United StatesInternet of Things Cybersecurity Improvement Act of 2020: agency procurement and use of Internet of Things devices
IoT Cybersecurity Improvement Act of 2020, 15 U.S.C. 278g-3b to 278g-3e
In force since .
A product security requirements rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Prohibition, Security
What it requires
- This Act binds federal agencies, the Office of Management and Budget and the National Institute of Standards and Technology, not a manufacturer. It reaches your organization only if you sell, or want to sell, an Internet of Things device to a federal agency, through the agency's decision whether it may procure, renew or use the device.
- The head of an agency is prohibited from procuring or obtaining, renewing a contract to procure or obtain, or using an Internet of Things device if the agency's Chief Information Officer determines that its use prevents compliance with the standards and guidelines developed under 15 U.S.C. 278g-3b or the guidelines published under 15 U.S.C. 278g-3c.
- The head of an agency may waive that prohibition if the Chief Information Officer determines that the waiver is necessary in the interest of national security, that procuring, obtaining or using the device is necessary for research purposes, or that the device is secured using alternative and effective methods appropriate to its function.
- The Director of the National Institute of Standards and Technology must publish standards and guidelines for agencies on the use and management of Internet of Things devices, including minimum information security requirements, and guidelines for a contractor providing an information system to an agency, and any subcontractor, on receiving information about a potential security vulnerability and disseminating information about its resolution.
These lines are LexLint's reading of the law's text.
What this law does
The Internet of Things Cybersecurity Improvement Act of 2020 prohibits the head of an agency from procuring or obtaining, renewing a contract to procure or obtain, or using an Internet of Things device if the agency's Chief Information Officer determines that its use prevents compliance with the standards and guidelines developed under section 278g-3b or the guidelines published under section 278g-3c. The prohibition takes effect 2 years after .
The prohibition also applies to a contract or subcontract in amounts not greater than the simplified acquisition threshold. The head of an agency may waive the prohibition if the Chief Information Officer determines that the waiver is necessary in the interest of national security, that procuring, obtaining or using the device is necessary for research purposes, or that the device is secured using alternative and effective methods appropriate to its function.
The Director of the National Institute of Standards and Technology must develop and publish standards and guidelines for the Federal Government on the appropriate use and management by agencies of Internet of Things devices owned or controlled by an agency and connected to its information systems, including minimum information security requirements for managing cybersecurity risks associated with such devices.
The Director of the National Institute of Standards and Technology must also publish guidelines for a contractor providing an information system, including an Internet of Things device, to an agency, and for any subcontractor, on receiving information about a potential security vulnerability and disseminating information about its resolution.
When LexLint raises it
When your app profile says your app distributes a software product.
Back to the example · Lint your app
Page updated .