IoT Cybersecurity Improvement Act: Covered Devices and SBOM Rules

The Internet of Things Cybersecurity Improvement Act of 2020 requires internet-connected devices bought by the federal government to meet minimum cybersecurity standards set by the National Institute of Standards and Technology. Signed into law on December 4, 2020 as Public Law 116-207, it does not regulate private industry directly.¹ It works through the government’s checkbook: if a device cannot meet the NIST baseline, federal agencies cannot buy or use it. For manufacturers, that turns a technical standard into a market access requirement.

What Counts as a Covered Device

The Act defines a covered IoT device using three criteria. It must have at least one transducer, meaning a sensor that reads the physical environment or an actuator that changes it. It must have at least one network interface. And it cannot be a conventional computing device such as a smartphone or laptop, where security frameworks already exist.¹

A device also has to be able to function on its own, not solely as a component embedded inside other equipment like a bare processor chip.¹ In practice this captures connected security cameras, building sensors, HVAC controls, smart lighting, and similar hardware deployed across federal facilities.

Which Agencies Must Comply

The Act uses the broad definition of “agency” in 44 U.S.C. § 3502, which sweeps in every executive department, military department, government corporation, and independent regulatory agency. A short list of entities is excluded, including the Government Accountability Office, the Federal Election Commission, the District of Columbia and U.S. territorial governments, and certain government-owned contractor-operated facilities.² For a vendor, that means the compliance obligation reaches almost every federal buyer of connected hardware.

The Security Capabilities Devices Must Have

NIST responded to the Act with SP 800-213, a framework agencies use to decide whether a device can safely join their information security programs.³ The companion document, NISTIR 8259A, is the one manufacturers need to read. It sets out six core cybersecurity capabilities every covered device should demonstrate:⁴

Device identification. Each device must be uniquely identifiable both logically on a network and physically through a label or embedded marker, so one device cannot impersonate another.
Device configuration. Authorized personnel must be able to change software settings and restore a secure baseline, and unauthorized users must be locked out of those controls.
Data protection. The device must use recognized cryptographic methods to protect data at rest and in transit, and authorized users must be able to render stored data permanently inaccessible when needed.
Logical access to interfaces. The device must restrict local and network interface access to authorized users and systems, and disable interfaces that are not in use.
Software update. The device must support secure, verifiable updates so patches for newly discovered flaws can be applied without introducing malicious code.
Cybersecurity state awareness. The device should be able to report on its own security status, including logs available to authorized entities.

These are the measuring stick against which every IoT device is evaluated before entering the federal supply chain. NIST is currently updating both NISTIR 8259 and SP 800-213, so the technical bar is likely to rise.

Vulnerability Disclosure Obligations

The Act also required NIST to publish guidelines for reporting, coordinating, and resolving security vulnerabilities in government-used IoT devices. NIST met that mandate with SP 800-216, which gives researchers a structured way to report bugs and gives agencies and contractors a playbook for fixing what gets reported.⁵

On the agency side, CISA’s Binding Operational Directive 20-01 requires every civilian federal agency to publish a vulnerability disclosure policy on its primary .gov site at a standardized URL path. Agencies had 180 days from the directive’s issuance to publish those policies and set up handling procedures. National security systems and certain Department of Defense and Intelligence Community systems are outside its scope.⁶

The practical consequence for vendors: agencies are expected to verify that suppliers maintain coordinated disclosure mechanisms before entering service agreements. A manufacturer with no process for receiving, triaging, and patching reported vulnerabilities is effectively disqualified from the federal market, even if the device meets every other technical standard.

Software Bill of Materials

A related supply-chain requirement flows from Executive Order 14028, which directs federal agencies to require their software suppliers to provide a Software Bill of Materials. An SBOM is a machine-readable ingredients list for software: every component, library, and dependency inside a product. For IoT devices running embedded software, this lets an agency quickly determine whether a known vulnerability in a third-party component affects devices already on its network.⁷

SBOMs must conform to one of three accepted industry formats: SPDX, CycloneDX, or SWID. Suppliers are expected to maintain digitally signed SBOM repositories and make them available to purchasers directly or through a public website.⁷ Manufacturers targeting federal contracts need to track and disclose every piece of open-source and commercial code running on their devices.

How the Ban on Non-Compliant Devices Works

The enforcement mechanism sits in a procurement restriction. An agency is prohibited from procuring, obtaining, or using an IoT device if the agency determines that doing so would prevent compliance with NIST’s published standards.⁸ The review happens during acquisition, and the agency’s Chief Information Officer makes the compliance call.

The law allows three waivers. An agency head can approve a non-compliant device if the CIO determines that:⁸

The waiver is necessary in the interest of national security.
Procuring or using the device is necessary for research purposes.
The device is secured using alternative methods that are effective and appropriate for its function.

These are not blanket exemptions. Each applies to a specific device in a specific situation, and the CIO must make an affirmative determination in each case. The third waiver is the most commonly used, because it lets agencies keep legacy IoT hardware in service when compensating controls such as network segmentation, enhanced monitoring, or restricted access adequately manage the risk.

What Happens to Contractors Who Misrepresent Compliance

The Act itself does not create civil or criminal penalties. Enforcement risk instead comes from the False Claims Act at 31 U.S.C. § 3729, which applies whenever a contractor submits a false statement to get paid by the government. A manufacturer that certifies its IoT device meets NIST standards when it does not has submitted a false claim. Liability can be severe: three times the government’s damages plus per-claim penalties that currently exceed $13,000 each after inflation adjustments.⁹

The Department of Justice has treated cybersecurity fraud as an active enforcement priority. Recent settlements have reached into the millions for contractors who falsely certified compliance with NIST-based requirements, including cases where no actual breach occurred. Failing to implement required controls while billing the government as though they were in place was enough to trigger liability.

Beyond money, federal acquisition regulations allow agencies to debar or suspend contractors who demonstrate a lack of integrity, which includes misrepresenting product capabilities. Debarment shuts a company out of all federal contracting for a period that typically runs up to three years.

Extra Rules for Defense Contractors

Selling connected devices to the Department of Defense adds another layer through the Cybersecurity Maturity Model Certification program. CMMC Phase 1 implementation began in November 2025 and runs through November 2026, initially focused on Level 1 and Level 2 self-assessments.¹⁰ For an IoT manufacturer, CMMC stacks on top of the IoT Cybersecurity Improvement Act. A vendor selling connected sensors to the Army, for example, needs the devices to meet NISTIR 8259A capabilities and the organization to hold the appropriate CMMC level.

Level 1 requires an annual self-assessment and an affirmation of compliance by a senior official. Level 2 requires a certified third-party assessment every three years plus annual affirmations. Level 3 involves government-led assessments every three years. Non-compliance carries the same enforcement pattern as the rest of federal contracting: lost eligibility and potential False Claims Act exposure for misrepresented certifications.

A Note on Consumer Devices

The IoT Cybersecurity Improvement Act does not reach consumer products. A separate FCC program, the U.S. Cyber Trust Mark, offers a voluntary cybersecurity label for wireless consumer IoT devices, based largely on NIST criteria.¹¹ If your question is about a smart doorbell or thermostat sold at retail, that program is the relevant framework, not this Act.

1
Congress.gov. Public Law 116-207 – IoT Cybersecurity Improvement Act of 2020
2
Office of the Law Revision Counsel. 44 USC 3502 Definitions
3
Computer Security Resource Center. NIST SP 800-213 – IoT Device Cybersecurity Guidance for the Federal Government Establishing IoT Device Cybersecurity Requirements
4
National Institute of Standards and Technology. NISTIR 8259A – IoT Device Cybersecurity Capability Core Baseline
5
National Institute of Standards and Technology. NIST SP 800-216 – Recommendations for Federal Vulnerability Disclosure Guidelines
6
Cybersecurity and Infrastructure Security Agency. BOD 20-01 Develop and Publish a Vulnerability Disclosure Policy
7
National Institute of Standards and Technology. Software Security in Supply Chains Software Bill of Materials (SBOM)
8
U.S. Government Publishing Office. Internet of Things Cybersecurity Improvement Act of 2020
9
Office of the Law Revision Counsel. 31 USC 3729 False Claims
10
Department of Defense Chief Information Officer. Cybersecurity Maturity Model Certification
11
Federal Communications Commission. U.S. Cyber Trust Mark