New Federal Law Requires Security Standards For Internet Of Things (IoT) Devices

On December 4, 2020, less than 10 days before one of the most severe cyberattacks in US history was publicly reported, President Trump signed into law the Internet of Things (IoT) Cybersecurity Improvement Act of 2020 (the Act). Sponsored by Representatives Will Hurd (R-Texas) and Robin Kelly (D-Illinois), the Act is designed to protect the security and integrity of IoT devices owned or controlled by the federal government, which uses these devices for critical purposes such as controlling electricity and HVAC systems, monitoring water quality for harmful substances, administering access to buildings and devices, and providing surveillance.

The Act requires the National Institute of Standards and Technology (NIST) to publish, by March 4, 2021, security standards and guidelines on federal government agency use and management of IoT devices owned or controlled by such agencies. And by August 31, 2021, the Office of Management and Budget (OMB) must review each federal