NIST IR 8425, Profile of the IoT Core Baseline for Consumer IoT Products, lists the cybersecurity capabilities commonly needed for IoT products used at home. It was published in September 2022, written as outcomes that apply to the whole product, and is a reference for selection and labeling, not a full security standard.
What it is
NIST's publication page says the document is the consumer profile of NIST's IoT core baseline. It identifies capabilities for consumer IoT products, meaning those for home or personal use. The page adds that it can also be a starting point for small businesses buying IoT products.
The final version is dated 20 September 2022, following a draft released on 17 June 2022. The authors are Michael Fagan, Katerina Megas, Paul Watrobski, Jeffrey Marron and Barbara Cuthill of NIST.
Where it came from
NIST developed the profile in response to Executive Order 14028. It first appeared in NIST's recommended criteria for cybersecurity labeling of consumer IoT products. NIST reviewed a range of source documents and worked with stakeholders for roughly a year.
Outcomes, not a checklist of technologies
The capabilities are written as cybersecurity outcomes that apply to the entire product. That wording lets a maker choose how to reach the outcome. For example, an outcome about updates does not say which update protocol to use.
I have not reproduced the individual outcomes here because I did not review the full text. Read the PDF on NIST's site for the list before you map your product to it.
How a maker can use it
- Download the profile and list its outcomes in a spreadsheet.
- For each outcome, write how your product meets it, or why it does not apply.
- Mark gaps and assign owners. Typical gaps involve update support and vulnerability handling.
- Record the evidence, such as design notes and test results.
- Revisit it when you change the product.
The same exercise works against the ETSI baseline, and the two overlap in places. Doing one makes the second easier.
How a buyer can use it
A buyer can use the document's themes as a question list when they compare products. Ask whether the product updates, how it handles passwords, and how issues are reported. You do not need the document to start; the NCSC advice in other posts covers the first steps.
Where Safeguard fits
If your product firmware includes open source components, knowing what is inside supports several outcomes. Safeguard offers SBOM and dependency scanning, and you can try a free scan at gold.safeguard.sh/scan.
Quick check
Is NIST IR 8425 a regulation?
No. The NIST page describes it as a profile of baseline outcomes. Other programs may refer to it.
Does it apply to business devices?
It is aimed at consumer products. NIST says it can also serve as a starting point for small businesses buying IoT products.
Sources
Last reviewed: 19 October 2026.
