Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/applied-cybersecurity/frequently-asked-questions-faqs-nistirs-8259-and-8259a-final

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology Laboratory

## Applied Cybersecurity Division

-  Projects/Programs  Expand or Collapse    -  Cybersecurity and Privacy Applications 
  -  Cybersecurity for the Internet of Things (IoT) 
  -  Cybersecurity Framework 
  -  National Cybersecurity Center of Excellence (NCCoE) 
  -  National Initiative for Cybersecurity Education (NICE) 
  -  Privacy Framework 
  -  Small Business Cybersecurity Corner 
-  How to Work With Us 
-  NIST Publications Searchable Database 
-  Staff Directory 
-  News & Updates 
-  Events 

# Frequently Asked Questions (FAQs) for NISTIRs 8259 and 8259A (Final)

## Share

Facebook

Linkedin

Twitter

Email

**1.    What is the purpose of NISTIRs 8259 and 8259A?**

While cybersecurity is a shared responsibility that likely will require an ecosystem approach, the impetus for NISTIRs 8259 and 8259A was to provide Internet of Things (IoT) device manufacturers with much-needed guidance and best practices for supporting their customers’ security goals. 

**2.    Why was NIST’s guidance separated into two separate publications?**

NISTIRs 8259 and 8259A represent a 2-pronged approach comprised of recommended activities and a core device capability baseline, respectively, that together provide a holistic, integrated roadmap to ensure IoT device cybersecurity. While each publication supplements and reinforces the other, NIST’s decision to release the guidance in two distinct publications was based largely on feedback from manufacturers to increase clarity and facilitate easy adoption. 

**3.    What is the core baseline?**

The core baseline provided in NISTIR 8259A is comprised of device capabilities generally needed to support common cybersecurity controls with the goal of protecting an organization’s devices, data, systems, and ecosystems. It provides a vital foundation upon which industry- and market-specific baselines can now be formulated.

**4.    What is a device cybersecurity capability?**

A device cybersecurity capability is a feature or function that a device provides through its hardware or software that customers (both organizations and individuals) need to secure the device as a key component of overall IT ecosystem security.

**5.    Are IoT device manufacturers required to implement the recommendations included in NISTIR 8259 or the core baseline in NISTIR 8259A?**

No. However, NISTIR 8259 and 8259A provide specific activities and a core baseline of device capabilities, respectively, representing the most comprehensive and widely accepted roadmap yet for manufacturers to help protect their customers from increasing—and increasingly sophisticated—cybersecurity threats.

**6.    Will NIST update its guidance in the future?**

NIST has well-established strategies and processes for reviewing and updating all of its guidance—including NISTIRs 8259 and 8259A—to help ensure long-term value and effectiveness.

**7.    How did NISTIRs 8259 and 8259A come about?**

*Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure* called for “resilience against botnets and other automated, distributed threats.” In the order, the President directed the Secretaries of Commerce and Homeland Security to “lead an open and transparent process to identify and promote action ... to improve the resilience of the internet and communications ecosystem and to encourage collaboration with the goal of dramatically reducing threats perpetrated by automated and distributed attacks (e.g., botnets).”

Recognizing the importance of IoT security to both organizations and individuals (across the nation and throughout the world), and in response to the order, the Departments of Commerce and Homeland Security published *A Report to the President on Enhancing the Resilience of the Internet and Communications Ecosystem Against Botnets and Other Automated, Distributed Threats* (a/k/a the “Botnet Report”). Later that year, we released an associated Botnet Roadmap.

Starting with Appendix A in the draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks, we began by looking at existing efforts, both domestic (e.g. Cloud Security Alliance, the Industrial Internet Consortia) and global (GSMA, ENISA, UK government’s DCMS) initiatives to identify *the areas of general convergence on key IoT device capabilities*. Encouraged to continue our work, NIST engaged a wide range of stakeholders and cultivated public-private partnerships to collaboratively develop the activities and capabilities that would come to comprise NISTIR 8259. The final publication incorporates more than 450 comments that NIST received during two public comment periods and a workshop that drew more than 500 participants (both virtual and in person).

The result is a robust, risk-based approach that is feasible and practical for industry—and which has begun to be widely adopted even before publication of the final document. 

**8.    What’s Next for the Core Baseline?**

NIST is adapting NISTIRs 8259 and 8259A to devise a federal government profile that will define the cybersecurity device capabilities—along with manufacturer support needs and agency non-technical capabilities—needed to enable federal agency adoption of more securable IoT devices. We are also contemplating the development of industry profiles, although no such plans have been finalized.

NIST also continues its active involvement and leadership role in the joint technical committee of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) to develop an international baseline of IoT device cybersecurity capabilities. 

Information technologyCybersecurityInternet of Things (IoT)

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov