Why Regulation

Value is therefore dependent on accurate, “clean” data, making it imperative to safeguard these devices and systems so actions are not unduly influenced by compromised data.

This is precisely why the federal government has enacted the IoT Cybersecurity legislation. The stakes have become too high to do nothing.

Why Now?

Prior to the federal government taking action, California and Oregon crafted their own IoT security legislation, and several states such as Illinois, Kentucky and Massachusetts are in various stages of creating their own rules.

While this is encouraging because it means the issue is now being taken seriously, this “every state for themselves” approach causes confusion and a lack of consistency for device manufacturers.

With each state having separate task forces, and each looking at IoT cybersecurity from their own perspective, there is a lack of a cohesive security policy. This means requirements will differ from state to state, making compliance with varying sets of rules difficult for device manufacturers.

Now that the federal government has stepped in and passed the IoT Cybersecurity Improvement Act, providing corresponding documentation and reporting requirements, device manufacturers have the guidance they need to be in alignment with government procurement policies.

The hope is that these standards will be universally applied so IoT device manufacturers willingly comply with regulations that make IoT ecosystems extremely secure.