The National Institute of Standards and Technology (NIST) has released an initial public draft of SP 800-213 Revision 1, IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements, and opened it for public comment through August 24, 2026. The updated guidance refines how federal agencies should define and apply cybersecurity requirements when procuring Internet of Things (IoT) products, establishing a baseline framework that will shape both government acquisitions and broader industry expectations.
For organizations that sell to federal agencies or operate in regulated sectors, this revised guidance represents the operationalization of statutory and executive mandates that have been building since 2020. The requirements NIST is formalizing will determine which IoT products federal agencies can purchase, how vendors must demonstrate security capabilities, and what lifecycle support manufacturers must provide.




