Cybersecurity & Privacy

Assess connected-device identity, updates, permissions and data handling across installation, everyday use and retirement.

A connected product’s security depends on its whole lifecycle. Track the device, accounts, update path and data destinations rather than relying on a general “secure” claim.

Review security across the lifecycle

Before installation

Establish ownership, supported authentication and a recoverable configuration.

During operation

Track updates, unusual behaviour and the access each integration requires.

At retirement

Remove accounts, revoke credentials and verify the documented reset and deletion process.

Explore device trust, software and data responsibilities

Device trust and identity

Record how the product and its administrator are identified, how ownership is established and how credentials are protected or replaced. Check the exact supported functions and configuration; a secure-element or secure-boot label does not demonstrate the security of every account and integration.

Secure elements · Device certificates · Secure boot · Attestation · Provisioning security · Key management.

Network and fleet security

Maintain a device inventory and document the connections and remote access each system needs. Review separation and monitoring with the responsible network operator, including how changes are authorised and investigated. A discovery result is a starting point for ownership and maintenance, not proof of protection.

Segmentation · Zero trust access · IoT asset discovery · Anomaly detection · Remote access security · OT security monitoring.

Open the ot security monitoring guide →

Firmware and software assurance

Find the exact model’s support information, update procedure and vulnerability-reporting route. Review the authenticity of updates, expected interruption and documented recovery with its owner. Track the end of software support separately from hardware warranty and physical service life.

Signed updates · SBOM · Vulnerability management · Disclosure programs · Supply chain security · End-of-support tracking.

Open the firmware and software assurance guide →

Data privacy and consent

Map the information collected, where it is processed, who can access it and how long it remains. Review permissions, deletion and changes in occupants or staff. Use applicable local requirements and documented product behaviour; a factory reset or a privacy-policy link alone is insufficient evidence of complete data removal.

Local versus cloud processing · Data retention · Data deletion · Permission controls · Consent records · Privacy reviews.

Research and resilience

Define the assets, likely failure or misuse scenarios and recovery owner before choosing a test. Keep security testing authorised and bounded. Retain evidence of findings, corrective actions and retesting, and distinguish a documentation review, vulnerability assessment and formal certification.

Threat models · Security testing labs · Incident response · Backup recovery · Resilience engineering · Security standards explainers.

A practical example

For a proposed device register, record model, firmware, owner, network, cloud accounts, support information and the next review date. Start by finding devices with unclear ownership or update status; an inventory alone does not demonstrate that they are secure.

Questions to resolve

Which supported capability protects each identified risk?
Who receives vulnerability and support notices?
What data and access remain after factory reset or account deletion?

Use the evidence

The category map describes technologies and product types. It does not establish that a particular model is available, tested or compatible. Check the exact model, region, documentation and support arrangements before buying.

Work through the connected-technology buying checklist

Primary security references

NIST IR 8259A: core device cybersecurity baseline, May 2020 is a starting point for identifying device capabilities. ETSI EN 303 645 V3.1.3, September 2024 addresses consumer-IoT security, including update support and vulnerability reporting. These references guide questions; they do not certify a listed product or establish compliance with every local requirement.

Evidence: Category guide. Reviewed 2026-10-18. By Admin.