NIST seeks comments on IoT device cybersecurity catalog revision until 15 October 2026

What happened

• The National Institute of Standards and Technology (NIST) has opened a public comment period for a draft revision of NIST SP 800‑213A, the IoT Device Cybersecurity Requirement Catalog.
• The revision will incorporate lessons from the draft IoT Product Cybersecurity Guidelines (SP 800‑213 Rev. 1) and align with NIST CSF 2.0 and SP 800‑53 Rev. 5.2.0.
• Comments are accepted until 15 October 2026, after which NIST will produce an initial revision for federal agencies and their contractors.
• No penalties or deadlines beyond the comment window are imposed.

Why it matters

Stakeholders developing or procuring IoT solutions for federal contracts should monitor the upcoming SP 800‑213A update and prepare to map existing controls to the revised requirements.

Business impact

Organizations may need to revise internal IoT security policies and procurement checklists to reflect the forthcoming guidance, affecting design, testing, and documentation processes.

What to check

1. 1

   Review current IoT security controlsMedium priority

   Compare existing device controls with the draft SP 800‑213A topics and note gaps before the final guidance is issued.