Internet of Things Advisory Board (IoTAB) Committee 

Established by 9204(b)(5) of the William M. (Mac) Thornberry

National Defense Authorization Act for Fiscal Year 2021 (Pub. L. 116-283)

October 24 and 25, 2023

Virtual Meeting Platform: Webex

MEETING MINUTES 

Board Members 

● Michael J. Bergman, Consumer Technology 

Association

● Dr. Ranveer Chandra, Microsoft

● Nicholas Emanuel, CropX

● Steven E. Griffith, National Electrical 

Manufacturers Association

● Tom Katsioulas, Global Semiconductor Alliance

● Prof. Kevin T. Kornegay, Morgan State University

● Debra Lam, Georgia Institute of Technology

● Ann Mehra

● Robby Moss, Moviynt

● Nicole Coughlin, Town of Cary North Carolina

● Maria Rerecich, Consumer Reports

● Debbie A. Reynolds, Debbie Reynolds Consulting

● Dr. Arman Shehabi, Lawrence Berkeley National 

Laboratory

● Peter Tseronis, Dots and Bridges LLC

Board Chairs and NIST Staff 

● Benson M. Chan, Strategy of Things Inc. (Chair)

● Daniel W. Caprio Jr., The Providence Group (Vice

Chair)

● Barbara Cuthill, NIST (Designated Federal 

Officer)

● Jeffrey Brewer, NIST (Alternate Designated 

Federal Officer)

● Katerina Megas, NIST (Federal Working Group 

Co-Convener)

● Alison Kahn, NIST (Federal Working Group CoConvener)

● Greg Witte, NIST Contractor, (Report Editor)

● Brad Hoehn, NIST Contractor (Report Editor)

● David Lemire, NIST Contractor (Scribe)

● Wendy Szwerc, NIST Contractor (Scribe)

Speaker(s):

● Dr. Joseph Kvedar, Mass General Brigham

● Jim Kohlenberger, Trusted Future

● Dr. Amit Elazari, Open Policy Group

● Rajesh Krishnan, Asimily

● Kathleen Scott, CTIA

● John Marinho, CTIA 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 2 

Action Items Over Both Days

Note: Names and roles are bolded to show ownership.

Report Recommendations:

● All board members to provide all probationary recommendations by November 8.

● Ms. Coughlin and Ms. Mehra to draft a recommendation for public safety regarding cameras as IoT.

● Ms. Mehra to draft a recommendation for monitoring, reporting, “IoT.gov” website on progress.

● Ms. Mehra and Ms. Coughlin to draft a recommendation on NextGen 911.

● Ms. Mehra to create a recommendation for Software as a Medical Device.

● Ms. Reynolds and the privacy subgroup to review CTIA letter for privacy comments

● Mr. Bergman and the cybersecurity subgroup to review CTIA recommendations.

● Mr. Bergman to write a recommendation ‘considering adding modules to labeling program’.

● Mr. Chan to confirm with Mr. Tseronis on removal of Presidential Policy Directive (PPD) 21.

● Mr. Chan, Mr. Katsioulas, Ms. Mehra, and Ms. Lam to draft recommendations for small business 

workforce for innovation.

● Mr. Witte and Mr. Chan to verify all recommendations are captured.

Follow-up to Speaker Recommendations:

● All board members must go back through the speaker recommendations list and identify any 

additional recommendations the board should consider that fill gaps in existing recommendations.

● Board members must consider how to incorporate language from Mr. Moore's first two 

recommendations (grants/guidance addressing IoT into Federal programs and RFPs/RFIs 1 including a 

requirement for an IoT plan) into existing ‘upleveled’ recommendations.

● Mr. Caprio to review Mr. Kohlenberger’s recommendations and identify and draft any changes to the 

board’s existing recommendations for board consideration.

● Mr. Bergman will write up a recommendation from Mr. Krishnan regarding a common vulnerability 

framework. 

● Ms. Reynolds, Ms. Mehra, Mr. Bergman, Ms. Rerecich to fold Dr. Kvedar’s recommendation 1 

(privacy) into the federal framework for privacy recommendation.

● Ms. Mehra and Mr. Chan to integrate Dr. Kvedar’s recommendation 2 (education) and 3 (increase 

funding) into workforce development recommendations.

● Mr. Chan to send speaker Chris Moore’s information to Ms. Mehra.

● Ms. Cuthill to obtain speaker Dr. Elazari’s transcripts to review for recommendations.

Storyboard and Commentary Sections:

● The board to submit their storyboard narratives to Mr. Witte by November 1.

● All board members to include benefits discussion in commentary writeups.

● Ms. Mehra and Mr. Caprio to identify the FDA’s role in IoMT and emerging technologies.

● Mr. Bergman to add some commentary on spectrum sharing in the connectivity section. 

● Ms. Mehra and Mr. Griffith to add Transparency and Artificial Intelligence (AI) Explainability to the 

AI Commentary Section.

● Mr. Griffith to add generative AI to AI commentary.

● Mr. Chan to add a commentary section for personas.

1 Requests for Proposal (RFPs) / Requests for Information (RFIs)
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 3

Specific Editor Actions:

● Mr. Witte to include a new recommendation into the IoT Trust theme from the privacy team that isn’t 

yet in the report.

● Mr. Witte to consult with the privacy subgroup team on the IoT Trust Theme regarding the use of 

‘confidentiality’ due to clarity needed on applying to enterprises vs. individuals. 

● Mr. Witte to follow-up on the board’s recommendation that the IoT Federal Working Group identify 

areas for aggressive actions such as privacy or cybersecurity in the context of progression over the next 

5 years. 

● Mr. Witte indicated the editor team will integrate all recommendations into themes aligning to the 

NDAA topics through a compliance matrix.

Updated Schedule:

● October 27: All commentary sections submitted to Mr. Witte (cc Mr. Chan, Mr. Caprio).

● November 1: Get stories of IoT use over to Mr. Witte. Each area needs to have some stories, especially 

the sector teams.

● November 8: All new recommendations and any modifications to existing recommendations due to 

Mr. Witte (cc Mr. Chan and Mr. Caprio). New and modified recommendations will be considered 

“probationary” in the report and needing further action in the December meeting. 

● November 15: Mr. Witte and Brad Hoehn will send a draft report to the advisory board to review, 

redline, and comment on before the December 12-13 meetings.

● December 12-13: Review / discuss probationary recommendations and all draft content in report. No 

new recommendations will be accepted after this meeting.

● January (Meeting date to be determined): Review near final version of report. Last time any changes 

will be made. 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 4

IoTAB Meeting on Tuesday, Oct 24, 2023

Chair Opening Remarks

Ms. Cuthill opened the meeting., welcomed the attendees, and introduced the chair, Mr. Benson Chan. 

● Mr. Chan went over the agenda and goals for the eighth meeting of the Internet of Things Advisory 

Board (IoTAB).

● Mr. Chan said the board would take time to discuss recommendations from speakers during this 

meeting.

Outside Expert Speaker: Dr. Joseph Kvedar, Mass General Brigham

Dr. Joseph Kvedar

Presentation: The Internet of Things in Health

● Ms. Mehra introduced Dr. Kvedar, Vice President of Partners Healthcare who is responsible for 

building connected health systems and is developing a new method of healthcare delivery from doctor’s 

offices to homes leveraging connected devices. 

● Dr. Kvedar said he would talk both about applications and why the forward movement toward the 

vision has been slow. He indicated that there is increased patient demand from one-to-one healthcare 

delivery (either in a doctor’s office or via telemedicine) to one-to-many where IoT is an enabler. 

● Dr. Kvedar discussed the role of wearables, in two categories: tracking for health, and chronic illness 

management.

○ He identified that motivation was a key area still being examined and this was easier to do for 

chronic illness management than for people who didn’t use wearables in the first place.

○ He explained that IoT enables true one-to-many via readings to a platform that a doctor or nurse 

can view and track data on many patients at the same time. Gave examples of diabetes 

management, blood pressure care, and heart monitoring.

● Dr. Kvedar identified with the data that can simply be captured by a user’s smartphone today.

● In referencing his 2015 book2

, he identified a progression towards automating healthcare in which there 

are three key needs and discussed technical barriers for each:

1. Devices and data: New sensors, data aggregation, and normalization

o Devices like smart scales or activity trackers provide data and data streams where it 

should be possible to merge the data sets and create new predictions about activity 

needed to make some change for the user (e.g., manage weight). But there is no 

common way of displaying those data sets together. 

o He described barriers to aggregation as normalizing data, accounting for reading 

discrepancies from different sources, frictionless data capture, making the data readily 

available to clinicians, and integrating data from multiple sources into the electronic 

record. 

2 https://theinternetofhealthythings.com/
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 5

2. Analytics or Artificial Intelligence (AI): taking the data and using it to predict and adjust your 

future activity

o He emphasized that healthcare is so individual that it isn't enough to say if said person 

does X that they will also do Y. 

o And that there’s a long gap between what can be done to predict a future state and what 

that might be to drive the behavior of the individual to change.

3. Engagement: Essential to achieve results from the first two needs

o He is interested in consumer centric engagement and pointed out that you cannot 

expect patients to drop what they're doing and focus solely on what we need them to 

do for their health. 

o It's key to fit engagement tools and application messaging into their everyday life and 

personalization is key since health is highly personalized.

● He identified some collected barriers and recommendations to remove barriers from sources identified 

as the American Telehealth Association, one entrepreneur on regulatory concerns, and some thoughts 

from an employee at Qualcomm. 

○ American Telehealth Association - Barriers:

 States implement their own health data privacy frameworks

 Ensuring interoperability and proper Electronic Health Record integration

 Concerns about hacking into healthcare system database

 Insufficient funding and resources to implement or maintain security systems

 Lacking capacity and resources to identify security requirements adequately

 Lack of consistent policies, practices, and regulatory frameworks 

○ American Teleheath Association: Recommendations to Remove Barriers:

 Create federal framework for privacy to reduce complexity of compliance and 

confusion

 More education for providers and health systems

 Increase funding for staff capacity to implement requirements and processes

 Solicit feedback on successful privacy/security processes and collect use cases

 Empower AGs for enforcement action when privacy laws are violated

 Ensure transparency and explainability on the use of AI to ensure outputs are secure, 

trustworthy, clinically appropriate, and reliable

○ Entrepreneur’s perspective through the Food and Drug Administration (FDA) - Barriers:

 Understaffed and poor response times

 Need to fit in a box – no innovative thinkers

 Culture is to say no

 Dr. Kvedar also commented that other entrepreneurs also think this is a difficult 

process
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 6

○ Qualcomm lawyer on Software as a Medical Device (SaMD) 3 – Barriers: 

 Centers for Medicare & Medicaid Services (CMS) does not consistently deal with 

SaMD from a coverage/payment perspective. 

 SaMD are prescription digital therapeutics, AI and mobile medical apps.

 Dr. Kvedar indicates that this is software that can behave and act in a healthcare 

delivery process as a physical device. Dr. Kvedar indicates this feedback is the FDA 

has done well here but that CMS is behind. 

 For example, at present, SaMD is an indirect practice expense so essentially a loss to 

providers. And it’s not covered as Durable Medical Equipment either. So, there’s no 

way for a person using it to get a bump in allocation because it’s buried. 

○ Qualcomm lawyer on SaMD - Recommendations to Remove Barriers:

 There is an acknowledgement that SaMD is a medical device and to treat it as such for 

coverage/payment

 Proactively help stakeholders identify which benefit categories are appropriate for 

SaMD.

Questions and Board Discussion:

● Mr. Chan asked what work is being done with the providers and payers? 

○ Dr. Kvedar indicated there are reimbursement codes for remote patient monitoring and 

therapeutic monitoring for FDA approved devices. Some of the applications mentioned do exist 

and CMS does cover them. 

○ However, he indicated that private payers are “all over the map” regarding coverage. He 

pointed out that he had relayed points that were in a broader context and that it is daunting for 

a healthcare provider who wants to go into this space to figure out which plans pay for what. 

○ Dr. Kvedar pointed out that whether it is video visits, or asynchronous monitoring they look at 

it as potential access utilization. He pointed out it would be nice to get even more coverage but 

it's difficult at so many levels, and this is viewed as “excess utilization” or “added cost”.

○ He indicated as a bottom line that it's difficult to implement these remote patient monitoring 

and therapeutic programs at present.

● Mr. Chan pointed out that people also complain about healthcare inequities and as an example indicated 

that if one lives in a rural area, they may have to drive many miles to reach a needed doctor. He asked, 

‘Is it an access issue or are some of these things used to address those issues?’

○ Dr. Kvedar stressed that it is multi layered and very complex. We could advocate for universal 

broadband. There are other issues such as health literacy gaps and language barriers. But there 

are people trying to break down those equity barriers. 

○ He pointed out that if there is a pipeline to push the government on universal broadband that 

would be helpful.

● Mr. Chan asked in closing - Are IoT devices covered under Medicare / Medicaid?

○ Dr. Kvedar indicated that it is paid through Medicare / Medicaid programs. The American 

Medical Association created these reimbursement codes. 

3 Software as a Medical Device; see: https://www.fda.gov/medical-devices/digital-health-centerexcellence/software-medical-device-samd
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 7

○ The reimbursement codes for remote patient monitoring allow the provider to bill Medicare for 

the hardware that is an FDA approved device, educating the patient on how to use it and 

reviewing the data that the device throws out. 

○ Dr. Kvedar pointed out that Medicare has been receptive to IoT. As it trickles down to the 

private payer world, however, it is murkier.

Outside Expert Speaker: Jim Kohlenberger, Trusted Future

Mr. Jim Kohlenberger

Document: 5 Recommendations for IoT Progress

Mr. Caprio introduced Mr. Kohlenberger as a policy strategist at the forefront of technology and 

innovation policy. He served in Clinton and Obama administrations and as Chief of Staff of the Office of 

Science and Technology Policy. 

● Mr. Kohlenberger provided an economic outlook on the administration advancing high risk / high 

reward research that will expand opportunity and tackle some of the biggest challenges today.

● One of the biggest barriers is the slow IoT rollout including smart technologies with embedded 

intelligence. Within the government, these are often referred to as cyber physical systems. But they are 

all the same thing, and there’s a bridge of linking the digital world to the physical world. 

● Mr. Kohlenberger pointed out that over the last 15 years productivity improved more than the previous 

50 years in relation to the role of the information economy and technology deployment.

○ He pointed out that the technology sector has grown to about 10% of US Gross Domestic 

Product (GDP) overall and has fundamentally transformed sectors like finance and 

entertainment to be almost entirely digital. 

○ He pointed out these two sectors make up about 30% of GDP with potentially 70% remaining 

to be transformed. 

○ He noted that sectors with more substantial physical equipment and infrastructure (e.g., 

transportation, energy, healthcare, agriculture, and manufacturing) are being left behind by 

these productivity improvements. 

○ Today only a small percentage of the equipment in those sectors has been connected and he 

sees this as an opportunity going forward. 

● Mr. Kohlenberger then expanded on how economists quantify this pointing out that economists, 

Michael Mandela and Bret Swanson looked at the economic impact bridge between the digital sector 

and the physical economy. 

○ They looked at what happens when we bridge this information economy with the physical 

economy extending this digital transformation is a boost in annual economic growth by $2.7 

Trillion by 2031 and a boost in federal revenues by accumulative $3.9 Trillion. Mackenzie also 

has similar estimates and they estimated that if we just boost productivity in these physical 

sectors by 1%, we could generate another $3,500 in income for average everyday Americans.

○ As an example, Mr. Kohlenberger discussed the use of wireless sensors on freight trains to 

detect wheel bearings that are about to fail. Millions of dollars could be saved with the use of 

sensors. He referenced an environmental disaster that cost $800M to clean up which could have 

been avoided with the use of these low-cost sensors. 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 8 

● He pointed out there’s a need for both private sector innovation leadership and federal government 

research and investment.

○ Private sector innovation leadership is key to discover and invent more low-cost technologies.

○ The Federal government plays a critical role while there are still some enormously hard 

scientific challenges that require high risk, high reward research and working across a broader 

range of sectors. 

○ Historically, he noted that Federal investments have led to the Internet, the web browser, the 

search engine, the technologies of the smart phone (lithium-ion batteries, multi touch screens, 

and accelerometers), and Siri itself was a Defense Advanced Research Projects Agency 

(DARPA) program along with a whole host of other sensor technologies. 

○ The government invested in these high risk, high reward research areas that at the time private 

companies couldn't do on their own. These enablers helped bring today’s new products. 

● He then gave some examples of where the government is pushing new technology challenges. 

○ The President called for a new agency modeled on DARPA to improve healthcare outcomes.

○ Low-cost sensors on transportation infrastructure could detect problems before a bridge fails 

or it could provide data on existing infrastructure, or collect continuous traffic data for cars, 

trucks, buses and cyclists integrating with traffic signals.

○ The administration is advancing a whole bunch of smart city technologies and adoption in a 

variety of ways with the intent of providing for safety where for example emissions could be 

reduced by 10% to 15% to improve quality of life, lower costs, and reduce commutes.

○ A $100 million new smart grants program is made possible by the bipartisan infrastructure law

which helps to scale small projects in communities. 

○ The National Science Foundation has a smart and connected community initiative to help drive 

smarter technology into various sectors - health, transportation, water, management, smart grid, 

emergency management and smart facilities.

○ The Chips and Science Act included an initiative for “Regional Innovation Engines” and smart 

city related initiatives have been part of this initiative. 

● In talking through the potential of smart technology to support emissions reductions goals: 

○ Buildings account for 71% of US electricity usage and the President launched a climate-smart 

building initiative grant at $61 million in smart building technology to help equip 7,000 

buildings with smart controls and sensors.

○ A sensor program invested $20 million into 15 projects to develop a new class of sensors to 

significantly reduce building electricity usage. 

○ The Environmental Protection Agency (EPA) is pushing the frontiers on connected devices for 

environmental monitoring, including lead in the water. 

○ The administration is focused on social equity and widely distributed sensors are critical to 

measuring the emissions in areas near chemical plants, refineries, and factories.

○ The EPA is pushing out $100 million in devices, including air quality sensors that can help 

across agriculture and smart manufacturing across smart wearables for factory workers. 

○ DARPA is working on IoT for ocean applications and the administration launched a whole 

series of new regional technology hubs. One is in Montana, one in Rhode Island, and one in 

Oregon.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 9

● Mr. Kohlenberger pointed out these are a fraction of what the federal government is doing and don’t 

solve all challenges. To unlock new opportunities and help solve societal challenges, there's a need to 

make sure that our federal researchers at agencies have the tools to continue this progress.

● He presented 5 recommendations for the board to consider:

1. Congress should fully funding the existing Research and Development (R&D) deployment 

demonstration work. 

○ One of the most important recommendations since the charter asks to identify things including 

budgetary items that could inhibit the development of IoT. As in, is it slowing the progress? 

○ So, fully fund the science agency work that is happening in these areas to push them forward 

or cut the opportunity short.

2. The board should quantify the economic potential at hand in the report. 

○ Show that we can grow the economy in big ways. The research shows that investment in IoT 

would boost federal revenues by a huge amount by lifting our economy. This also means that 

every dollar invested in research and adoption pays for itself several times over. 

○ As an example, the human genome project is now about $7Billion dollars every single year as 

compared to the initial $3Billion dollars investment.

 Economic studies initially showed that for every $1 invested by the federal government 

resulted in $141 in economic activity. 

 Collectively, the companies, the new employees and the new investment also resulted 

in in creating more tax revenue for the federal government as well. 

3. Interoperability is a challenge and looking at how different definitions of Internet of things could be 

made into an internet of everything. 

○ The different definitions indicate different points of view restricting interoperability, Such as:

 Cyber physical systems which is the bridge between the digital and the physical world.

 Computer enabled networked physical systems

 Network sensing

○ He pointed out a staffer of his, Chris Greer, a scientist who co-authored a report on cyber 

physical systems, indicated that these different points of view are relating to one another and 

are in fact converging and essentially the same thing. He said recognizing this convergence can 

bring currently isolated sectors together for progress around shared research application and 

innovation goals. 

○ Mr. Kohlenberger pointed out that within the federal government varying terminology for 

essentially the same technology creates unnecessary barriers. 

4. A need to elevate inter-agency coordination.

○ We need to make sure there's a committee that is properly elevated, named and empowered 

since part of the challenge with IoT specifically is the need to bridge the science and the 

technology through an interagency committee. 

○ He discussed two committees that currently exist and provide a similar role:

 Within the White House, there's a function called the National Science and Technology 

Council which brings together all the science and technology agencies to think about 

common visions, coordination and how to advance science and technology. 

 For more than a decade there has been a Computer Enabled Networked Physical 

Systems Interagency Working Group under the Networking and Information 

Technology Research and Development Program (NITRD). 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 10

5. A need to take full advantage of a coherent comprehensive national strategy that lays out a vision.

○ The key is a need for a comprehensive strategy in this area since opportunities are immense. 

As the smart revolution moves from the smartphone to scale like smarter cities, and factories 

we need the smarter policies to go with it.

○ He asked, ‘How can we help advance national priorities and think about strategies to ensure 

US leadership in this space?’ He pointed out that a lot has been done already, so there’s a need 

to think about remaining gaps especially cross-cutting R&D needs and pushing new frontiers. 

○ Mr. Kohlenberger’s experience suggested that we are going to discover that agencies could be 

working on areas that the private sector has already advanced and that multiple agencies may 

be working on similar things. Working together would advance IoT more efficiently. 

Questions and Board Discussion:

● Mr. Caprio indicated that IoT had fallen off the Office of Science and Technology Policy (OSTP)’s 

Critical and Emerging Technologies (CET)4 list. He continued that the board sees an emphasis to put 

it back on the list and shape IoT as a priority again. The board has discussed creating an office in the 

White House or a national coordination office within OSTP and Mr. Caprio asked, ‘How can we be 

constructive to the White House and the OSTP?’ 

○ Mr. Kohlenberger pointed out that the federal government is doing work on IoT everywhere 

but that there is no comprehensive strategy to achieve the full potential.

○ He indicated that he did see IoT being worked cross-sector through network sensing and sensor 

development but acknowledged it’s a problem that others do not have this viewpoint. 

○ He noted that the varying discussion of technology across sectors can hide the commonality 

that all are talking about IoT and that OSTP is the Federal office for this type of coordination. 

○ He noted that the OSTP changed terminology in 2019 from cyber physical systems to computer 

networked physical systems. He acknowledged this raises questions about whether this is the 

same thing and pointed out that this is why common language is so important.

○ Mr. Kohlenberger reiterated that his first recommendation was around funding and that the

OSTP is a key place to be funded. 

○ He cited multiple areas (e.g., quantum, AI) that have national coordination offices and that 

bring together people from multiple agencies on detail. He said they all have the same key 

elements too: a comprehensive national strategy establishing a goal that US should be leader 

and that the National Coordination Office should identify priorities and opportunities to create 

a one stop shop. 

● Mr. Chan asked about who was doing the research. 

○ Mr. Kohlenberger indicated that the National Science Foundation (NSF) is the primary funder 

for research and primarily funds research at universities. 

 DARPA was created to advance technologies that the Department of Defense needed 

but that didn’t have a commercial market. 

 The newly announced regional innovation hubs from the Department of Commerce are 

collaboratives which involve universities, communities, and companies. Like the NSF 

Engines program, these are oriented toward “regional innovation”.

4 Updated 2022 CET list, see: https://www.whitehouse.gov/wp-content/uploads/2022/02/02-2022-Critical-andEmerging-Technologies-List-Update.pdf
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 11

 There are also university-based research projects, applied research projects, 

demonstration projects, and early-stage deployments happening differently across 

agencies.

 There is this whole pipeline of innovation that moves technology down to where the 

private sector can take a hold of it.

Outside Expert Speaker: Dr. Amit Elazari, Open Policy Group

Dr. Amit Elazari

Dan Caprio welcomed Dr. Amit Elazari who is Co-founder and Chief Executive Officer of the Open 

Policy Group and said her work has a focus on IoT security.

● Dr. Elazari was Head of Global Cybersecurity Policy at Intel and worked with government affairs on 

several policy portfolios (e.g., AI, privacy and cybersecurity). She has been engaged in standards 

development and is a co-editor for ISO 27402 on security measures for IoT. 

● Dr. Elazari highlighted the risk of creating policies that do not support innovation, and therefore do not 

support society, if we do not focus on better ways to connect smaller entities (e.g., startups, innovative 

companies, and investment firms) in the context of IoT. We need to do a better job when it comes to 

connecting innovators with policymakers.

● Her recommendations address the need for the federal government to create better platforms to engage 

with the innovative ecosystem and a particular focus on smaller organizations. 

○ She pointed out that a lot of the innovation is happening at smaller organizations that struggle 

with scaling. Leveraging automation to connect all sizes of entities with all levels of 

government is an important priority for IoT. 

○ The IoTAB’s recommendations cover a wide range of sectors which Dr. Elazari indicated 

means there is a need to engage with a broad set of stakeholders in the evolving space.

● Dr. Elazari provided several recommendations:

1. The board should include the development of a technology platform that federal agencies can tailor 

for a specific area that needs feedback / engagement.

○ She indicated this would enable a broader cross-section of small business stakeholders to 

engage and enable federal agencies to solicit feedback and think about the type of partnerships 

that might benefit the ecosystem. 

2. The board should create a subset of recommendations that address the federal government getting 

more feedback from small business as well as increasing IoT adoption among small businesses. 

o She pointed out this also includes working with different communities that may not have been 

engaged in the public policy commenting process such as the investors and venture capital. 

3. The board should call for the creation of JavaScript Object Notation (JSON)

5 formats for policy 

documents to make it easier to parse and tag comments for broader distribution. 

5

JavaScript Object Notation, see: https://www.json.org/json-en.html
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 12

o Dr. Elazari noted that this could be comparable to the difference that Open Security Controls 

Assessment Language (OSCAL)

6 is making a difference in terms of security compliance 

automation. 

4. The board’s recommendations should include policy modernization and look at how the federal 

government cultivates engagement with innovative entities. 

o Dr. Elazari pointed out that a hub could be a way to engage innovators and multiple agencies 

when looking across sectors since a hub allows for centralizing commenting and distribution 

of comments. This could provide a place for innovative companies to come and talk with 

government.

o Dr. Elazari noted that the National Cyber Director has provided more centralization for a 

cohesive strategy around cybersecurity that can be a great idea working in conjunction with 

NIST programs in the space.

● Dr. Elazari was supportive of introducing more cybersecurity requirements and that basic security 

measures are needed. 

○ She noted that one gap is the lack of automation and actual measuring of whether the devices 

are in fact deploying needed controls. 

○ She also noted that in the context of the US Cyber Trust Mark for consumers, more automation 

in the governance of these systems is needed. 

● Dr. Elazari asked how can enterprise solutions support the attestation at scale of third parties testing of 

the controls for existing requirements on IoT devices? 

○ She noted that NIST has created the Special Pubs (SP) 800-213/A7 and there still has not been 

enforcement of these requirements. There is a need to focus on measurability, automation and 

compliance that ensures that as new requirements roll out into US Cyber Trust Mark programs,

there are foundations in place. 

○ She also pointed out that this will create more cohesiveness and trust with the Europeans for

the US Cyber Trust regime and with their Cyber Resilience Act.

● Dr. Elazari identified a challenge as the current separation in government between Operational 

Technology (OT) and Information Technology (IT).

○ Some IoT and OT requirements are coming from different sources and different agencies. 

These need to come together more cohesively and be coupled with a strong automated 

governance culture. 

● Dr. Elazari noted that her biggest call to action is for a platform that is more robust to engage with these 

players and the investors that support them. She noted that the investors and venture capitalists decide 

where the money goes to the innovation of the future and are currently not as engaged with policy 

makers as they should be. 

Questions and Board Discussion:

6

Open Security Controls Assessment Language, see: https://pages.nist.gov/OSCAL/ 7

NIST SP 800-213, see: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-213.pdf

NIST SP 800-213A, see: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-213A.pdf
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 13

● Mr. Caprio asked how Dr. Elazari involved investors and how the board could be thinking about 

cybersecurity in terms of specific recommendations?

o Dr. Elazari recommended that congress should fund programs that are simply focusing on more 

innovative ways to comment and engage on policy that is related to technology.

 This would be inclusive of identifying opportunities, having a pilot in the space, thinking about 

adoption of a technology platform, and cultivating a culture where any public government 

document going out for comment can be consumed by technology to monitor it and bring it to 

the right people at the table.

 For example, she indicated shifting from simply posting a document on the federal register to 

creating Application Programming Interfaces (APIs) into certain platforms that connect to 

agencies to the ecosystem and prompt for comments in real time.

 She advocated using generative artificial intelligence to parse information and categorize it so 

that that in the future, a government agency can have a way to release information on a 

particular topic to an ecosystem that is constantly evolving and getting the right players that 

are working on the technology to answer the relevant policy questions. 

o Dr. Elazari noted that current government processes of soliciting feedback are scattered with 

different agencies looking at various things. 

 Government agencies are mostly talking with big players that can share their voices in the trade 

associations that can afford things at cost and this is a gap. She pointed out that it is a big risk 

to national security and to innovation that government agencies are not talking to the 

innovators.

 She also pointed out that a lot of startups and innovators are not focused on the federal register, 

are not part of trade associations, and don’t have government policy expertise or a policy 

intelligence tool. 

● Mr. Caprio noted that utilization of generative artificial intelligence is a game changer. He asked if 

there are any states that have picked up on this idea or that are doing pilots on this for the subject matter 

expert community. 

o Dr. Elazari indicated that she was not aware of states yet, but that a lot of startups spend a lot of 

money building data scrapers. Dr. Elazari reiterated her stance that documents should be in a 

machine-readable format to be parsed by a bot.

o Dr. Elazari pointed out that a hub would also be useful to streamline comments from subject matter 

experts and helping them to find the right agencies.

Recommendations Discussion

Mr. Chan

● Mr. Chan led a discussion to consider the recommendations from the day’s speakers. He summarized 

the board’s potential responses to this input:

o Accept and formulate recommendation for the report.

o Determine the suggestion is out of scope.

o Pass the suggestion to the IoT Federal Working Group (IoTFWG) for their consideration.

● Mr. Chan displayed six recommendations from Dr. Kvedar’s presentation:

1. Create federal framework for privacy to reduce complexity of compliance and confusion.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 14

2. More education for providers and health systems.

3. Increase funding for staff capacity to implement requirements and processes related to IoT.

4. Solicit feedback on successful privacy and security processes; collect use cases.

5. Empower state Attorney Generals (AGs) to take enforcement action when privacy laws are 

violated.

6. Ensure transparency and explainability on the use of AI to ensure the outputs are secure, 

trustworthy, clinically appropriate, and reliable.

● Mr. Mehra characterized the first (‘federal framework’) and second (‘education’) recommendations as 

being subsets of existing recommendations regarding privacy and workforce. She described increased 

funding for staff capacity as being somewhat different than current recommendations.

● Ms. Reynolds stated a goal to integrate healthcare concerns into the report’s story regarding privacy, 

given its importance to both policymakers and consumers. She noted the gap in general understanding 

regarding the lack of HIPAA protections for data outside of patient-provider situations.

○ Ms. Mehra confirmed that Ms. Reynolds was recommending that Dr. Kvedar’s 

recommendations be incorporated into the board’s privacy recommendations and concurred 

with that approach.

○ Mr. Bergman said he like to contribute to this effort, saying he had created a story for the 

privacy recommendations, and he believed Dr. Kvedar’s recommendations could be integrated.

● Mr. Chan summarized that Dr. Kvedar’s first recommendation be integrated under privacy and his 

second recommendation under workforce.

○ Ms. Mehra clarified that both the second and third recommendations fall under workforce 

development, one addressing current workforce and the other addressing net new workforce.

○ Mr. Chan assigned Ms. Mehra the action to address integrating the third recommendation into 

the report’s workforce material, adding he would contribute to that activity.

● Regarding the fourth recommendation, Ms. Mehra questioned noted the potential to add this to the 

report as a recommendation for further work.

● Mr. Caprio addressed the recommendation to empower state AGs to enforce privacy laws, asserting

that they have the authority to bring privacy actions now, with the ability to act with authorities similar 

to FTC, at their level. He emphasized the need for comprehensive federal law and added that working 

at state level is at cross-purposes with having a strong federal law.

○ Ms. Reynolds suggested using the role of state AG to help tell the story of why we need this 

federal law. She pointed to news that 24 state AGs had sued Meta and said the report’s story 

should be why that would not be necessary if there was a comprehensive federal law.

○ Ms. Mehra pointed out that each state has its own set of rules and regulations and asked if the 

board would recommend a single federal privacy law based on the best practices from each of 

the states. She noted the office of the national coordinator at the Department of Health and 

Human Services (HHS) had promulgated health information technology exchange guidance 

that each state had implemented individually.

○ Mr. Caprio pointed out that federal privacy regulation has evolved such that healthcare and 

financial services are outside of a federal privacy law, pointing to Health Insurance Portability 

and Accountability Act (HIPAA)8 and the Gramm-Leach-Bliley (GLB)9 Act as sector-specific 

8 HIPAA - https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf 9 GLB Act: https://www.govinfo.gov/content/pkg/PLAW-106publ102/pdf/PLAW-106publ102.pdf
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 15

solutions that are “suboptimal, but a reality”. He said the implication was that any current

comprehensive federal law would not address those subjects, even though ideally it should. He

suggested there could be an aspirational discussion in the report’s narrative about a more 

comprehensive approach.

○ Ms. Reynolds concurred, saying the approach was to consider areas where privacy regulation

doesn’t exist but to also acknowledge the lack of comprehensive federal regulation.

● Mr. Chan moved the discussion to the sixth recommendation, regarding AI transparency.

○ Ms. Reynolds stated that the privacy subgroup hasn’t specifically addressed AI. She explained 

that it seemed likely that AI regulation would precede privacy regulation but stated she believed

that the privacy portion is necessary to the goals regarding AI.

○ Mr Caprio stated that he expects much of the AI regulation that is coming will be voluntary 

self-regulation in the U.S. He noted efforts by the White House and pending legislation in the 

EU, and on-going discussion in numerous fora regarding AI transparency and explainability. 

He advocated retaining the board’s support for a comprehensive privacy law and discussing 

the relationship regarding IoT, data, and AI in the report narrative.

○ Mr. Chan suggested this material could be added to Mr. Griffith’s draft commentary on AI and

received support for this approach.

● Mr. Witte presented Dr. Kvedar’s recommendations regarding the FDA and CMS.

○ Acknowledge that SaMD is a medical device and treat it as such for coverage/payment

○ Proactively help stakeholders identify which benefit categories are appropriate for SaMD

● Mr. Caprio said he believed the board could offer informed commentary regarding the opportunities 

and challenges at FDA. 

○ Ms. Mehra stated that, based on Ms. Rerecich’s inputs to the healthcare subgroup, she believes 

SaMD should be considered in scope for the board’s recommendations. She described Dr. 

Kvedar’s material as focusing on barriers to adoption for SaMDs in particular, based on a lack 

of coverage or payment programs established by CMS such that patients and consumers can 

afford them. She supported having the healthcare subgroup create a new recommendation to 

treat SaMDs as medical devices but noted that time is needed to properly populate the board’s 

recommendation template. 

○ Mr. Witte suggested there are specific ideas that the IoTFWG might want to research, such as 

challenges the medical community is having with billing practices. These are topics that 

Congress might be able to help with and could have significant benefits to the healthcare 

community. 

○ Mr. Caprio said he believed there is an opportunity to make a recommendation regarding CMS 

but expressed concerns that the board needed more knowledge regarding the FDA.

○ Mr. Chan gave Ms. Mehra an action to create an SaMD recommendation.

○ Ms. Mehra also took an action to identify FDA’s role in IoMT and emerging technologies.

● Mr. Chan shared his summary of Mr. Kohlenberger’s recommendations:

1. Fully fund IoT R&D (existing funding polls from Bipartisan Infrastructure Law (BIL)

10, 

CHIPS Act11, etc.)

2. Quantify economic potential of these investments

10 BIL, see: https://www.govinfo.gov/content/pkg/PLAW-117publ58/pdf/PLAW-117publ58.pdf 11 CHIPS Act, see: https://www.govinfo.gov/content/pkg/PLAW-117publ167/html/PLAW-117publ167.htm
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 16

3. Bring “interoperability” among the different definitions of IoT

4. Elevate interagency coordination

5. Develop coherent national IoT strategy

● Mr. Caprio clarified that the first point spoke to funding IoT demonstration projects, and the final bullet 

could include advanced sensing as part of the IoT and could also include a national coordination office 

akin to those for other adjacent technologies.

○ Ms. Mehra noted the first two items speak directly to budgetary challenges and said they 

aligned with topics that Dr. Kvedar discussed. She stated the board hasn’t meaningfully 

discussed budgetary challenges and that funding is necessary to address challenges to IoT.

○ Mr. Chan stated that the board’s recommendations had been improved regarding leveraging 

federal funding to encourage the use of IoT. He described these as adoption-oriented, whereas 

Mr. Kohlenberger had focused on R&D.

○ Mr. Caprio described Mr. Kohlenberger’s recommendations as higher-level issues that point to 

the “why” IoT is important. He said these can be polished for the report, and suggested they 

should appear up front in the report. Mr. Caprio stated these are topics that members of 

Congress cared about when they formed the board.

○ Mr. Witte suggested these could appear as findings in the overview section.

○ Mr. Bergman described the first two and last two recommendations as “good ideas” but that he 

doesn’t see “interoperability” of definitions as a barrier and doesn’t see it as on the same level 

as the others. He said that in his experience there were no industry issues regarding the meaning 

of “Internet of Things”, along with similar terms such as cyber physical systems, consumer 

connected devices, and IoMT.

 Mr. Caprio asked how this terminology issue affects the goal of having IoT added back 

to the Critical and Emerging Technologies (CET) list.

 Mr. Bergman stated that “IoT is the broadest, most commonly accepted definition”, 

and other terms are academic or niche” terms. For adding IoT to the CET list he 

advocated explaining IoT as inclusive of those other terms to address the 

interoperability goal. Mr. Bergman expressed concern that there might be pushback 

about modifying the CET list as it is “enshrined statutorily” in some places. He noted 

that IoT is involved in at least two-thirds of the CETs but that having it as a 

consideration for those isn’t as effective as it being directly on the list.

○ Mr. Caprio assessed that there was consensus on Mr. Kohlenberger’s recommendations 1, 2, 

4, and 5. He explained that Mr. Kohlenberger’s suggestion of a National Coordination Office

for IoT was a shift from the board’s current recommendations and would require Congressional 

action. 

○ Mr. Chan assigned an action to Mr. Caprio to review Mr. Kohlenberger’s recommendations 

identify and draft any changes to the board’s existing recommendations for board 

consideration.

● Mr. Chan asked the board for input regarding Dr. Elazari’s presentation.

○ Mr. Caprio noted Dr. Elazari touched on a theme regarding the connection between IoT and

AI, saying she had made it between IoT security and generative AI.

○ Mr. Chan summarized that Dr. Elazari was speaking about challenges for small businesses to 

access and engage on policy documents, saying it would be desirable to increase accessibility 

for smaller business to policy documents that may affect their business.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 17

○ Mr. Caprio suggested there were parallels to the Obama administration’s emphasis on open 

data.

○ Mr. Tseronis stated that open data was part of an overall open government concept and led to 

a 2019 federal data strategy. He stated that “data as a strategic asset” is a pillar of the FY2024 

budget, and that data fuels innovation.

○ Mr. Witte suggested that Dr. Elazari’s points about open policy could possibly be woven into 

the board’s existing policy recommendations.

Approach / Expectations for Report 

Note: This section on schedule was presented as-is during the meeting, however, following both days 

of the board meeting, the schedule was updated. What remains here is a representation of what was 

discussed during the meeting at this time.

Mr. Chan, Mr. Witte

Mr. Chan opened a discussion of the process and timeline for finishing the report.

Slides: Chair’s Agenda and Discussion Slides

● Mr. Witte shared a timeline (at the time of discussion) for finalizing the board’s report.

● Mr. Witte stated that Mr. Kohlenberger’s presentation had contained helpful material about the 

motivations regarding IoT (the “why”) and stated that each of the subgroups need to provide their 

storyboard narratives to support the “why” for their sectors.

● Mr. Witte emphasized the December meeting will be the final opportunity to go through the report as 

a board and consider the overview storyboard, and recommendations. He said the editors need a thumbs 

up or down on December 12th to allow for final revisions before January publication. He allowed for 

the possibility of adjusting recommendations in December but said there isn’t schedule room for new 

recommendations.

● Mr. Bergman asked how the board would approve the final report version after finalization on 

January 14th.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 18

○ Mr. Witte said there’s a need to confirm a formal process. He suggested that could occur at a 

January meeting.

○ Mr. Bergman said the board needs need the “absolute final publication copy read for approval” 

in their hands to review prior to that meeting.

● Mr. Bergman noted the schedule item for “publishing to the NIST website” and asked whether NIST 

would perform any executive review.

○ Ms. Cuthill confirmed there is no NIST review because this is the board’s product, not a not a 

NIST product. She stated it would defeat the purpose of having an advisory board if the agency 

modified its report.

● Mr. Bergman expressed concern about meeting the planned schedule, given other demands on the board 

members’ time, and asked if publication in January was “drop dead necessary”.

○ Mr. Witte stated the recommendations content is essentially complete. He described the 

schedule as difficult but achievable, and pointed out that the IoTFWG is expecting the report 

on time, saying delays will affect their efforts to take action on the recommendations.

○ Mr. Bergman stated a need to make sure the individual steps are achievable, beginning with his 

concerns about the subgroups providing storyboard narratives by November 1st.

○ Ms. Megas said she welcomed discussion on schedule feasibility and suggested an active 

expression of consensus from the subgroup leads. She asked for confirmation that there would 

be no new recommendations after this meeting ends.

○ Mr. Chan stated he expected there would still be some new recommendations to fill gaps.

○ Ms. Megas expressed concern that this did not allow for board approval of new 

recommendation and review of a full report at the December meeting.

● Ms. Mehra asked what happens if the board fails to achieve the 15 January publication date.

○ Ms. Megas explained that Congress directed the IoTAB to deliver its recommendations in 

12 months and that NIST has interpreted this as 12 months from the first meeting. She added 

that her concern was the “general arc” and that the board approve recommendations before they 

are incorporated into the report draft.

● Mr. Chan explained the outline of recommendations mapped to themes shows an overview that 

provides the opportunity to identify strong and weak areas in the report. He noted that some of today’s 

input could strengthen weak sectors (e.g., healthcare) and explained the outline demonstrated why he 

thinks there are still a few more recommendations needed.

○ Mr. Witte stated that there also could be some realignment of recommendations to for better 

balance among sectors.

● Ms. Mehra stated the board should strive to achieve the milestone date. She noted the planned June 2024 

report to Congress by the IoTFWG and asked if timeline had shifted.

○ Mr. Witte explained the IoTFWG has six months to consider its response to IoTAB report, so 

late delivery of the board’s report would affect the IoTFWG report.

● Ms. Mehra asked if Congress could make the decision to move forward and not implement any of the

board’s recommendations, due to shifting views of how to address IoT.

○ Mr. Witte pointed out the board has had speakers that emphasized its importance to Congress. 

He anticipated Congress would take the report seriously.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 19

○ Ms. Megas strongly encouraged the board to help the audience understand the impacts of 

inaction against the potential positive outcomes that can be recognized from IoT. She described 

it as an opportunity to highlight why this needs to be a priority for the report’s various 

audiences, including Congress, federal agencies and the private sector.

● Ms. Mehra expressed concern that the board’s recommendations regarding IoT could be grouped 

together with other competing technologies (AI, quantum, machine learning, etc.) and not recognized 

as unique or innovative. 

○ Mr. Witte described the upfront overview as the place to define why IoT is important and stated 

that Ms. Mehra’s concern is behind the request for stories. He also pointed to a section about 

how IoT is distinct from those adjacent technologies. 

○ Mr. Katsioulas pointed out the need to emphasize how IoT is a data producer for many of the 

“adjacent” technologies, rather than a competitor.

Recommendations Submitted Prior to the Meeting

Small Business & Start-Ups

Mr. Griffith

Document: Draft Small Business Recommendations - IoT Adopters

Document: Draft Small Business Recommendations - IoT Manufacturers

● Mr. Griffith presented two new recommendations focused on small businesses as manufacturers of IoT 

and as adopters of IoT. He stated these are based on an action from the previous meeting to split the 

recommendations related to small business and noted that the wording is very similar between the two 

and much of the content has carried over from the version discussed at the previous meeting.

Small Business 

Recommendation xx

The federal government should accelerate IoT technology adoption for small 

businesses and startup organizations. This can be done via policies, procedures, 

and funding methods that specifically target them.

Approved

Issues:

• Add language clarifying the intent to add an IoT focus to the activities of 

existing support mechanisms and organizations.

● Mr. Griffith discussed the range of mechanisms that might support IoT adoption by small businesses, 

including funding for innovative technologies, modified grant program guidelines, fast track programs, 

business networks and others. 

● Ms. Mehra pointed to the rapidly increasing complexity that comes with adopting IoT. She asked if 

there were other mechanisms to propose in this recommendation that responded to that complexity.

○ Ms. Lam responded that these supporting organizations have technical expertise in their sectors

and can hire subject matter expertise specific to the sector, including IoT, AI, and other 

technologies. She said the approach of tapping into existing infrastructure was to use these 

umbrella organizations to advantage and avoid the need to create something new.

● Ms. Mehra asked what is currently missing, if the recommendation is assuming there is infrastructure 

in place.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 20

○ Ms. Lam replied that the groups exist to support startups in general but there is no dedicated 

support focused on IoT. The goal is to accelerate IoT adoption by working within existing 

agencies.

○ Ms. Mehra replied that Ms. Lam’s language needed to be added to the recommendation, 

describing this as a “net new carve-out for IoT”. 

● Mr. Katsioulas suggested adding language to encourage partnerships between Small and Medium Sized 

Businesses (SMBs) and larger enterprises, to prevent the SMBs from being crowded out of business 

opportunities.

● Mr. Chan suggested there are other government mechanisms such as tax credits that could be included.

Small Business 

Recommendation xx

The federal government should accelerate the adoption of IoT technologies 

manufactured by small business and startup organizations. This can be done via 

policies, procedures, and funding methods that specifically target them.

Approved Issues:

• None

● Mr. Griffith explained the second recommendation is targeted toward accelerating adoption of IoT 

technologies manufactured by SMBs and startups. He pointed out obstacles such SMBs face in 

responding to government RFPs or expanding their sales channels while competing against larger 

organizations. 

● Mr. Chan noted additional barriers for SMBs to market their innovative technologies, such as lack of 

proof of performance compared to large established businesses.

● Ms. Mehra asked about establishing IoT manufacturing clusters of innovation around the country, as a 

possible means to overcome geographic obstacles where start-ups and manufacturing capabilities they 

need are widely separated. She suggested adding that something more than additional funding through 

existing mechanisms, such as manufacturing clusters, might be necessary to have a meaningful business 

impact.

○ Mr. Griffith concurred that visibility into the geography considerations could be helpful, 

especially for SMBs to locate potential partners.

○ Mr. Katsioulas stated that the CHIPS and IoT storyboard for the report calls for multistakeholder initiatives across US and the EU. He said these would be spearheaded by large 

companies but must include innovative small business as well. 

○ Ms. Mehra responded this small business recommendation should tie back to that storyboard.

● Mr. Chan concluded there was consensus regarding these two recommendations. 

Smart Transportation 

Mr. Griffith

Document: Draft Smart Transportation (update to Recommendation 6)

Document: Draft Smart Transportation - 2nd Set of recommendations

● Mr. Griffith presented updates to Transportation recommendation 6 that respond to an action from the 

previous meeting to identify barriers associated with the ability of the electric grid to support growing 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 21

quantities of electric vehicles (EVs). He presented new text under the list of barriers. He is also looking 

for some National Renewable Energy Laboratory (NREL)

12 studies that could be referenced.

○ No objections or concerns were raised.

● Mr. Griffith presented a proposed new recommendation.

Transportation 

Recommendation xx

The federal government should work with various organizations, including 

ASHTO, the state DOTs, private industry, to facilitate interoperability through the 

development of a consistent data dictionary that allows for the sharing and 

exchange of traffic and other data collected form IoT and non-IoT sources.

Approved

Issues:

• Replace “data dictionary” with “data taxonomy” to more clearly convey the 

issue.

● Mr. Griffith identified the origin of this recommendation as conversations with state Department of 

Transportation (DOTs) about the Highway Engineering Exchange Program (HEEP)

13, which is focused 

on accelerated adoption of innovated transportation technologies. Mr. Griffith reported HEEP does 

work with IoT and highlighted the need for a consistent data dictionary to enable multiple jurisdictions 

to exchange traffic data. He identified a range of data of interest including geographic, infrastructure, 

traffic mobility, transportation performance, and traffic anomalies. He identified American Association 

of State Highway and Transportation Official (AASHTO)

14 as the relevant standards body but that 

standards can take a while to create, and there are issues of funding and skill sets (e.g., data scientists) 

to develop a data dictionary.

● Mr. Chan added that the sector is finding that data from technology innovation projects can’t be shared 

with other states, which hinders regional projects. He said that addressing this interoperability issue is 

needed in order to scale the technologies.

● The board agreed that “data taxonomy” was a more appropriate term to clearly convey the issue.

● Ms. Mehra asked if this only applies to transportation.

○ Mr. Chan acknowledged that data interoperability is a broader concern but stated that the 

transportation sector is being held up by fundamental interoperability issues.

Privacy

Ms. Reynolds

Document: Draft Privacy Recommendations

● Ms. Reynolds summarized that she had two updated and two new recommendations, describing her 

presentation as the final recommendation for the privacy subgroup.

○ Update R12, regarding location tracking, is to connect it to the U.S. E-Labeling program, rather 

than specifying the Cyber Trust Mark.

○ Update R10, regarding data sanitization for used automobiles before sale, there’s an 

outstanding intent to provide more detail or identify alternative standards.

12 https://www.nrel.gov/ 13 https://www.heep.org/ 14 https://transportation.org/
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 22

○ Mr. Bergman explained that the NIST standards have multiple levels of sanitization based on 

data sensitivity and his intent was to review them and apply them appropriately based on prior 

experience for similar requirements. He said he would provide that input after the meeting.

Privacy 

Recommendation 13

Mandate NIST sanitization standard for government automobiles before reselling

Merge with R10 Issues:

• Potential for industry concerns regarding mandatory sanitization

● Ms. Reynolds described the new R13 as an offshoot of R10, applied to government vehicles, and should 

have the same changes made as are developed for R10.

○ Mr. Bergman suggested empowering the editors to consolidate R13 with R10, focusing on the 

desired outcome rather that implementation details.

○ Mr. Chan said his only concern was the possibility of losing sight of other government use of 

IoT where similar requirements should apply. He expressed a general philosophy that IoT 

recommendations for industry should also apply to government.

● Mr. Witte asked if the board was comfortable with the term “mandate”.

○ Ms. Reynolds replied that the IoTFWG and the government don’t have to accept the

recommendation as a mandate, but that she preferred to keep that term.

○ Mr. Bergman stated that industry isn’t going to complain about the government imposing 

requirements on itself but might have concerns about mandates on commercial car resellers.

○ Mr, Griffith supported recommending a mandate, saying the government should lead by 

example.

Privacy 

Recommendation 14

Support comprehensive federal data privacy regulation

Moving forward in 

principle

Issues:

• Add “comprehensive” to recommendation to align with terms of art as 

used in the privacy community.

• Remove “framework” from other privacy recommendations and instead 

discuss in narrative.

● Ms. Reynolds explained that there is a recommendation to include IoT in future federal privacy 

regulations but no statement of support for whatever form those regulations might take. She said this 

recommendation supports R04 and adds specific support for establishing Federal data privacy 

regulation, which also responds to industry concerns about dealing with a variety of state regulations. 

Ms. Reynolds noted the work of the House Energy and Commerce Committee related to this topic. She 

described this recommendation as similar to the board’s support for the Cyber Trust Mark program.

● The board agreed:

○ To add “comprehensive” to the proposed recommendation as it is the term of art commonly 

used in the privacy community;

○ To remove “framework” in regard to privacy regulation due to the varied interpretations that 

can be applied to that term.

● Mr. Chan asked for consensus for privacy recommendation R14 as discussed.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 23

○ Mr. Bergman asked how this conclusion fits with the framework recommendations, noting the 

R03 includes a “framework”.

○ Ms. Reynolds acknowledge the need to consider R14 vs R03. She said the approach of placing 

all privacy recommendations under a framework is unworkable and expressed the preference 

to discuss a framework in the narrative but not include it in any recommendations.

● Mr. Witte reported anecdotal feedback the board had received to avoid being overly prescriptive in 

identifying responsible agencies, and to use “federal government agencies” generally to give the 

IoTFWG more flexibility in addressing the board’s recommendations.

Storyboard Discussion for Report 

Mr. Chan

Document: Storyboard Planning

● Mr. Chan shared the storyboard diagram from the previous meeting, saying the board is shifting from 

developing recommendations to mapping them to themes and creating a narrative. He emphasized the 

goal of highlighting opportunities, which he characterized as where IoT can bring significant societal 

and economic benefits, along with implementation approaches and barriers.

● Mr. Chan showed an outline for describing IoT opportunities and an example for the potential of IoT 

and precision agriculture to help small family farms become productive and profitable. The example 

included a range of statistics regarding small farms, examples of how IoT could help their economic 

posture, and barriers to achieving those outcomes.

● Mr. Chan clarified that this approach primarily applies to industry sectors and isn’t a model that needs 

to be followed exactly.

○ Mr. Katsioulas offered that the “numbers element” is most applicable to stories for sector 

topics.

● Mr. Bergman requested and received confirmation that the horizontal topics (cybersecurity, privacy, 

etc.) also need to have stories.

● Mr. Katsioulas asked if the intent was for the sector stories to reference the recommendations associated 

with the horizontal topics.

○ Mr. Chan agreed and added that sectors may have barriers that are addressed by horizontals but 

that any particular sector may not connect to all horizontal topics.

○ Mr. Katsioulas added that the business aspects and transformation of industry would be 

associated with the sector topics.

● Mr. Witte commended the detail and statistics in Mr. Chan’s example but said that approach isn’t 

required for all topics. He emphasized the goal to “tell the story and inspire imagination”, saying a 

mixture of stories that inspire the reader and convey the benefits is desired. He repeated his willingness 

to take this input in any form that is comfortable for the board members.

○ Mr. Katsioulas said he is willing to “put some numbers behind” stories once they are captured.

● Mr. Chan created an action for the subgroups to submit their stories to Mr. Witte by 01 November.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 24

Closing

Ms. Cuthill adjourned the meeting at 5:13 pm.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 25

IoTAB Meeting on Wednesday, Oct 25, 2023

Opening Remarks

Ms. Cuthill opened the day’s meeting. She thanked people for attending and turned the meeting over to 

the chair, Mr. Chan.

Mr. Chan 

Mr. Chan reviewed the day’s agenda. 

Public Participation Speaker: Rajesh Krishnan, Asimily

Mr. Rajesh Krishnan

Slides: Rajesh Krishnan 

Presentation: 

● Mr. Krishnan is Head of Product Marketing at Asimily, a company that protects IoT devices with a 

focus on the medical space. He described his background in ethical hacking, where he learned how 

companies deal with vulnerabilities. He summarized his study of data regarding how vulnerabilities are 

closed, which he said showed no patterns about the ability of varied organizations to close 

vulnerabilities quickly. He also noted that “quickly” could mean over a year from report to closure. 

● Mr. Krishnan said the challenge has shifted from finding vulnerabilities, which he said the marketplace 

does well, to how to mitigate them in an efficient manner. He said many of their customer organizations 

have thousands of devices which they must support with very limited resources, due to lack of funding 

or difficulties in finding suitable personnel. 

● Mr. Krishnan summarized the complex set of actions required to mitigate a vulnerability for a specific 

equipment item and the associated time which he said could total 12-14 hours. He said that when 

multiplied by dozens of problems this can add up to thousands of hours. He added that this process 

usually prioritizes mitigating vulnerabilities based on their severity score along with requirements to 

meet service level agreements.

● Mr. Krishnan said that organizations with a broader set of tools to address vulnerabilities are more 

effective. He explained that those who find vulnerabilities and provide descriptions for how to fix are 

hunters rather than defenders and therefore don’t recognize other mitigation approaches that can “shrink 

the problem” by applying more focused action.

● Mr. Krishnan explained this approach uses a deep analysis of an exploit chain to find the simplest way 

to address that vulnerability, illustrating the approach with a simplified range of options for an example 

vulnerability and their associated time costs. He noted the value of the MITRE ATT&CK15 framework 

to support this process. He also noted the challenges their customers have in competing for talent against 

major technology industry companies.

● Mr. Krishnan stated that most of the industry focuses on the most time-consuming complex approaches, 

which requires a lot of coordination and make permanent long-term network changes that carry a future 

burden. He described an alternative approach of looking at the data available about an exploit, ruling 

out mitigation options that would harm the function of a device or are unacceptable due to FDA 

approval concerns; the latter group could include patching the device. He identified other considerations 

such as degree of device interconnection, the importance of a device, its cost, and the impact of taking 

15 MITRE ATT&CK, see: https://attack.mitre.org/
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 26

it out of service. He summarized the goal as find an efficient remediation approach that doesn’t harm 

the device, based on a contextual risk score. He stated that customers are happiest when they see their 

time for remediation being reduced.

● Mr. Krishnan identified two research areas:

○ Standardized mitigation prerequisites (skills, time).

○ Correlating mitigations with Indictors of Compromise (IoC) or known attacks.

● He focused on what he called a “common mitigation workflow”, describing it as similar to a CWE16

system. He suggested the industry would benefit from having a standard set of approaches to mitigation 

and associated workflows. He described the notion of enumerating a set of known activities associated 

with requisite skills and expected durations. He said the skills sets could be linked to workers on a team 

and by using common mitigation workflows automation could be employed to correlate the available 

personnel and skills to suggest the optimal mitigation using the resources available, using an example 

where a mitigation must be performed quickly in response to a 0-day situation. He suggested that such 

a system could be a direction for “protecting IoT and other things as well”.

Questions and Board Discussion:

● Mr. Bergman described the concept as a very pragmatic look at how to allocate resources to 

vulnerabilities in a prioritized way, rather than considering everything an emergency. He suggested an 

implementation approach of extending the CVE/CVSS system, with vulnerability researchers adding 

data regarding remediation time and skills required for new vulnerabilities and asked Mr. Krishnan 

about that approach.

○ Mr. Krishnan said he envisioned a separate system with variations among different instances. 

He said it seems unrealistic for vulnerability reporters to understand every possible installation 

and suggested instead a baseline menu of the most common remediation that have been known 

to thwart an exploit. He offered the examples of micro segmentation or disabling IPv6 as 

known techniques that could be captured in a baseline as taking about 2 hours for a technician 

with early career skills. He characterized this as putting bounds on the instincts of a manager 

regarding the level of effort for a task.

● Mr. Bergman asked how this information would be generated, and if the description of it as “best 

practice guides for an enterprise” was accurate.

○ Mr. Krishnan agreed with that characterization and offered the vision of a fully formed 

common mitigation workflow, taxonomy and list that would take the place of a researcher’s ad 

hoc commentary about mitigations. The list would identify specific workflows that would 

block a particular exploit chain that had led to identifying a vulnerability. This connects the 

exploit chain to the vulnerability. He said this is where the MITRE ATT&CK framework is 

useful to understanding how the vulnerability is used, offering that it is important to understand 

the exploit for the mitigation to be successful. He offered the hope that this would provide 

efficiencies for defenders through better organization.

● Mr. Bergman asked what recommendations Mr. Krishnan thought the board should make.

○ Mr. Krishnan recognized the value that the CVE and CWE systems have provided. He 

recommended forming a group develop a taxonomy of the sort he had described. He 

encouraged the participation of academia and industry to consider on how granular the 

16 Common Weakness Enumeration: https://cwe.mitre.org/
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 27

taxonomy should be and identify key areas to start with, citing potentially pure networking, 

IoT, or application security. He also pointed to the need to codify the necessary skills, 

suggesting that work experience and certifications could be relevant. 

● Mr. Bergman suggested this sounds like the types of frameworks NIST has created such as the 

Cybersecurity Framework17 and Risk Management Framework18 that apply structured criteria to make 

evaluations. He proposed a recommendation for the government to consider a study to develop a 

common mitigation workflow in a framework format that would provide guidance for enterprises to 

priorities mitigations based on topics such as skills required and remediation time required.

○ Mr. Krishnan agreed with Mr. Bergman’s proposed wording.

● Ms. Cuthill asked if Mr. Krishnan has considered bring this proposal to a Standards Development 

Organization (SDO). 

○ Mr. Krishnan said they had considered that idea, but his small organization currently lacked 

the ability to manage such an effort. 

Outside Expert Speakers: Kathleen Scott and John Marinho

Mr. John Marinho, CTIA, and Ms. Kathleen Scott, Wiley

Mr. Chan welcomed the speakers and thanked CTIA both for their letter and for appearing to discuss it.

Document: CTIA feedback on draft report

Presentation:

● Mr. Marinho explained that CTIA is the trade association for the wireless telecommunications industry 

with a four-decade history in the US, noting that they often provide input on topics like IoT to the 

government including a focus on NIST’s work. He introduced Ms. Scott, who had worked very closely 

with CTIA members preparing CTIA’s letter.

● Ms. Scott said she would highlight key themes behind the CTIA comments and six actionable requests 

for the board to consider as it finalizes its report. She expressed CTIA’s support for the board’s work 

and in particular the emphasis on the benefits of IoT, improving connectivity, and enhancing 

cybersecurity.

● Ms. Scott stated that two key themes drove CTIA’s comments. 

○ First, she said CTIA’s suggestions drive toward promoting approaches that are voluntary, 

flexible and consensus driven. 

○ Second, she advocated the board promote technology agnostic, uniform, and risk-based 

standards that apply across industries, saying that legislation or standards addressing horizontal 

issues such as cybersecurity or privacy should be uniform across industries to help future proof 

the report.

● Ms. Scott moved on to highlight six specific requests: 

○ 1: Bolster the discussion of the benefits that are likely to flow from IoT so its full potential is 

better highlighted. CTIA believes a clearly articulated vision of the potential benefits will make 

17 NIST Cybersecurity Framework, see: https://www.nist.gov/cyberframework 18 NIST Risk Management Framework, see: https://csrc.nist.gov/projects/risk-management/about-rmf
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 28

it easier for policy makers to understand the costs of failing to take key enabling steps. CTIA 

views the board’s report as the best chance for industry to make these benefits known to 

IoTFWG and Congress.

○ 2: Enhance the board’s recommendations for making additional spectrum available. This 

includes: 

 CTIA supports the board’s existing recommendation to promote innovations to 

improve connectivity,

 Expand licensed midband spectrum available for 5G because that spectrum is critical 

to U.S. competitiveness, and 

 Recommend additional funding for accelerated rural broadband deployment on a 

technology-neutral basis, including wireless technologies along with other broadband 

solutions.

○ 3: Apply a set of core principles to guide any additional recommendations regarding AI:

 Recognize and encourage the vast beneficial uses of AI,

 Account for existing laws and regulatory protections to avoid burdensome duplication,

 Recommendations should be uniform across sectors and harmonized to avoid state / 

federal fragmentation,

 Be risk-based and focused on high-risk applications,

 Be flexible and consistent with the NIST AI risk management framework.

○ 4: Expand on the three current recommendations regarding IoT labeling (3.3, 5.1, and 5.5) to: 

 (i) include requirements that any labeling program remains voluntary, flexible, clearly 

scoped, and industry led. A voluntary program enables stakeholders to test different 

approaches and try innovative and adaptable solutions. Flexibility provides for the 

changing cybersecurity capabilities of IoT devices, and the cybersecurity risks faced 

by individual organizations. The scope should remain focused on cybersecurity and 

not be expanded to unrelated information. CTIA also believes that industry is best 

positioned to design labels for consumers that are informative without being 

overwhelming. 

 (ii) provide specific protections for participants to encourage adoption of that voluntary 

labeling program at the federal level. CTIA recommends enhancing recommendation 

3.5 in the draft report to include safe harbors, federal preemption and international 

harmonization. Safe harbors give participants in a voluntary labeling program 

assurance against exposure to additional litigation risk or regulation. Federal 

preemption protects participants against confusing or conflicting state regulations. The 

labeling program should clearly be “a floor and a ceiling” federally enforced. The 

labeling should strive for consistency with international obligations to give global 

customers more confidence and increase efficiency in terms of designing to standards. 

○ 5: Reconsider recommendations to create federal agencies or offices focused on emerging 

technology. “Emerging technology” is a broad and vague term and could end up capturing 

more regulatory authority than intended, and it is unclear when a technology matures and 

transitions to no longer being emerging. Technology agnostic frameworks and standards are 

preferrable. CTIA believes that a better approach to future proof the report is to ensure 

cybersecurity regulation is uniform and platform agnostic. 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 29

○ 6: CTIA notes this was discussed during Day 1; they urge the board to reconsider the draft 

recommendation 1.0 supporting creation of a national data protection framework for IoT and 

instead advocate for comprehensive federal privacy legislation. Such regulation would preempt 

the growing patchwork of state privacy laws and achieve a uniform and technology agnostic 

national approach to privacy.

Questions and Board Discussion:

● Ms. Mehra asked for additional information regarding CTIA’s recommendations regarding WAN and 

spectrum allocations and what the remaining barriers and challenges are.

○ Ms. Scott referenced pages 5 and 6 of the CTIA letter. She emphasized two recommendations 

CTIA would like to see the board add: 

 First: to prioritize mid-band spectrum. She explained that low- and mid-band spectrum 

availability has increased only moderately since 2012. She said CTIA believes that 

“replenishing the pipeline” of mid-band spectrum allocations for licensed operations 

is critical to the development of 5G and U.S. competitiveness in wireless.

 Second: for funding and acceleration of broadband deployment.

● Ms. Mehra asked if CTIA has a map to provide visual understanding of low- and mid-band spectrum 

availability. 

○ Mr. Marinho said yes, adding that CTIA has gone on record with their position about spectrum 

deficiencies that the industry is facing compared to other nations. He said they have shared 

their views with Congress and the FCC and would share them with the board. 

● Ms. Mehra asked where and what constituents in the U.S. are most impacted by lack of low- and midband spectrum availability. 

○ Mr. Marinho explained that low- and mid-band spectrum is “prime real estate” for the wireless 

industry. He said the lack of it in the U.S. creates “an artificial cap on competitiveness”, 

especially regarding the growth of IoT, compared to Europe and China. He offered to submit 

CTIA white papers on this topic to the board. 

● Ms. Mehra asked if this shortfall impacts rural areas more than metropolitan areas. 

○ Mr. Marinho agreed, saying this was particularly relevant to rural broadband deployments due 

to the propagation characteristics of different spectrum. He said CTIA could share their 

analyses.

● Mr. Bergman noted CTIA’s letter is emphatic about the need for licensed spectrum and asked what mix 

they would recommend for licensed and unlicensed spectrum allocations.

○ Mr. Marinho stated that the spectrum mix had evolved over decades and that their concerns 

centered on low- and mid-band deficiencies for licensed spectrum. He said CTIA didn’t have 

a “magic split” but believes the US is at a competitive disadvantage compared to other 

countries. He stated the need to rebalance that because of economies associated with licensed 

spectrum and its benefits, particularly in rural areas. He said there are clear differences in 

allocation between the U.S. and other countries and CTIA’s concern is that the U.S. have a 

“good balance” of licensed 5G spectrum.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 30

● Mr. Chan asked CTIA’s position on spectrum sharing.

○ Mr. Marinho described this as a complex question, saying spectrum sharing is both “very 

promising” and “relatively new”, and that there is a need for innovation and for the industry 

and marketplace to evolve. He said they have seen both positive and disappointing outcomes, 

and that the industry is trying to figure out how to get to the same level of reliability and 

resiliency that consumers and the industry expect. He noted that there is a need for more 

research, more industrialization of the technology, more standardization, and more automation. 

He also noted the potential benefits of AI for spectrum sharing being considered by folks like 

the FCC. 

● Mr. Chan pointed to IoT application that require the benefits of high band 5G and asked if CTIA has 

recommendations for that.

○ Mr. Marinho replied their focus is on low- and mid-band. He said the industry is using highband, but it doesn’t give the coverage advantages of low- and mid-band throughout the country. 

He said that the benefits of high band are primarily in urban and dense areas due to propagation 

characteristics.

● Mr. Witte ask for clarification regarding the letter, where CTIA “strongly supported taking action to 

make more spectrum available”. He noted that the NDAA asks whether there’s adequate spectrum 

available to support the growing IoT market, and asked whether CTIA believed more spectrum is 

necessary for growth or simply better for the industry.

○ Mr. Marinho asserted that the wireless industry has a history of using spectrum very efficiently. 

He said the issue is the U.S. position in a competitive global marketplace based on global 

standards. He said spectrum availability is key to driving economies of scale. Mr. Marinho said 

the question is not “is there enough spectrum?” because industry has demonstrated the capacity 

to sort that out. He stated the question is are we ceding competitive advantage to other markets 

in other countries with better spectrum availability, and are we artificially constraining our 

ability to leverage the propagation characteristics of low- and mid-band to provide broadband 

in rural areas? Are there segments of the U.S. market disproportionately impacted by lack of 

low- and mid-band spectrum?

● Mr. Bergman noted that the infrastructure bill has provided significant funding ($65B) for rural 

broadband. He asked if CTIA was advocating for addition funding, and if they have a specific proposal.

○ Mr. Marinho said there isn’t a specific proposal but confirmed that in addition to the spectrum 

CTIA thinks additional funding makes sense. He concluded that both additional funding and 

additional low- and mid-band spectrum are needed, and that neither alone was enough.

Discuss Outstanding Recommendations

Mr. Chan, Mr. Witte

Today’s Speakers’ Recommendations 

● Mr. Chan solicited the board’s views on addressing the recommendations the day’s speakers.

● Mr. Bergman said he could frame a cyber security recommendation related to common mitigation 

workflow. The board raised no objections to the direction of that proposed recommendation. 

● Mr. Bergman summarized his views on CTIA’s recommendations: 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 31

○ Regarding the positive impacts of IoT he said the board has a recommendation under 

development for Congress to fund a study on that, so no changes to the board’s direction are 

needed.

○ Regarding CTIA’s push for exclusive use of licensed spectrum, Mr. Bergman has asked CTIA 

a question about balancing the use of licensed and unlicensed spectrum. He stated there is a lot 

of support outside of wireless industry for technology that doesn’t require licensing and 

preferred to maintain the balance in board’s current recommendations.

○ He stated there’s an ongoing discussion about C-Band (3.7-4.2 Ghz) disposition compared to 

the rest of the world, and he expects CTIA will provide additional information.

○ He said he had no issues with CTIA’s AI framework and recommendation for it to be guided 

by a set of core principles but declined to write that material. 

○ He stated CTIA’s recommendation on IoT labeling are consistent with CTA’s and said he could 

provide commentary text to support that, which he preferred to direct recommendations.

○ He said he was still not in favor of the board’s recommendation for new Federal offices and 

noted that Ms. Scott has used similar language about unintended consequences. He added he 

hopes the board will reconsider their recommendation. 

○ Regarding CTIA’s recommendations for a “data protection / privacy framework”, he noted he 

proposed adding “policy” to the board’s privacy framework recommendation and felt CTIA’s 

recommendation was similar. He suggested Ms. Reynolds and the privacy subgroup should 

consider if CTIA words could be applied to the recommendation for comprehensive federal 

regulation discussed on Day 1. 

● Mr. Chan said he would assign the recommendations around spectrum and broadband to the 

Connectivity subgroup to provide draft recommendation language to the board.

○ Mr. Chan noted that Mr. Marinho’s response to a question regarding spectrum sharing was that 

“more work needs to be done”. Mr. Chan suggested the board could use that as a 

recommendation.

○ Mr. Bergman noted that spectrum sharing is a strong FCC and industry priority, and he saw no 

need for a recommendation. He stated that this is a difficult technology and an interesting 

opportunity to make more efficient use of spectrum. He suggested the Connectivity group could 

provide draft language about continuing to support spectrum sharing.

Schedule Update 

● Summary of Upcoming Schedule: 

○ October 27: All commentary sections submitted to Mr. Witte (cc Mr. Chan Mr. Caprio).

○ November 1: Get stories of IoT use over due to Mr. Witte (this can be in short paragraphs, 

bullet points, or call Mr. Witte and tell him verbally). Each area needs to have some stories, 

especially the sector teams.

○ November 8: All new recommendations and any modifications to existing recommendations 

due to Mr. Witte (cc Mr. Chan and Mr. Caprio). New and modified recommendations will be 

considered “probationary” in the report and needing further action in the December meeting. 

○ November 15: Mr. Witte and the support team will send a draft report to the advisory board to 

review, redline, and comment on before the December 12-13 meetings.

○ December 12-13 – review and discuss probationary recommendations, all draft content in 

report. No new recommendations will be accepted after this meeting.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 32

○ January (meeting date to be determined, but either the 3rd, 4th or 5th weeks of Jan) – review near 

final version of report. Last time any changes will be made. 

● Mr. Chan summarized the results from the day’s speakers:

○ Mr. Bergman will write up a recommendation from Mr. Krishnan regarding a common 

vulnerability framework.

○ The cybersecurity and connectivity subgroups will consider how to address the 

recommendations in the CTIA letter.

○ The connectivity subgroup will consider draft language about spectrum sharing for an 

appropriate commentary section.

● Mr. Witte noted an additional action for the privacy subgroup to evaluate the Day 1 changes to the data 

protection framework recommendation in light of the CTIA comments on page 7 of their letter. He said 

that Ms. Scott stated the board had largely addressed CTIA’s concerns but suggest that an analysis of 

this point would be helpful.

● Ms. Mehra suggested that spectrum availability affects all of the industries and sectors that the board 

has been considering, especially healthcare and public safety. She suggested that makes spectrum a 

horizontal issue. 

Slides: Telit Cinterion Recommendations

Document: Telit Cinterion White Paper

● Mr. Chan noted a letter from Telit Corporation received this week that was sent to the IoT Advisory 

Board and said he would like to discuss its content. 

○ Mr. Bergman said he both he and Mr. Griffith had commented in emails to the chairs and the 

subgroup. He said Mr. Griffiths comments were that the recommendations “appear very broad” 

and that the Cyber Trust Mark program addresses some of them for the consumer sector. Mr. 

Bergman said that process is already going on and addressing the first two recommendations. 

○ Mr. Bergman said he opposed adopting the third recommendation, to “have U.S. Government 

accredit providers”. He suggested that having the government give a mark of approval for 

software and services providers (outside of Federal acquisitions) is “not the way we would 

want to go” but acknowledge that it might be possible instigate a voluntary program. He noted 

that NIST had looked at consumer software security criteria and that effort gained no traction 

after initial report and said the framing of the recommendation made him nervous about 

establishing a new government power. 

○ He concluded that both his and Mr. Griffith’s conclusions are to take no action.

● Mr. Chan shared the recommendations page of the submission. He stated the source is a “module 

maker” that is heavily reliant on Chinese cellular modules and concerned about the risks. 

○ Mr. Bergman pointed out that the Cyber Trust Mark program at FCC includes a concept that if 

a company is on the entity list, they should not get the Mark, noting that such companies also 

can’t sell in the US. He pointed out there are other lists and that there is already a discussion of 

how to use the lists to deal with companies, people, and equipment deemed “not secure” by the 

U.S. government and protect the integrity of the Cyber Trust Mark. He acknowledged that the 

FCC hasn’t announced any decisions, but said the apparent direction is that there are about 5 

or 6 such lists which will be used in the context that they are defined to discredit companies. 

He said it is easier to identify and maintain a list of discredited companies.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 33

○ Mr. Chan clarified that the recommendations are focused on modules, which aren’t covered 

under the labeling program.

○ Mr. Bergman agreed and suggested there could be a recommendation to add coverage of 

modules to the Cyber Trust Mark program. There were no objections to this proposal.

Review of Existing Recommendations 

Document: Draft Environmental Monitoring

Environmental 

Recommendation 4a

Utilize IoT technologies to facilitate carbon transparency across economic sectors.

Accepted Issues:

• None

● Mr. Chan displayed the updated environmental monitoring recommendation renamed “carbon 

transparency” and revised based on comments from last meeting. He noted the added language 

regarding federal grants for carbon emissions monitoring using IoT technologies, and confirmed there 

were no objections to the changes.

Previous Speaker Recommendations 

Document: Revised Organization of Recommendations for Report

● M. Chan displayed the recommendations mapped to themes from the pre-read in order to discuss gaps. 

He noted some areas are light on recommendations and noted the board had heard from speakers on 

those topics.

● Mr. Witte noted that some sector-specific recommendations have been moved to broader topics. He 

cited several examples that have been moved under the theme of federal grants and programs. He said 

there are still opportunities to move things around. He suggested there are three approaches:

○ Move all recommendations under the themes and avoid topic-specific “leftovers”;

○ Move some recommendation from the themes to topic-specific sections;

○ Continue with the current approach with the majority of recommendations under the themes 

but retains individual topic-area recommendations.

● Mr. Witte recommended the approach of grouping all recommendations under themes and using a 

legend or a matrix to link them to the topics in the NDAA. He suggested that some topic areas seem to 

be lightly covered but said that was because their recommendations had been grouped under themes.

○ Mr. Chan concurred with Mr. Witte’s recommendation but stated the need to get input from 

the board. He noted that many recommendations had been “up leveled” under the themes but 

that he believes there are still gaps in healthcare, public safety, and small business. He noted 

that healthcare recommendations could be developed from the Day 1 speakers and suggested 

that the recommendation from Chris Moore should be considered for public safety. 

○ Mr. Witte noted the option to identify subjects where the board didn’t have specific 

recommendations but recognizes the importance of the subject and encourages additional 

studies and research. 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 34

● Mr. Chan shared a slide of key points and recommendations from Ms. Morrow’s September 

presentation on critical and emerging technologies and said that Mr. Caprio is working on one related 

recommendation. 

Previous Speaker Recommendations: Chris Moore 

● Ms. Kahn noted that public safety is a dual topic, encompassing both first responders and the safety of 

citizens, and asked if any recommendations from smart cities could be applied to public safety.

● Mr. Chan agreed there is an intersection. He displayed three public safety recommendation from Chris 

Moore:

○ Federal grant solicitations and guidance should address how IoT could/should be incorporated 

into Federal programs.

○ Federal RFPs/RFIs should include a requirement for an IoT plan (at a minimum to show that 

bidders have thought about how IoT could be incorporated into large projects.

○ General statement about how new technologies are merely tools and should not be avoided 

because of potential or theoretical risks.

● Mr. Chan describe a project Mr. Moore is involved in to upgrade 911 systems nationwide. Mr Chan 

identified a smart cities / public safety connection from Mr. Moore’s description of the potential to 

integrate IoT data into next generation 911 systems to provide dispatchers with greater situational 

awareness to help with prioritization in dispatching first responders. 

○ Ms. Mehra agreed that the 911 upgrade program is a new item worth discussing but asked what 

the board might recommend beyond that the program should incorporate privacy and security 

considerations from the board’s other recommendations.

○ Mr. Chan stated that 911 upgrades are going on “sporadically” and that most jurisdictions are 

not using the latest technologies. He said Mr. Moore is trying to get the funding for the centers 

to get next-gen 911 upgrades, which is the opportunity to include IoT in those systems. He said 

the recommendation would be that next-gen 911 systems incorporate data feeds from smart 

cities and IoT technologies.

○ Mr. Chan noted that Mr. Moore’s first two recommendations are similar to existing upleveled 

recommendations that could be connected to public safety, and also to transportation and 

sustainable infrastructure.

○ Mr. Chan described Mr. Moore’s third recommendation as general for new technologies that 

had been presented in terms of the privacy concerns associated with cameras and facial 

recognition that have caused some cities to reject them. He said Mr. Moore is saying that the 

technology should be considered, weighing the benefits and risks, and managing the risks 

through things like the policies developed by a police chief’s association. He noted that such a 

recommendation could be broader than public safety and could also apply to things like selfdriving vehicles. He said the broader point is to consider both benefits and risks.

○ Ms. Mehra pointed out a consideration for the next-gen 911 program is the diminishing number 

of homes with landline telephone connections. 

○ Ms. Coughlin noted the challenges of cameras being combined with AI and becoming 

multifunction devices. She identified a potential data feed for next-gen 911 being smoke 

detectors that can automatically place an emergency call. She summarized that it would take a 

long time for next-gen 911 to be widely deployed.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 35

○ Ms. Mehra stated that from reading about the next-gen 911 program on the NTIA website,19 it 

hadn’t received a progress update since July of 2021. She suggested Mr. Moore was pointing 

out the need for updating the program. Ms. Mehra said she would draft a recommendation for 

this in the public safety area, saying this seems a valuable and important program. She also 

stated the intent to reach out to the program contact at NTIA.

● Mr. Chan summarized that Mr. Moore’s first two recommendations will be addressed by incorporating 

language into existing upleveled recommendations. 

● Mr. Chan summarized Mr. Moore’s third bullet as saying to avoid blanket judgments that new 

technologies are bad, with cameras and facial recognition as a specific example.

○ Ms. Mehra and Ms. Coughlin agreed to draft a recommendation for public safety regarding 

cameras as IoT.

Previous Speaker Recommendations: List

● Mr. Chan shared a list of invited speakers from previous board meetings prior to July; the list has also 

been shared via email (outside speaker recommendations from July, August and September have 

already been considered separately). He noted that he also provided links to the relevant meeting 

minutes. Mr. Chan said the action is for the board members to go through the list and identify additional 

recommendations the board should consider.

○ Mr. Witte suggested this activity should be limited to only recommendations that fill a major 

gap.

Open Action Item Review 

Mr. Benson Chan, Chair & Mr. Dan Caprio, Vice Chair

Slides: Chair's agenda and discussion deck

● Mr. Chan shared the list of outstanding action items from the previous meeting.

19 https://www.ntia.gov/category/next-generation-911
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 36

● Mr. Chan stated Mr. Bergman recommended removing recommendation 3.7 and that Mr. Tseronis has 

responded via email that he disagreed but was amenable to the removal.

○ Mr. Witte concurred and stated he believe there was the same agreement on PPD-21. 20

○ Mr. Chan stated his understanding was the intent was to learn more regarding the update in 

progress.

○ Mr. Witte replied that there wasn’t an action but the intent to notify those responsible for the 

update of the board’s concerns. He stated that he would treat the removal of both the SRMA21

20 Presidential Policy Directive 21 (PPD-21), Critical Infrastructure Security and Resilience, see 

https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-criticalinfrastructure-security-and-resil 21 Sector Risk Management Agencies, see: https://www.cisa.gov/topics/critical-infrastructure-security-andresilience/critical-infrastructure-sectors/sector-risk-management-agencies
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 37

and PPD-21 recommendations as a “probationary removal”, in the spirit of the process for new 

probationary recommendations agreed upon earlier.

● Mr. Chan reviewed the commentary writing assignments from the September meeting:

○ Quantum computing (Mr. Bergman, Ms. Mehra)

○ Platform business and ecosystems (Mr. Katsioulas)

○ Privacy (Ms. Reynolds)

○ AI (Mr. Griffith)

○ Consumer (Ms. Rerecich)

○ Smart Home (Ms. Mehra, Ms. Rerecich, Mr. Griffith)

○ Smart Infrastructure (Mr. Tseronis, to be confirmed)

○ IoMT (Ms. Mehra)

● Mr. Chan said the AI commentary had been drafted and could be reviewed. He said it had been 

circulated in the pre-read for the meeting.

● Mr. Katsioulas stated the supply chain commentary was 95% complete and that he needed to 

synchronize with Mr. Witte.

● Mr. Katsioulas said the platform-based business ecosystems material was in-progress and that the key 

message is that one of the biggest issues for lack of accelerated adoption is the need for a broader, 

orchestrated ecosystem partnerships. He said he hoped to have the first version by early the next week.

● Mr. Bergman confirmed he is on track to provide the quantum commentary.

● Mr. Chan, the board members, and Mr. Witte discussed the appropriate length for the commentary with 

the following results: 

○ Two to three pages is a reasonable target, acknowledging that the lengths would vary; 

○ Key is to develop content and deliver to Mr. Witte, final adjustments for lengths can be left to 

editors; 

○ Focus on “telling the story;”

○ Include a few sentences about why the subject is relevant to the report; 

○ Push home the benefits with specifics regarding the economic and societal benefits from IoT 

devices; 

○ Graphic ideas are helpful; and

○ Most critical is for members to meet the schedule with draft material. 

● Mr. Witte advised that AI should probably both have its own commentary section and be addressed as 

needed in relation to specific topics in the report. He said the link between AI and IoT is significant.

○ Mr Chan noted that a lot of the data to be process by AI would come from IoT. He noted that 

Dr. Kvedar’s day 1 presentation emphasized the need for AI explainability in medical devices 

and diagnoses. He also noted the use AI in cybersecurity for threat analysis and recognition.

○ Mr. Katsioulas emphasized the importance of quality, trusted data to the effectiveness of both 

AI and quantum computing.

○ Mr. Witte noted the implications of this for the quality of data produced by IoT devices.

○ Mr. Katsioulas connected this to the need for trusted supply chains. 

● Mr. Chan summarized that the remaining action items were completed.

Draft Commentary 

Document: AI Commentary Example
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 38

● Mr. Chan asked the members if they had reviewed Mr. Griffith’s AI commentary. The following 

comments were made: 

○ Overall, a good model and the two-page length was good; 

○ Needs overview material added; 

○ Generative AI should be added for the commentary to not seem dated; (Note: there are 

recommendations which address generative AI in the report)

○ Add material to connect the commentary to some of the sectors in the report;

○ Could address the need for trustworthy data from sensors and security for the connectivity to 

sensors; 

○ Graphic ideas are helpful, for AI this could be an image depicting “IoT sensors securely 

providing input into AI”.

● Mr. Chan raised the topic of how to discuss personas in the report, describing the diversity of personas 

that have been discussed and noting that Ms. Reynolds had provided some relevant material. 

○ Mr. Katsioulas suggested thinking about personas in two ways: the users of the devices and the 

entities involved in providing a solution. He said is important to identify developers, 

distributors, domain experts, etc. He said he would discuss this in general terms in the platform 

systems commentary, but that specifics are needed to connect personals to sectors and use 

cases. 

○ Mr. Witte recalled that personas were conceived as a tool for the board to review its 

recommendations to ensure proper coverage. He suggested the report could speak to personas 

broadly, noting that there are many types of people who are impacted by and who have impact 

on the IoT and that the report covers a number of different personas. He said it would be 

difficult to connect specific personas to each recommendation. 

○ Mr. Chan suggested this could be a commentary section tied to benefits, such as the benefits of 

IoT to consumers and to manufacturers. He said the personas that don’t get talked about are the 

people who service the IoT, suggesting that this is an entire new category of service jobs and 

that the maintenance of IoT has received little thought. He noted that cities expect long lifetimes 

from products used in public works. He also noted the need for hardware and software 

developers for IoT. He suggested that a discussion of how different personas benefit could be 

used, rather than a discussion of economic benefits to businesses. Mr. Chan concluded that he 

could write this commentary.

Continuation of Discussion of Draft Report 

Mr. Witte

Document: Revised Organization of Recommendations for Report

Recommendations Organized Under Themes

● Mr. Witte shared the outline of themes and recommendations from the report. He said the goal was to 

get feedback on the organization of recommendations against the themes. He said that each theme 

would include introductory text followed by the specific recommendations.

● Review of the infrastructure theme. 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 39

○ There are many sector-specific examples and recommendations that can assist with creating 

introductory text. Examples are used to illustrate the needs being addressed by the theme and 

do not take the place of specific recommendations.

○ Mr. Witte asked for feedback regarding recommendations that call for NIST to lead, saying 

they “stood out” as the report’s recommendations generally don’t call out specific agencies. 

○ Mr. Bergman restated his view that the goal is interoperability, rather than the creation of 

standards. He advised against leading with the term “standardizations” and recommended 

leading off with “a need for interoperability”, saying that would lead readers in the right 

direction.

○ Mr. Katsioulas supported Mr. Bergman’s view, adding it may be necessary to review available 

standards and identify gaps but also that there are other means to achieving interoperability.

○ Mr. Witte said he would revise the section accordingly and requested review when a revised 

version is available.

● Review of the IoT Trust theme.

○ He suggested the introduction could include material based on the comment from Chris Moore 

about balancing benefits and risk. He proposed a statement that discussions about trust must be 

balanced between considering what harms might be done and what benefits might be received.

○ The recommendations for a data protection model no longer uses the term “framework”. Mr. 

Witte noted the board may have more input on the terminology.

○ Mr. Witte took an action to consult with the privacy team regarding the use of “confidentiality”. 

The concern was clarity about confidentiality applying to enterprises whereas privacy is the 

appropriate term relative to individuals. Mr. Witte concurred, saying that both concepts are 

necessary for trust and data protection, but they are not equivalent.

○ Mr. Witte noted there are new recommendation from the privacy team that aren’t yet in the 

outline and will be added to the IoT Trust theme.

○ The recommendation to make the electric grid more resilient generated some discussion of its 

appropriate placement. While availability is an element of trustworthiness, the electric grid 

recommendation had originated as a sustainable infrastructure recommendation.

● Review of the supply chain theme: 

○ Mr. Witte noted there is an abundance of material to incorporate here. He said the overarching 

recommendation would be around the monitoring process the supply chain team had 

emphasized is important for protecting the integrity of the supply chain.

● Review of the leadership and government capability’s theme:

○ It was noted that some of the government capability recommendations could also fit under 

cybersecurity. 

○ Mr. Katsioulas pointed to the developing regulatory environment in the EU, particularly the 

Digital Product Passport, and noted the future need for products imported to Europe to follow 

their regulations.

○ Mr. Witte noted the recommendation about federal grants to “reskill” workers and noted it 

could be moved to the workforce theme but was currently grouped with related 

recommendations about grants and programs about government leadership.

● Review of the IoT-ready workforce theme:
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 40

○ The advice the board has received to be specific about what workforce concerns are specific to 

IoT to improve adoption and reduce barriers. Mr. Witte suggested this was an opportunity to 

add content or a recommendation to this theme regarding the demand for workers compared to 

the supply.

○ Mr. Katsioulas reported on workforce discussions from a seminar on the CHIPS Act where it 

was reported that workforce, not funding, is the biggest issue for CHIPS Act implementation 

due to large technology companies hiring all the available talent. Mr. Katsioulas reported that 

an educator had described difficulties in interesting students in the skill sets needed for 

semiconductors and IoT. He suggested there is a need for the government to create incentives 

to learn those skills and inform students of their career value.

○ Ms. Mehra described this an “IoT-ready workforce” recommendation to create a new 

generation of “graduates that embrace IoT”.

○ Mr. Chan stated the scope of an “IoT-ready workforce” is much broader than engineers and 

needs to include people in manufacturing, installation, maintenance, data science and other 

skill areas. He cited the example of a shortage of these skills impeding achievement of carbonfree power generation goals by limited manufacturing and installation capacity. He also 

acknowledged that the pay gap between IoT-oriented positions and those in the large tech 

industry companies is a significant factor.

○ The specific concerns and challenges of small businesses in hiring critical skilled employees 

were identified as important for the workforce theme. The following considerations arose from 

the board on this issue: 

 The recommendation needs to emphasize the innovation typically provided by such 

businesses and the challenges of small business;

 The recommendation should fit into the small business category to balance against the 

large technology companies;

 Provide examples of businesses in older industries where IoT technology is now 

becoming pervasive and need an IoT-ready workforce to support it (e.g., paper mill 

example came up);

 Large technology companies have such deep pockets that they make it difficult for 

small companies to compete;

 It was noted that innovative startups are needed to fill gaps and support the large 

technology providers, leading to accelerated growth. He said he has seen this occur in 

many different markets. 

○ Mr. Witte described these as aspects of creating an IoT-ready workforce, including reskilling 

experienced engineers, encouraging future engineers, and training engineers in related areas to 

learn more about how IoT applies to their specialty (he used the example of highway engineers, 

as noted by a previous invited speaker).

● Mr. Witte addressed recommendations not yet aligned with themes. 

○ He said these recommendations aligned with the NDAA tasking but suggested aligning each 

of them with one of themes would make the report more streamlined and readable. He 

acknowledged that alignment would not be a perfect fit. Mr. Witte suggested that many could 

fit into the group of government leadership recommendations.

○ Ms. Mehra concurred that the public safety recommendation in this group could align with 

government leadership.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 41

○ Ms. Mehra pointed out that the environmental monitoring recommendation related to carbon 

emissions from farms originated from the agriculture subgroup and had been expanded to a 

broader requirement on carbon transparency.

 Mr. Chan confirmed this history.

 Mr. Katsioulas offered that he could provide data related to maritime operations as a 

major source of carbon dioxide and the potential for IoT to aid in its reduction.

 Mr. Witte and Mr. Chan agreed this would be helpful data, especially with actual 

numbers.

○ Mr. Witte said that the editors will integrate these recommendations into the themes, while 

ensuring that the sector-specific aspects aren’t lost to show alignment to the NDAA topics and 

support development of the planned compliance matrix.

○ Mr. Witte said that the CTIA presentation had provided data related to recommendations about 

spectrum considerations.

○ Mr. Witte noted the potential to add mention of specific proceedings or negotiations under the 

international subject area.

 Mr. Chan pointed out that the international content is primarily about harmonization 

and has very little material related to trade.

 Mr. Witte replied the “proceedings and negotiations” item was a specific request in the 

NDAA.

 Mr. Katsioulas offered that he could provide relevant content about trade from some 

of the early supply chain drafts.

○ Ms. Cuthill asked if there are recommendations related to the NDAA topic of “identification 

of regulatory barriers”.

 Mr. Chan suggested this is covered by recommendations related to grant practices, 

programs, budgetary and jurisdictional challenges.

 Mr. Witte said the recommendations address the need for additional regulations but 

have not considered existing regulations.

 Ms. Cuthill stated the board should be explicit if there aren’t barriers associated with 

existing regulations.

 Mr. Chan mentioned sector specific policies, such as city policies prohibiting facial 

recognition systems on the basis of privacy, as inhibiting the deployment of IoT. He 

suggested this would be best handled in commentary sections.

● Mr. Witte identified three recommendations to mark as probationary removals:

 3.6: include IoT in PPD-21

 3.7: guidance for SRMAs

 3.8: multi-stakeholder sector-specific considerations

● Mr. Bergman stated a preference that three recommendations currently under “Establish Government 

Capabilities” should be moved to Trust to better group cybersecurity recommendations:

 3.1 Upgrade federal buildings with inadequate cybersecurity

 3.3 Prioritize broad and active industry engagement re: labeling

 3.5: Congressional support to deploy IoT cybersecurity labeling
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 42

● There was discussion of moving supply chain recommendations related to trust in the supply chain to 

the IoT trust theme. 

○ This is a subset of the Supply Chain recommendations which include many more specific 

recommendations that the other broad themes. 

○ Mr. Katsioulas said that he preferred to wait for the next report draft before determining which 

supply chain recommendation should be moved. 

● Mr. Witte concluded by soliciting feedback on the organization of the report. He said the themes were 

a helpful organizing construct and made the report easier to read. He thanked the board for input in 

developing them.

Recommendations Not in The Current Draft

● Mr. Chan shared some recommendations he stated had been approved but aren’t in the current draft. 

○ Under sustainability: 

 Facilitate and support research, development and deployment of low-cost air quality 

sensors.

 Utilize IoT technologies to facilitate carbon transparency across economic sectors.

 Recommendation regarding wide area environmental monitoring 

○ An additional privacy recommendation. 

○ IoT and small business related recommendations 

● Mr. Witte stated the editors have tried to maintain traceability but welcomed any corrections. He said

he would double-check against previous meeting minutes.

● Mr. Chan said that all five of the recommendations he’d mentioned were contained in the pre-read for 

this meeting. 

Overall Report Status 

● Mr. Chan solicited the board members’ views on what is missing from the draft.

● Ms. Mehra suggested reviewing the draft through the lens of what the world could look like in 5 years 

and asked if it would be helpful to have a means to see how the IoT agenda has progressed. She said 

the board has produced important, tactical recommendations that answer the charter but having learned 

how pervasive IoT is there may be a missed opportunity to recommend a “national dashboard” to 

measure progress.

○ Mr. Chan agreed that a business would want to develop metrics to monitor progress toward its 

goals. He suggested a recommendation to develop metrics to monitor progress would be 

worthwhile.

○ Mr. Katsioulas expressed support for such a recommendation but was skeptical of how 

effectively such measurements could be made with government. 

○ Mr. Chan stated Ms. Mehra’s point about progress of 5 years was worthwhile and suggested a 

recommendation the IoTFWG to identify areas for aggressive actions such as privacy or 

cybersecurity. 

○ Ms. Mehra responded that the goal isn’t to give priority to particular areas but to report “the 

state of the union” with regard to the board’s recommendations to shows where we are making 
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 43

progress, and where we need additional resources to continue to be a leader in IoT design, 

development, implementation, and adoption. 

○ Ms. Mehra said the value of a dashboard, compared to periodic reports, is to provide on-going 

visibility based on data imported from various resources. She suggested members of Congress 

or anyone else should be able to visit “IoT.gov” to see status and drill down to state, county, 

even street level. She summarized it could be a wrapper for the board’s set of barriers and 

recommendations.

○ Ms. Coughlin was supportive of the dashboard concept and concurred with Ms. Mehra that 

reports very rapidly become outdated.

○ Mr. Katsioulas said it is important to identify tangible metrics for measurement, suggesting 

growth in IoT manufacturing supply, businesses offering IoT services, and use of dataenabled ML AI applications. He suggested it would be worthwhile for the board to offer 

metrics along with benefits.

○ Ms. Mehra expressed the concern that it’s not possible to define a KPI for every 

recommendation. She suggested recommending creation of an “IoT.gov” to monitor progress.

○ Mr. Chan described describing this as a capability to measure the acceleration of IoT into the 

economy.

○ The board members were supportive of creating a website tracking progress in IoT. The 

“CHIPS.gov”22 website was identified as a potential model for a comparable IoT status website.

● Ms. Mehra took an action to draft a recommendation for creation of an “IoT.gov” website.

○ Mr. Katsioulas and Mr. Griffith volunteered to assist. Ms. Rerecich offered to serve as a 

reviewer.

○ Mr. Chan reminded the group to follow the recommendations template the board has been using 

to ensure the key points are captured in this recommendation. He emphasized that the objective 

is to formulate a recommendation for tracking progress, not to design a website.

○ Mr. Katsioulas described the intent as to suggest types of content needed and leverage an 

existing example.

January Meeting

● Mr. Chan discussed the scheduling of the January meeting. The consensus was to avoid the first two 

weeks of January, leaving the options of January16-17, 23-24, or 30-31. Mr. Chan said he would followup with the entire board to select the dates for the meeting.

Action Items and Wrap-up

Mr. Chan, Chair

● Mr. Chan displayed and walked through the action items he had captured during the meeting; key 

points: 

○ Several actions address recommendations from this meeting’s speakers by integrating into 

existing recommendations or drafting new recommendations.

○ Many actions are due by November 8th, especially submission of “probationary 

recommendations”.

22CHIPS.gov, see: https://www.nist.gov/chips
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 44

○ Mr. Katsioulas added an action to enhance the workforce development commentary regarding 

the balance of supply and demand and the impact of the “magnificent seven” companies.

 Mr. Chan recorded that additional action (not displayed below)

○ Mr. Chan noted he expect several board members would contribute to the “iot.gov” 

recommendation.

● The edited list of actions was:

● Mr. Katsioulas requested the next draft report be sent at least a week in advance of the December 

meeting and that all board members be urged to carefully review, captures redlines, and bring their 

feedback to that meeting. He said the board needs to “get to a lot of conclusions” at the December 

meeting to avoid slipping delivery into February. He expressed the need to have as many board 

members as possible for that meeting.
INTERNET OF THINGS ADVISORY BOARD (IoTAB)

Minutes, Oct 24-25, 2023

Page 45

○ Mr. Witte stated the draft will be available well in advance of the December meeting and 

thanked Mr. Katsioulas for his emphasis on having strong attendance to do a quality review.

● Mr. Chan stated his view that the meeting has made a lot of great progress, including identifying and 

gaps and assigning actions to fill them. He thanked the members for their contributions.

Ms. Cuthill adjourned the meeting.