Key Facts
- Regulator
- IoT Security Foundation (IoTSF), a non-profit organisation that publishes IoT security best practice guidance
- Latest version
- IoT Security Assurance Framework, Release 4.0 (4.0.0). Formerly the IoTSF IoT Security Compliance Framework (renamed after Release 2.1).
- Official text
- www.iotsecurityfoundation.org ↗
What is IoTSF?
IoTSF is the IoT Security Foundation, a non-profit that publishes IoT security best practice guidance. Its IoT Security Assurance Framework gives firms that make or supply IoT products and services a graded set of security requirements to check against and gather evidence for. It is voluntary guidance, not law.
The current version is the IoT Security Assurance Framework, Release 4.0 (4.0.0). Until Release 2.1 it was published as the IoT Security Compliance Framework. IoTSF publishes it alongside its other best practice guidelines.
Why it matters
A buyer asks how you know your connected product is secure enough to sell. "We follow best practice" is not an answer they can file.
The IoTSF framework turns that claim into a set of requirements and a record of evidence against each one. The evidence can then be used to declare conformance with best practice.
Best practice you can't evidence is an opinion.
It also gives buyers a common yardstick. Procurement teams can use parts of the framework to set the security they expect from their suppliers.
Who it applies to
The framework is aimed at firms that provide IoT products, technology or services: their managers and engineers, the supply chain managers who audit them, and third-party auditors. Its scope covers business processes, IoT devices, gateways and hubs, and networks including cloud and server elements. That puts device makers, platform and cloud providers, and the firms that buy from them in range.
Obligation: voluntary. The IoTSF framework is not a statutory or regulatory requirement. Firms use it to self-assess or self-certify, or have a third-party auditor assess them against it. It becomes contractual when a customer writes it into supplier requirements.
It does not replace ISO 27001: one of its own requirements is that the company follows industry-standard recommendations such as UK Cyber Essentials, the NIST Cybersecurity Framework or ISO 27000. Treat ISO 27001 as the organisation-level layer and the IoTSF framework as the product-level layer on top.
The UK position
The framework is voluntary in the UK. A UK firm meets it mainly through the regimes below, which it sits close to:
| Regime | Who it affects | Link to the IoTSF framework |
|---|---|---|
| PSTI Act 2022 (consumer connectable product security) | UK makers and sellers of consumer connectable products | IoTSF lists the Act among its UK IoT security resources and says the framework gave input to some national IoT rules. Class 1 requirements can serve as evidence of good practice. |
| UK GDPR and Data Protection Act 2018 | IoT products that process personal data | Requirement 2.4.12.8 asks that the product can be made compliant with personal-information law where it is sold. The framework's references point to ICO UK GDPR guidance. |
| Code of Practice for Consumer IoT Security (DCMS with NCSC, 2018) | Consumer IoT products | IoTSF says requirements in ETSI, DCMS and NCSC codes of practice demand Class 1 at a minimum. |
IoTSF says Class 1 requirements cover most current government guidance and law on consumer or commercial products. Class 1 is therefore the practical floor for a UK consumer product. The likeliest first encounter is a buyer asking for evidence against the framework.
Key requirements
The framework is a set of security requirements, graded by assurance class and applied after a risk assessment:
- Risk assessment first. A documented risk assessment must come before the framework is used. It sets the assurance class for the product or service.
- Assurance classes 0 to 4. Requirements are graded into classes drawn from the confidentiality, integrity and availability (CIA) triad.
- Mandatory or advisory by class. Each requirement is mandatory or advisory depending on the class, so a higher class carries a heavier evidence load.
- Scope across the product. Requirements cover business processes, device hardware, software and interfaces, encryption, web and mobile apps, and cloud and network elements. A privacy section (2.4.12) sits alongside them.
- Evidence and declaration. The firm records a response and evidence for each requirement, explains any it marks "not applicable", and can use the result to declare conformance with best practice.
A class chosen before the risk assessment is a guess.
The framework also draws on ISO/IEC vulnerability standards. Requirement 2.4.3.17 expects the Security Policy to comply with ISO/IEC 30111 at Class 3 and above, and requirement 2.4.3.9 cites ISO/IEC 29147.
What changed in Release 4.0
Release 4.0 added a Development Infrastructure section on the security of the development environment. The supply chain appendix content moved to a separate IoTSF white paper. The framework itself is the document to cite.
Frequently asked questions
The IoTSF Security Compliance Framework is the former name of the IoT Security Assurance Framework. IoTSF renamed it after Release 2.1. Release 4.0 is fully backward compatible, with the same sections and requirement numbering, so references to the old name in questionnaires or contracts usually point to the same requirements.
Not by IoTSF. The IoTSF IoT Security Assurance Framework says IoTSF does not certify, endorse or affirm anyone who uses it, and does not verify their declarations. A firm can self-certify or ask a third-party auditor to assess it. IoTSF members also get the companion Assurance Questionnaire, a tool for collecting the evidence.
The IoTSF framework grades its requirements into assurance classes 0 to 4. Class 0 covers products whose compromise would have little impact; Class 4 covers products whose compromise could affect critical infrastructure or cause injury. Each class sets target levels of confidentiality, integrity and availability: Class 3, for example, sets high confidentiality to protect personal data.
No, and neither replaces the IoTSF framework. An ISO 27001 certificate or Cyber Essentials badge is evidence towards its business-process requirements. ISO 27001 and Cyber Essentials address the organisation's own security, while the IoTSF framework goes into the product: device hardware and software, interfaces, encryption and key management, and a minimum support period for security updates.
IoTSF does not claim that. The IoTSF framework itself says a mapping of government regulations to its requirements is still being developed. Class 1 evidence is a sound base for a UK maker of consumer connectable products, but the PSTI Act and its regulations set the legal duties, and compliance is judged against them.