NIST Wastes No Time In Implementing The IoT Cybersecurity Act Of 2020

Last week, we told you that President Trump signed bipartisan legislation establishing minimum security requirements for Internet of Things ("IoT") devices used by the federal government. The Act is the first of its kind at the federal level, aimed at protecting the security of IoT devices and services in the marketplace. The Act governs federal purchases of IoT devices and services but is intended to leverage the purchasing power of the federal government to affect the broader IoT market indirectly. Thus, without (yet) setting standards for all IoT devices and services, the legislation nevertheless is significant whether or not a company sells its product to the government.

The core of the legislation is a requirement that the National Institute of Standards and Technology ("NIST") issue standards for the "appropriate use and management" of IoT devices owned or controlled by federal agencies. These standards are then to be incorporated by the Office of Management