56 Author ORCID iDs

57 Michael Fagan: 0000-0002-1861-2609 

58 Katerina N. Megas: 0000-0002-2815-5448 

59 Paul Watrobski: 0000-0002-6449-3030 

60 Jeffrey Marron: 0000-0002-7871-683X 

61 Barbara B. Cuthill: 0000-0002-2588-6165

62 Preliminary Draft Release Period

November 30th, 2023 - December 21st 63 , 2023

64 Submit Feedback and Comments

65 iotsecurity@nist.gov

66

67 National Institute of Standards and Technology

68 Attn: Applied Cybersecurity Division, Information Technology Laboratory

69 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

70 All comments are subject to release under the Freedom of Information Act (FOIA).

71
iii

72 Abstract

73 Ensuring the security of routers is crucial for safeguarding not only individual privacy but also 

74 the integrity of entire networks. With the increasing prevalence of smart homes, IoT devices, and 

75 remote work setups, the significance of consumer-grade router cybersecurity has expanded, as 

76 these devices often rely on routers in the home to connect to the internet. This report presents the

77 consumer-grade router profile, which includes cybersecurity outcomes for consumer-grade 

78 router products and associated requirements from consumer-grade router standards.

79 Keywords

80 Cybersecurity; consumer-grade routers

81 Reports on Computer Systems Technology

82 The Information Technology Laboratory (ITL) at the National Institute of Standards and 

83 Technology (NIST) promotes the U.S. economy and public welfare by providing technical 

84 leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test 

85 methods, reference data, proof of concept implementations, and technical analyses to advance 

86 the development and productive use of information technology. ITL’s responsibilities include the 

87 development of management, administrative, technical, and physical standards and guidelines for 

88 the cost-effective security and privacy of other than national security-related information in 

89 federal information systems. 

90 Audience

91 The intended audience for this report consists of manufacturers of consumer-grade router

92 products (especially product security officers), retailers, and testing and certification bodies 

93 interested in establishing minimum cybersecurity requirements for consumer-grade routers.

94 Note to Reviewers

95 On July 18th, 2023, the White House announced the next steps for the Cybersecurity Labeling 

96 Program for Smart Devices to Protect American Consumers, referred to as the “U.S. Cyber Trust 

97 Mark.” [WHAnnouncement] In addition to announcing participation by the Federal 

98 Communications Commission and Departments of Energy and State, the White House also 

99 directed NIST to “immediately undertake an effort to define cybersecurity requirements for 

100 consumer-grade routers—a higher-risk type of product that, if compromised, can be used to 

101 eavesdrop, steal passwords, and attack other devices and high value networks.” In response, 

102 NIST worked to develop these requirements with a standards-based, transparent, community103 involved process. Two discussion essays, one including a standards crosswalk

104 [StandardsCrosswalk] were published for community feedback. This draft is a pre-comment 

105 NISTIR preliminary draft intended to inform feedback at a discussion forum NIST will 

host on December 7th 106 , 2023. An official NISTIR public draft release and comment period 

will occur after December 7th 107 , 2023.
iv

108 Call for Patent Claims

109 This public review includes a call for information on essential patent claims (claims whose use 

110 would be required for compliance with the guidance or requirements in this Information 

111 Technology Laboratory (ITL) draft publication). Such guidance and/or requirements may be 

112 directly stated in this ITL Publication or by reference to another publication. This call also 

113 includes disclosure, where known, of the existence of pending U.S. or foreign patent applications 

114 relating to this ITL draft publication and of any relevant unexpired U.S. or foreign patents.

115 ITL may require from the patent holder, or a party authorized to make assurances on its behalf, 

116 in written or electronic form, either:

117 a) assurance in the form of a general disclaimer to the effect that such party does not hold 

118 and does not currently intend holding any essential patent claim(s); or

119 b) assurance that a license to such essential patent claim(s) will be made available to 

120 applicants desiring to utilize the license for the purpose of complying with the guidance 

121 or requirements in this ITL draft publication either:

122 i. under reasonable terms and conditions that are demonstrably free of any unfair 

123 discrimination; or

124 ii. without compensation and under reasonable terms and conditions that are 

125 demonstrably free of any unfair discrimination.

126 Such assurance shall indicate that the patent holder (or third party authorized to make assurances 

127 on its behalf) will include in any documents transferring ownership of patents subject to the 

128 assurance, provisions sufficient to ensure that the commitments in the assurance are binding on 

129 the transferee, and that the transferee will similarly include appropriate provisions in the event of 

130 future transfers with the goal of binding each successor-in-interest.

131 The assurance shall also indicate that it is intended to be binding on successors-in-interest 

132 regardless of whether such provisions are included in the relevant transfer documents.

133 Such statements should be addressed to: iotsecurity@nist.gov

134
v

135 Table of Contents

136 Introduction ...................................................................................................................... 1

137 Scope of Consumer-Grade Routers................................................................................ 2

138 Crosswalk between NISTIR 8425 Outcomes and Consumer-Grade Router 

139 Cybersecurity Requirements .................................................................................................. 3

140 Asset Identification ..................................................................................................... 3

141 3.1.1. Asset Identification 1 ................................................................................................ 3

142 3.1.2. Asset Identification 2 ................................................................................................ 4

143 Product Configuration................................................................................................. 4

144 3.2.1. Product Configuration 1............................................................................................ 4

145 3.2.2. Product Configuration 2............................................................................................ 4

146 3.2.3. Product Configuration 3............................................................................................ 5

147 Data Protection........................................................................................................... 5

148 3.3.1. Data Protection 1...................................................................................................... 5

149 3.3.2. Data Protection 2...................................................................................................... 5

150 3.3.3. Data Protection 3...................................................................................................... 5

151 Interface Access Control 1.......................................................................................... 6

152 3.4.1. Interface Access Control 1a...................................................................................... 6

153 3.4.2. Interface Access Control 1b...................................................................................... 6

154 3.4.3. Interface Access Control1c....................................................................................... 7

155 Interface Access Control 2.......................................................................................... 7

156 3.5.1. Interface Access Control 2a...................................................................................... 7

157 3.5.2. Interface Access Control 2b...................................................................................... 7

158 3.5.3. Interface Access Control 2c...................................................................................... 8

159 Software Update......................................................................................................... 8

160 3.6.1. Software Update 1.................................................................................................... 8

161 3.6.2. Software Update 2.................................................................................................... 8

162 3.6.3. Software Update 3 (New Addition Relative to NISTIR 8425) .................................... 9

163 Cybersecurity State Awareness.................................................................................. 9

164 3.7.1. Cybersecurity State Awareness 1............................................................................. 9

165 3.7.2. Cybersecurity State Awareness 2 (New Addition Relative to NISTIR 8425).............. 9

166 Non-Technical Outcomes ..........................................................................................10

167 Conclusion.......................................................................................................................10

168 References ..............................................................................................................................10

169 Appendix A. Consumer-Grade Router Scope Discussion ................................................11

170 Appendix B. List of Symbols, Abbreviations, and Acronyms...........................................13
vi

171 Appendix C. Glossary..........................................................................................................13

172 List of Tables

173 Table 1. Requirements for all consumer-grade router product components ............................... 2

174 Table 2. Non-technical cybersecurity outcomes and requirements from consumer-grade router 

175 standards..................................................................................................................................10

176 Table 3. Scope Coverage of the Consumer-Grade Router Standards Analyzed.......................12

177 List of Figures

178 Fig. 1. An example consumer-grade router product that includes a smartphone application and 

179 backend server in addition to the router device. ......................................................................... 2

180
1

181 Introduction

182 Router cybersecurity is of paramount importance in today's interconnected world, where digital 

183 communication plays a central role in both personal and professional spheres. Routers serve as 

184 the gatekeepers of our networks, managing the flow of data between devices and the internet. A 

185 compromised router opens the door to a host of potential threats, ranging from unauthorized 

186 access to sensitive information to the possibility of malicious attacks on connected devices. 

187 Ensuring the security of routers is crucial for safeguarding not only individual privacy but also 

188 the integrity of entire networks. With the increasing prevalence of smart homes, IoT devices, and 

189 remote work setups, the significance of consumer-grade router cybersecurity has expanded, as 

190 these devices often rely on routers in the home to connect to the internet. A secure home router

191 (i.e., one that is consumer-grade) not only protects U.S. citizens against data theft and other 

192 cyberattacks but also contributes to the overall resilience of the global digital infrastructure. As 

193 technology advances, the need for robust router cybersecurity becomes ever more critical to 

194 maintain a safe and trustworthy digital environment.

195 This report presents the consumer-grade router profile, which includes cybersecurity outcomes

196 for consumer-grade routers and associated requirements from consumer-grade router standards. 

197 In this context, outcomes are broad, flexible guidelines that can apply, albeit differently, to 

198 different use cases and contexts, while requirements are targeted specifications that can define 

meeting an outcome for a specific use case, context, technology, etc. Four existing standards1199 for 

200 consumer-grade routers are referred to in this document:

201 1. Broadband Forum (BBF) TR-124 Issue 8 – Functional Requirements for Broadband 

202 Residential Gateway Devices [BBF]

203 2. CableLabs (CL) Security Gateway Device Security Best Common Practices [CableLabs]

204 3. Federal Office for Information Security (BSI) TR-03148: Secure Broadband Router -

205 Requirements for secure Broadband Routers [BSI]

206 4. Infocomm Media Development Authority (IMDA) Technical Specification Security 

207 Requirements for Residential Gateways [IMDA]

208 NIST recommends use of the full set of requirements from all four consumer-grade router 

209 standards. Requirements from the standards for consumer-grade routers focused primarily on 

210 the router device. A few requirements addressed non-technical cybersecurity support and no 

211 requirements were given for other product components (e.g., mobile application). Thus, the 

212 requirements from the four standards address technical cybersecurity for consumer-grade 

213 router devices, but not the non-technical cybersecurity outcomes, nor cybersecurity for product 

214 components other than the router device (e.g., backend, mobile app).

215 Full support of all outcomes by all consumer-grade router product components is expected, as 

shown in Table 1 below.

2

216 Additional requirements are needed to meet all consumer-grade router 

217 product non-technical outcomes. If a consumer-grade router product has additional product 

1 These standards primarily focused on technical capabilities for router devices. The Broadband Forum (BBF) TR-124 Issue 8 standard includes 

requirements outside of the purview of cybersecurity, while the other three standards focused exclusively on cybersecurity requirements. All 

cybersecurity requirements were examined to create the consumer-grade router profile. Non-cybersecurity requirements from the BBF standard 

were not analyzed as part of the profiling process.

2 The identification of requirements for these gaps is on-going and NIST welcomes recommendations of standards and guidance that can inform 

the process.
2

218 components, such as a smart phone mobile application, additional requirements would also be 

219 necessary to meet the outcomes for the complete consumer-grade router product. Work on 

220 identifying these additional requirements is on-going and NIST welcomes feedback on standards 

221 and guidance applicable to these gaps for consumer-grade routers.

222 Table 1. Requirements for all consumer-grade router product components

Consumer-grade router... Technical Outcomes Non-technical Outcomes

Device Sections 3.1-3.7 Section 3.8 + TBD

Additional Product Components TBD TBD

223

224 The rest of this document is structured as follows:

225 • Section 2 states the recommended scope of consumer-grade router products.

226 • Section 3 presents an informative cross-walk between the technical and non-technical 

227 cybersecurity outcomes for consumer-grade router products and the related requirements 

228 from the four consumer-grade router standards.

229 • Section 4 concludes the document.

230 Scope of Consumer-Grade Routers

231 This profile identifies minimum cybersecurity for consumer-grade routers. Consumer-grade 

232 routers are defined as networking devices that forward data packets, most commonly Internet 

233 Protocol (IP) packets, between networked systems which are primarily intended for residential 

234 use and can be installed by the customer. The profile makes no distinction in its cybersecurity 

235 recommendations with regards to whether the product is owned by the customer or leased.

236 Additional discussion and justification for this scope can be found in Appendix A.

237 Cybersecurity outcomes and requirements for products should be scoped to all product 

238 components (e.g., smartphone applications) in addition to the router device. Fig. 1 below shows 

239 an example consumer-grade router product where the router device is supported by both a 

240 backend and smartphone application.

241

242 Fig. 1. An example consumer-grade router product that includes a smartphone application and backend 

243 server in addition to the router device.
3

244 Due to available standards specific to the product type, the requirements used to define the 

245 profile focuses on the cybersecurity of the consumer-grade router device, but the presence of 

246 other product components should not be ignored. NIST recommends the use of general standards 

or guidance to understand appropriate cybersecurity for these other product components.3247

248 Crosswalk between NISTIR 8425 Outcomes and Consumer-Grade Router 

249 Cybersecurity Requirements

250 This section provides additional information about how the requirements from the four router 

251 standards relate to the consumer-grade router profile outcomes. 

252 Sections 3.1-3.7 below shows which requirements from the four consumer-grade router 

253 standards are related to the technical outcomes that have been expanded and adapted from 

254 Profile of the IoT Core Baseline for Consumer IoT Products, NISTIR 8425 [IR8425] for 

255 consumer-grade routers. Each subsection from 3.1-3.7 states the high-level outcome along with 

256 each sub-outcome that defines the high-level outcome. For each sub-outcome, a set of related 

257 requirements from the four consumer-grade router standards are also included. The abbreviations 

258 used for the standards are:

259 BBF’s TR-124 Issue 8 [BBF]

260 CL’s Security Gateway Device Security Best Common Practices [CL]

261 BSI’s Secure Broadband Routers [BSI]

262 IMDA’s Security Requirements for Residential Gateways [IMDA]

263 Requirements related to the non-technical cybersecurity outcomes from these standards are

264 presented in Section 3.8.

265 Asset Identification

266 The consumer-grade router product is uniquely identifiable and inventories all of the consumer267 grade router product’s components.

268 3.1.1. Asset Identification 1

269 The consumer-grade router product can be uniquely identified by the customer and other 

270 authorized entities.

271 Related Standards Requirements:

272 BBF GEN.DESIGN.12, GEN.DESIGN.13, MGMT.LOCAL.20, 

273 IF.LAN.WIRELESS.AP.20

274 CL OOB-011, KEY-006, OOB-007

275 BSI (3.1.2.1)

3 NIST is working to identify standards and guidance related to IoT product cybersecurity, technical and non-technical, for the full product scope, 

including all IoT product components. Please refer to https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-program for additional 

information.
4

276 IMDA None

277 3.1.2. Asset Identification 2

278 The consumer-grade router product uniquely identifies each product component (e.g., router 

279 device, mobile app) and maintains an up-to- date inventory of connected product components.

280 No requirements from the consumer-grade router standards were mapped to this outcome. This 

281 outcome relates to a specifically product-wide concept (i.e., inventory of product components), 

282 and thus it is expected that standards including device-focused requirements would not address a 

283 product-focused outcome.

284 Product Configuration

285 The configuration of the consumer-grade router product is changeable, there is the ability to 

286 restore a secure default setting, and any and all changes can only be performed by authorized 

287 individuals, services, and other consumer-grade router product components.

288 3.2.1. Product Configuration 1

289 Authorized individuals (i.e., customer), services, and other consumer-grade router product 

290 components can change the configuration settings of the consumer-grade router product via one 

291 or more consumer-grade router product components.

292 Related Standards Requirements:

293 BBF MGMT.LOCAL.2

294 CL OOB-007, DE-007, MI-002, MI-010, MI-011

295 BSI (3.1.2)[3], (3.1.2)[3], (3.1.2)[4], (3.1.2.1), (3.1.2.2), (4), (4.1.1)[1], (4.1.1)[1], 

296 (4.1.1)[3], (4.1.1)[6], (4.1.1)[6], (4.1.1)[7], (4.1.2)[Table6], (4.1.2)[2], (4.2)[2], (4.3)[2], 

297 (4.3)[3], (4.4), (4.5), (4.5), (4.8), (4.8), (4.9), (4.10)[1]

298 IMDA 4.2, 4.2.3, 4.4

299 3.2.2. Product Configuration 2

300 Authorized individuals (i.e., customer), services, and other consumer-grade router product 

301 components have the ability to restore the consumer-grade router product to a secure default (i.e., 

302 uninitialized) configuration.

303 Related Standards Requirements:

304 BBF MGMT.LOCAL.10

305 CL OOB-009, DE-003, DE-004, DE-006

306 BSI (4.6)

307 IMDA 4.1.1, 4.2.1, 4.2.3
5

308 3.2.3. Product Configuration 3

309 The consumer-grade router product applies configuration settings to applicable consumer-grade 

310 router components.

311 No requirements from the consumer-grade router standards were mapped to this outcome. This 

312 outcome relates to a specifically product-wide concept (i.e., application of configuration across 

313 all product components), and thus it is expected that standards including device-focused 

314 requirements would not address a product-focused outcome.

315 Data Protection

316 The consumer-grade router product protects data stored across all consumer-grade router product 

317 components and transmitted both between consumer-grade router product components and 

318 outside the consumer-grade router product from unauthorized access, disclosure, and 

319 modification.

320 3.3.1. Data Protection 1

321 Each consumer-grade router product component protects data it stores via secure means.

322 Related Standards Requirements:

323 BBF SEC.FIRMWARE.2

324 CL DRP-001, KEY-001, KEY-002, KEY-003, HR-003, HR-004, SB-005, OOB-002

325 BSI (4.1.1)[7]

326 IMDA 4.5

327 3.3.2. Data Protection 2

328 The consumer-grade router product has the ability to delete or render inaccessible stored data 

329 that are either collected from or about the customer, home, family, etc.

330 Related Standards Requirements:

331 BBF None

332 CL OOB-009

333 BSI (4.6)

334 IMDA 4.2.3

335 3.3.3. Data Protection 3

336 When data are sent between consumer-grade router product components or outside the product, 

337 protections are used for the data transmission.

338 Related Standards Requirements:
6

339 BBF MGMT.REMOTE.WEB.6, SEC.USERINTERFACE.1, SEC.FIRMWARE.1, 

340 SEC.FIRMWARE.2

341 CL OOB-003, DE-002, DE-004, DE-005, MI-001, NETS-001, NETS-003, SBOM-006

342 BSI (3.1.2.2), (3.1.2.2), (4.1.1)[1], (4.1.1)[6], (4.1.1)[6], (4.1.1)[7], (4.1.2)[2], (4.1.2)[2], 

343 (4.4), (4.10)[1]

344 IMDA 4.2.2, 4.2.5

345 Interface Access Control 1

346 Each consumer-grade router product component controls access to and from all interfaces in 

347 order to limit access to only authorized entities.

348 3.4.1. Interface Access Control 1a

349 Use and have access only to interfaces necessary for the consumer-grade router product’s 

350 operation. All other channels and access to channels are removed or secured.

351 Related Standards Requirements:

352 BBF MGMT.LOCAL.1, MGMT.REMOTE.WEB.1, MGMT.REMOTE.WEB.5, 

353 MGMT.REMOTE.WEB.12, MGMT.REMOTE.WEB.13, SEC.GEN.5, SEC.GEN.6, 

354 SEC.GEN.10, SEC.GEN.11, SEC.USERINTERFACE.8

355 CL HR-001, HR-002, OOB-005, MI-003, NETS-004, NETS-005, MI-011

356 BSI (3), (3), (3.1)[2], (3.1.2)[3], (3.2)[3], (4.1.1)[6], (4.1.1)[5]

357 IMDA 4.2, 4.2.1

358 3.4.2. Interface Access Control 1b

359 For all interfaces necessary for the consumer-grade router product’s use, access control measures 

are in place.4360

Related Standards Requirements5361 :

362 BBF GEN.DESIGN.14, GEN.OPS.21, MGMT.LOCAL.1, MGMT.LOCAL.5, 

363 MGMT.LOCAL.11, MGMT.REMOTE.WEB.2, MGMT.REMOTE.WEB.9,

364 IF.LAN.WIRELESS.AP.20, SEC.GEN.1, SEC.GEN.8, SEC.USERINTERFACE.2, 

365 SEC.USERINTERFACE.3, SEC.USERINTERFACE.4, SEC.USERINTERFACE.5, 

366 SEC.USERINTERFACE.6, SEC.USERINTERFACE.7, SEC.USERINTERFACE.9

367 CL OOB-001, OOB-004, OOB-006, OOB-008, OOB-010, OOB-012, MI-004, MI-007, 

368 MI-008, MI-009, MI-010, MI-013, DIAG-002, NETS-007, NETS-008, NETA-001, 

369 NETA-002, NETA-003, MI-002

4

IETF RFC6092 Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet 

Service [RFC6092] is a relevant source for more specific guidance related to IPv6 interface cybersecurity.

5

IMDA 4.1.2 discusses password requirements, as does BSI (4.1.1)[1]. IMDA’s requirement is more stringent than BSIs (i.e., minimum 

password character length of 10 versus 8) and is recommend with BSI’s requirement.
7

370 BSI (3.1)[1,2], (3.1.2.1), (3.2)[3], (3.2)[3], (3.2)[3], (4.1.1)[1], (4.1.1)[1], (4.1.1)[2], 

371 (4.1.1)[2], (4.1.1)[5], (4.4)

372 IMDA 4.1, 4.1.1, 4.1.2, 4.2, 4.2.1

373 3.4.3. Interface Access Control1c

374 For all interfaces, access and modification privileges are limited.

375 Related Standards Requirements:

376 BBF MGMT.REMOTE.WEB.3, MGMT.REMOTE.WEB.4, SEC.GEN.7

377 CL MI-006

378 BSI (3.1)[1,2], (3.1.2)[4], (3.2)[3], (3.2)[3], (3.2)[3]

379 IMDA 4.2

380 Interface Access Control 2

381 Some, but not necessarily all, consumer-grade router product components have the means to 

382 protect and maintain interface access control.

383 3.5.1. Interface Access Control 2a

384 Validate that data shared among consumer-grade router product components match specified 

385 definitions of format and content.

386 Related Standards Requirements:

387 BBF None

388 CL MI-012, NETS-006

389 BSI None

390 IMDA 4.6

391 3.5.2. Interface Access Control 2b

392 Prevent unauthorized transmissions or access to other product components.

393 Related Standards Requirements:

394 BBF WAN.DoS.1, WAN.DoS.2, WAN.DoS.3, WAN.DoS.4, WAN.DoS.5

395 CL MI-005, NETS-006

396 BSI (3.1.2)[3], (3.1.2)[3], (3.1.2)[4], (4.3)[1], (4.3)[3], (4.7)[1], (4.7)[1], (4.9)[1], (4.9)[1]

397 IMDA 4.2.1
8

398 3.5.3. Interface Access Control 2c

399 Maintain appropriate access control during initial connection (i.e., onboarding) and when 

400 reestablishing connectivity after disconnection or outage.

401 Related Standards Requirements:

402 BBF None

403 CL None

404 BSI (3.1.2.3), (3.2)[2]

405 IMDA 4.1, 4.1.1, 4.2, 4.2.1

406 Software Update

407 The software of all consumer-grade router product components can be updated by authorized 

408 individuals, services, and other consumer-grade router product components only by using a 

409 secure and configurable mechanism, as appropriate for each consumer-grade router product 

410 component.

411 3.6.1. Software Update 1

412 Each consumer-grade router product component can receive, verify, and apply verified software 

413 updates.

414 Related Standards Requirements:

415 BBF GEN.OPS.22, GEN.OPS.23

416 CL KEY-004, KEY-005, SB-001, SU-001, SU-005, SBOM-009, SB-002, SU-003

417 BSI (4.2)[1], (4.2)[3], (4.2)[3], (4.2)[6]

418 IMDA 4.3

419 3.6.2. Software Update 2

420 The consumer-grade router product implements measures to keep software on consumer-grade 

421 router product components up to date (i.e., automatic application of updates or consistent 

422 customer notification of available updates via consumer-grade router components).

423 Related Standards Requirements:

424 BBF GEN.OPS.19, GEN.OPS.20, MGMT.LOCAL.15, MGMT.LOCAL.21, 

425 MGMT.LOCAL.22

426 CL SB-003, SU-002, SU-006, SBOM-003, SBOM-007, SBOM-008, SBOM-010

427 BSI (4.1.2)[Table 6], (4.2)[1], (4.2)[2]

428 IMDA 4.3
9

429 3.6.3. Software Update 3 (New Addition Relative to NISTIR 8425)

430 New addition relative to NISTIR 8425.

431 Integrity of data, including configuration is preserved when an update is applied.

432 Related Standards Requirements:

433 BBF GEN.OPS.15, GEN.OPS.24

434 CL SU-004

435 BSI None

436 IMDA None

437 Cybersecurity State Awareness

438 The consumer-grade router product supports detection of cybersecurity incidents affecting or 

439 affected by consumer-grade router product components and the data they store and transmit. 

440 3.7.1. Cybersecurity State Awareness 1

441 The consumer-grade router product securely captures and records information about the state of 

442 consumer-grade router components that can be used to detect cybersecurity incidents affecting or 

443 affected by consumer-grade router product components and the data they store and transmit.

444 Related Standards Requirements:

445 BBF GEN.OPS.18, LAN.FW.2, LAN.FW.3, LAN.FW.4, MGMT.LOCAL.18, 

446 MGMT.LOCAL.20

447 CL SB-004, LOG-001, LOG-002, LOG-003, LOG-004, LOG-005, SB-002, TS-001

448 BSI (4.1.2)[1], (4.1.2)[Table 6], (4.1.2)[Table 6], (4.1.2)[Table 6], (4.1.2)[Table 6], 

449 (4.1.2)[Table 6], (4.1.2)[2], (4.8)

450 IMDA None

451 3.7.2. Cybersecurity State Awareness 2 (New Addition Relative to NISTIR 8425)

452 New addition relative to NISTIR 8425.

453 The consumer-grade router product can inform authorized entities about or respond directly to 

454 changes in cybersecurity information.

455 Related Standards Requirements:

456 BBF GEN.OPS.6

457 CL AR-002

458 BSI None

459 IMDA None
10

460 Non-Technical Outcomes

461 Table 2 below states the non-technical cybersecurity outcomes NIST has defined for the 

462 consumer-grade router profile with the requirements from the four consumer-grade router 

463 standards that related to these outcomes. 

464 Table 2. Non-technical cybersecurity outcomes and requirements from consumer-grade router standards

Consumer-Grade Router Profile Non-Technical Outcome Related Requirements

Documentation

The consumer-grade router product developer creates, gathers, and stores 

information relevant to cybersecurity of the consumer-grade router product and 

its product components prior to customer purchase, and throughout the 

development of a product and its subsequent lifecycle.

CL HR-005, MI-014, 

DIAG-001, SBOM004, SBOM-005

Information and Query Reception

The consumer-grade router product developer has the ability to receive 

information relevant to cybersecurity and respond to queries from the customer 

and others about information relevant to cybersecurity.

-

Information Dissemination

The consumer-grade router product developer broadcasts (e.g., to the public) 

and distributes (e.g., to the customer or others in the consumer-grade router 

product ecosystem) information relevant to cybersecurity.

CL AR-001, SBOM011

BSI (4.2)[4]

IMDA 4.3e

Education and Awareness

The consumer-grade router product developer creates awareness of and 

educates customers and others in the consumer-grade router product ecosystem 

about cybersecurity-related information (e.g., considerations, features) related 

to the consumer-grade router product and its product components.

-

465 Conclusion

466 This consumer-grade router profile can help manufacturers and others determine adequate 

467 cybersecurity to develop into their products. These recommendations draw from current best 

468 practices and guides broad adoption of accepted and vetted cybersecurity for consumer-grade 

469 routers of any type. NIST reiterates the importance of a product-wide perspective on 

470 cybersecurity and further recommends consideration of it to develop a comprehensive approach 

471 to providing cybersecurity for consumer-grade router products.

472 References

473 [WHAnnouncement] White House (2023) Biden-Harris Administration Announces 

474 Cybersecurity Labeling Program for Smart Devices to Protect American Consumers. (White 

475 House, Washington, DC). https://www.whitehouse.gov/briefing-room/statements476 releases/2023/07/18/biden-harris-administration-announces-cybersecurity-labeling-program477 for-smart-devices-to-protect-american-consumers/

478 [StandardsCrosswalk] National Institute of Standards and Technology (2023) Crosswalk of 

479 Consumer-Grade Router Cybersecurity Standards to NIST’s Baseline for Consumer IoT 

480 Products. (National Institute of Standards and Technology, Gaithersburg, MD). 

481 https://www.nist.gov/system/files/documents/2023/10/25/Consumer482 Grade%20Router%20Standards%20Crosswalk.pdf
11

483 [BBF] Walls, J, Editor (2022) Functional Requirements for Broadband Residential Gateway 

484 Devices. (Broadband Forum, Fremont, CA), Technical Report (TR) 124, Issue 8. 

485 https://www.broadband-forum.org/resources/tr-124-issue-8-functional-requirements-for486 broadband-residential-gateway-devices

487 [CableLabs] CableLabs Security (2021) Gateway Device Security Best Common Practices. 

488 (CableLabs, Louisville, CO), CL-GL-GDS-BCP-V01-211007. 

489 https://community.cablelabs.com/wiki/plugins/servlet/cablelabs/alfresco/download?id=1209

490 eea3-bd81-40cb-9a18-21bd6cfcd80d

491 [BSI] Federal Office for Information Security (2023) Secure Broadband Router: Requirements 

492 for Secure Broadband Routers. (Federal Office for Information Security, Bonn, Germany), 

493 BSI Technical Report (TR) 03148. https://www.bsi.bund.de/EN/Themen/Unternehmen-und494 Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema495 sortiert/tr03148/tr-03148.html

496 [IMDA] Info-communications Media Development Authority of Singapore (2020) Security 

497 Requirements for Residential Gateways. (Info-communications Media Development 

498 Authority, Singapore), IMDA Technical Specification (TS) RG-SEC. 

499 https://www.imda.gov.sg/-/media/imda/files/regulation-licensing-and-consultations/ict500 standards/telecommunication-standards/radio-comms/imda-ts-rg-sec.pdf

501 [IR8425] Fagan M, Megas KN, Watrobski P, Marron J, Cuthill B (2022) Profile of the IoT Core 

502 Baseline for Consumer IoT Products. (National Institute of Standards and Technology, 

503 Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8425. 

504 https://doi.org/10.6028/NIST.IR.8425

505 [RFC6092] Woodyatt, J, Editor (2011) Recommended Simple Security Capabilities in 

506 Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service. 

507 (Internet Engineering Task Force), IETF Request for Comment (RFC) 6092. 

508 https://datatracker.ietf.org/doc/html/rfc6092

509 [ParksRouterResearch] Parks Associates (2022) Parks Associates: 52% of Consumers Acquired 

510 Their Routers From Their ISP. (PRNewswire, Dallas, TX). 

511 https://www.prnewswire.com/news-releases/parks-associates-52-of-consumers-acquired512 their-routers-from-their-isp-301593338.html

513 Appendix A. Consumer-Grade Router Scope Discussion

514 Routers are network devices that forward data packets, most commonly Internet Protocol (IP) 

515 packets, between networked systems. They may be wired (e.g., Ethernet), wireless (e.g., Wi-Fi), 

516 or both. Consumer-grade identifies those routers that may appear in an individual’s residence 

517 such that their primary use case is residential rather than enterprise, industrial, etc. However, 

518 some small businesses may choose to use consumer grade equipment given the limited 

519 performance needs of those businesses. The presumption for consumer equipment, or small 

520 businesses that use consumer grade equipment, is that the manufacturer cannot assume the user 

521 has cybersecurity expertise or an ability to take significant action to secure the product.

Consumer-grade routers may be acquired by households in at least two ways6522 :

523 1. Purchase of the equipment directly from a retailer.

6 As of 2022, about half of consumer-grade routers are received from ISPs rather than acquired by customers directly. [ParksRouterResearch]
12

524 2. Bundling and/or renting of the equipment from a service provider.

525 Each of these vectors may have implications for how cybersecurity outcomes could be met by 

526 the consumer-grade router product. Consumer-owned equipment may be fully managed by the 

527 household or may have some security services provided externally. Alternatively, bundled/rental 

528 equipment will likely be managed in part by the service provider. Additionally, these variations 

529 and use cases potentially have significantly different features and capabilities to consider as part 

530 of the product, and thus may have different risk profiles and cybersecurity outcomes. 

531 Table 3. Scope Coverage of the Consumer-Grade Router Standards Analyzed

Applicable to...

Consumer-Grade Router Standard ConsumerOwned Routers?ISP-Owned, CustomerLeased Routers?

TR-124 Issue 8 [BBF] Yes Yes

Security Gateway Device Security Best Common Practices [CL] Yes Yes

Secure Broadband Routers [BSI] Yes Yes

Security Requirements for Residential Gateways [IMDA] Yes No

532

533 As summarized in Table 3, the scope statements of three of four standards examined related to 

534 consumer-grade router cybersecurity either make no distinction about how the router is acquired 

535 by customers or state that the guidance applies to both contexts. 

536 BBF similarly does not distinguish between the two methods of acquisition, stating “a 

537 Residential Gateway implementing the general requirements of TR-124 will incorporate at least 

538 one embedded WAN interface, routing, bridging, a basic or enhanced firewall, one or multiple 

539 LAN interfaces and home networking functionality that can be deployed as a consumer self540 installable device.” It notably highlights that in scope are products that can be deployed as 

541 “consumer self-installable,” but this includes the customer purchased context, as well as most 

542 instances of service provider supplied routers.

543 CableLabs directly acknowledges both contexts and scopes in both: “This Gateway Device 

544 Security document specifies best common practices to serve as an industry metric for retail and 

545 leased devices (both gateways and cable modems) for security—this includes manufacturing 

546 process, supply chain, hardware and firmware configuration procedures, software, and 

547 management protocols.”

548 The German Federal Office for Information Security (BSI) focuses on scoping its requirements 

549 related to how the product is used rather than acquired, stating “In scope of this Technical 

550 Guideline are requirements on a router as a hardware component with an installed operating 

551 system and services provided to an end-user. The router serves the purpose of establishing a 

552 connection to the infrastructure of an Internet Access Provider (IAP) to gain Internet access. 

553 From the end-user’s perspective the router offers a gateway to the Internet as well as 

554 management functionalities for the end-user’s private network. The Technical Guideline 

555 describes requirements on the router that should be implemented to offer a secure operation of 

556 the router for the end-user.” Thus, the requirements can be applied to the case of when customers 

557 purchase a router and when a router is provided by or rented from a service provider.
13

558 Unlike the others, the IMDA alludes to a scope of only routers purchased by customers, stating 

559 that the goal is “ensuring that these devices are better protected when purchased and deployed by 

560 consumers.”

561 Appendix B. List of Symbols, Abbreviations, and Acronyms

562 BBF

563 Broadband Forum

564 BSI

565 Federal Office for Information Security

566 CL

567 CableLabs

568 IMDA

569 Infocomm Media Development Authority

570 IoT

571 Internet of Things

572 Appendix C. Glossary

573 Consumer-Grade Router Device

574 Networking devices that forward data packets, most commonly Internet Protocol (IP) packets, between networked 

575 systems which are primarily intended for residential use and can be installed by the customer.

576 Consumer-Grade Router Product

577 Consumer-grade router device and any additional product components (e.g., backend, smartphone application) that 

578 are necessary to use the IoT device beyond basic operational features. [IR8425, adapted]

579 Cybersecurity Outcome

580 Statement of what is expected either from a product or from an organization in support of a product related to the 

581 cybersecurity of that product. Can be technical or non-technical.