Security in the Billions

Securing Consumer IoT Products 

Presentation by Justin Sherman and Patrick Mitchell 

NIST IoT Advisory Board 

January 19, 2023 

Report by Patrick Mitchell, Liv Rowley, and Justin Sherman 

with Nima Agah, Gabrielle Young, and Tianjiu Zuo for the Atlantic Council 
 

 

 

 

 

Data Driven - Comprehensive IoT Survey 

International Focus – Four Countries 

• United States, United Kingdom, Australia, Singapore 

Private Sector Security Efforts 

Industry Organization Security Efforts 

Risks and Activities Across Three Verticals 

• Smart homes 

• Networking gear 

• Consumer health 
 

Government procurement 

Voluntary Code of Practice 

Current 

Methods 

Mandatory minimum standards 

Industry guidance 

Country-wide labeling 
 

 

 

 

Current Hurdles 

Challenges for State Challenges for Private Sector Challenges for Users 

Fragmented approach across Ambiguous requirements and policy Little to no information to make good 

jurisdictions goals buy-side choices 

Fragmented approach within Diverging process and regulatory Bad security outcomes/insecurity 

jurisdictions requirements Harmful knock-on effects 

Duplicative certification schemes 

 

Recommendations – How to 

Achieve Harmony in the 

Ecosystem 
 

Our Approach 

Tiers (of security measures) 

Recommendations (countryagnostic implementation) 

US guidance (specific 

implementation) 
 

 

 

 

 

 

 

 

Mandatory baseline to ensure IoT products have 

most basic and critical security measures in place 

Tier 1 – 

Minimum 

Baseline 

Features 

Random government audits to ensure compliance 

Set by government agency responsible for 

cybersecurity standards 

Should be rooted in widely agreed upon standards, 

such as ETSI EN 303 645 

Manufacturers self-attest to meeting standards 

Receipt of label for compliant device 
 

 

 

 

 

Standards above baseline 

Tier 2 – 

Enhanced 

Security 

Features 

Result of government consultation with 

industry 

Draw inspiration from international 

standards such as ETSI EN 303 645 

Labels are independently verified through a 

quick and cheap process 

Receipt of label for compliant device 
 

Set by industry-specific regulators 

Special 

Standards 

for Safety 

Critical 

Products 

Highest bar of security standards 

for products that could impact 

human life 

No accompanying label 
 

 

 

 

 

Labels 

Physical & digital 

Consider cooperating with industry, academic, civil society on design 

Aimed at individuals and enterprise 

Clearly articulate information 

Mutually recognized across jurisdictions 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation Sets 

• Set the Baseline of Minimally Acceptable Security (Tier 1) 

• Recommendation 1: Governments should implement regulatory measures to enforce a mandatory baseline on 

manufacturers selling in their markets. 

• Recommendation 2: Governments should follow the “reversing the cascade” philosophy, where instead of trying 

to influence manufacturers based abroad, governments put pressure on domestic suppliers and retailers—who

may, in turn, put their own pressure on manufacturers to improve security. 

• Incentivize Above the Baseline (Tier 2) 

• Recommendation 3: Governments should support the creation of a voluntary, higher tier of security requirements, 

indicated via labeling programs in their markets. 

• Recommendation 5: In the short term, governments should reach agreements to mutually recognize each other’s

labels. 

• Pursue international alignment on standards and implementation that cover entire lifecycle 

• Recommendation 7: Governments should pursue outcomes-based approaches to consumer IoT security rooted in 

agreed-upon basic security principles and maintain similar definitions for products considered “in-scope.” 
US Specific Guidance 

Set the Baseline of Minimally Acceptable Security 

• States should pass and enforce their own IoT security laws. 

• The federal government should adopt the binary labeling approach 

proposed by NIST. 

Incentivize Above the Baseline 

• Provide incentives for industry to obtain labels. 

• Provide liability protection for firms that pursue the higher, tier 2 

security standards. 
For more information, reach out to us at therr@atlanticcouncil.org!