NIST IR 8259 Rev. 1: baseline security activities for device makers

NIST IR 8259, the foundational cybersecurity activities for IoT device manufacturers, was withdrawn on 20 April 2026 and superseded by IR 8259 Rev. 1, which covers IoT product manufacturers. If you cite the 2020 version in a security plan or customer document, update the reference. The NIST page does not list the activities, so read the publication itself.

What the publications are

The original IR 8259 was published in May 2020 by Michael Fagan, Katerina Megas, Karen Scarfone and Matthew Smith. Its abstract describes recommended cybersecurity activities that manufacturers should consider before selling IoT devices. The goal is to make devices more securable, both by building in needed security functionality and by giving customers the security information they need.

Revision 1 was published in April 2026, dated 20 April 2026, and supersedes the 2020 version. NIST lists two earlier drafts, dated 13 May 2025 and 30 September 2025. The publication is split into IR 8259A and IR 8259B, and related publications include SP 800-213, SP 800-213A and IR 8228.

Why it applies beyond classic IoT

A connected robot, a drone, a charger and a telematics unit are all products with network connections and software. The reasoning behind the report fits them: customers often lack the capability to manage security risks, so manufacturers help by making products securable and by sharing information.

The stated benefit is lower customer effort and a lower frequency and impact of compromise, including attacks launched from compromised devices.

How to use it in practice

Treat the publication as a manufacturer checklist, then record how each activity is met. A sensible way to proceed:

1. Download the current revision and its companion parts, and note the date you used.
2. Replace any reference to the 2020 version in your policies, questionnaires and sales material.
3. For each activity, write a one-line statement of what your product does and where the evidence lives.
4. Identify the gaps and assign owners.
5. Review the record at each major release, not only once.

Information customers need

One theme of the report is giving customers the information they need to secure the product. In practice that can include what network access the device requires, how it receives updates, how long it will be supported and how to report a vulnerability. Many of these answers are easy to write down and hard to retrofit, so decide them during design.

Keeping references fresh

Standards move. A withdrawn document that still appears in a questionnaire answer suggests the answer was copied. A quick audit of your documents for old references is a cheap way to avoid that impression.

Safeguard can help with the software inventory behind these answers: SBOM and dependency scanning for the code your team builds, plus compliance and evidence automation for tracking what you have documented. It does not make a product compliant by itself.

Quick check

Sources

• NIST IR 8259 (withdrawn)
• NIST IR 8259 Rev. 1

Last reviewed: 19 October 2026.