Loading story…
NIST released the initial public draft of SP 800-213 Revision 1, titled IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements, updating how agencies and other organizations define cybersecurity requirements for IoT products and incorporate them into system risk management. The revision replaces narrower references to "devices" with "products," adds clearer language and more relevant content, and stresses that integrating an IoT product into an information system can alter the system’s risk profile and require additional or different security controls.
The draft is part of a broader NIST effort to modernize practical IoT security guidance through its Cybersecurity for the Internet of Things Program. NIST said feedback from the Cybersecurity for IoT Workshop: Future Directions, captured in NIST IR 8618, will help shape updates to SP 800-213 and future guidance, including possible next steps for SP 800-213A and a longer-term framework aimed at helping risk managers and CISOs make contextual, operational IoT security decisions. The public comment period for the draft remains open through August 24, 2026.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
NIST published an update on its Cybersecurity for the Internet of Things Program describing the SP 800-213 Revision 1 draft, planned consideration of next steps for SP 800-213A, forthcoming IR 8618 proceedings, and development of a future framework for contextual IoT security decision-making. The update also invited stakeholder feedback through NIST's IoT security program outreach.
NIST participated in Unify 2026 through a June 17 panel titled "Security by Design Across Alliance Standards." The panel focused on embedding security principles across standards and on harmonized security frameworks to support interoperability and reduce certification complexity.
NIST published a notice stating that NIST IR 8618 summarizes presentations and feedback from the March 31 to April 1 workshop and that the output is intended to inform updates to SP 800-213 and future IoT cybersecurity guidelines. The notice also said NIST planned to release the initial public draft of SP 800-213 Revision 1 on June 24.
NIST's Cybersecurity for IoT Workshop: Future Directions continued through April 1, concluding discussions on stakeholder needs, accessibility of IoT security guidance, and future directions for NIST guidance. The proceedings were later slated for publication as NIST IR 8618.
NIST held the hybrid "Cybersecurity for IoT Workshop: Future Directions" to examine emerging and future IoT technology trends and their impact on IoT cybersecurity. The workshop gathered feedback intended to inform updates to SP 800-213 and future IoT cybersecurity guidelines.
NIST's Cybersecurity for IoT Program released the initial public draft of Special Publication 800-213r1, "IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements." The draft updates guidance for establishing cybersecurity requirements for IoT products and accounting for them in system risk management.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
nist.gov
Open sourcecsrc.nist.gov
Open sourcecsrc.nist.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NIST released an initial public draft of **Special Publication 800-82 Revision 4**, *Guide to Operational Technology Security*. Reorganized around the NIST Cybersecurity Framework 2.0, the draft addresses OT environments including industrial control systems, building automation, transportation, and physical access control. It expands guidance on aligning OT and enterprise risk management, the Risk Management Framework, asset management, network monitoring, detection, security controls, security architecture, and zero-trust practices while accounting for operational performance, reliability, and safety requirements. Separately, CISA and the FBI warned critical-infrastructure operators that third-party ICS integrators can create significant exposure because of their broad access to industrial processes and customer environments. The agencies cited a March–April 2025 intrusion at a U.S. industrial-automation solutions company, where foreign malicious actors accessed its network and staged sensitive SCADA and customer data that could enable downstream disruptive attacks. NIST is accepting public comments on the draft through November 30, 2026.
Sep 24, 2026
U.S. **operational technology (OT)** security specialists urged **NIST** to make its forthcoming update to *Special Publication 800-82* significantly more practical and granular, arguing that OT owners and operators need actionable guidance rather than high-level frameworks. The feedback was provided as NIST begins its **fourth revision** of SP 800-82 and solicits private-sector input, reflecting growing maturity and urgency in OT cybersecurity governance. Vendors and practitioners emphasized that OT environments require different approaches than conventional IT, particularly for **vulnerability management**, where standard IT practices may be ineffective or counterproductive in industrial settings. Commenters also called for more **sector-specific guidance** for emerging OT verticals such as **smart building management** and **distributed energy systems** (including **EV charging networks**), and broadly supported NIST’s proposal to move several SP 800-82 appendices online—covering OT security organizations, tools and threats, and catalogs of vulnerabilities and incidents—to keep reference material more current.
Jun 29, 2026
The National Institute of Standards and Technology (**NIST**) published a draft *Transit Cybersecurity Framework Community Profile* intended to improve cybersecurity practices in transportation systems that require continuous operations and connectivity. The voluntary draft, developed by NIST’s National Cybersecurity Center of Excellence (**NCCoE**), is open for public comment through **February 23, 2026**, and positions transportation as a critical-infrastructure area needing more tailored cybersecurity guidance. Separately, **CISA** and the UK’s **NCSC** released joint guidance titled *Secure Connectivity Principles* for **Operational Technology (OT)** environments, aimed at helping asset owners balance business-driven connectivity (remote access, data integration, cloud connectivity) with security risk. The guidance outlines eight high-level principles (e.g., limiting exposure, centralizing and standardizing access, using secure protocols, hardening boundaries) intended to be broadly applicable across critical-infrastructure sectors. An additional Help Net Security interview with Fermilab’s CISO discusses general cybersecurity challenges in open scientific research environments, but it does not materially relate to the NIST transit framework draft or the CISA/NCSC OT connectivity guidance.
Jun 29, 2026