What it covers. NIST guidance that helps organisations define cybersecurity requirements for IoT devices they plan to buy or deploy. It explains how to consider IoT devices in risk management and links to a catalogue of device capabilities and supporting non-technical expectations of manufacturers.
In practice. Applying it well means identifying how a device will be used and what risks it introduces, then specifying requirements such as identification, secure configuration, software update capability, data protection and logging, plus manufacturer support like vulnerability disclosure. Requirements are included in procurement. Evidence includes device risk assessments, procurement specifications and an inventory of deployed IoT devices.
Common gaps. Common gaps are IoT devices bought outside IT governance, no inventory and devices that cannot be updated.