What is NISTIR 8259A and what is its legal status?

NISTIR 8259A (May 2020) defines a core baseline of six device cybersecurity capabilities. It is a NIST Interagency or Internal Report, not a regulation, and it states that implementing all capabilities is not mandatory: each may be implemented in full, in part or not at all, depending on the risk context. Its federal weight comes from SP 800-213, which agencies use to set device requirements, and from section 7 of the IoT Cybersecurity Improvement Act of 2020.

What is the difference between NISTIR 8259A and NIST SP 800-213?

8259A lists what a device should be able to do (identification, configuration, data protection, logical access to interfaces, software update, cybersecurity state awareness). SP 800-213 (November 2021) is written for the organisation that integrates the device into an information system: it explains how to assess risk and identify device cybersecurity requirements, using the SP 800-213A catalogue and its federal profile as a starting point.

Is NISTIR 8259 still current?

No. NIST withdrew the original NISTIR 8259 (May 2020) on 20 April 2026 and replaced it with NIST IR 8259 Rev. 1, Foundational Cybersecurity Activities for IoT Product Manufacturers. Rev. 1 describes nine activities (six pre-market, three post-market) instead of six, and speaks of IoT products rather than devices. NISTIR 8259A and 8259B have not been revised and remain current.

Is 8259A required to sell an IoT product in the United States?

Not for the commercial market: no federal law requires 8259A for products sold to consumers or businesses. For federal agencies, section 7 of Public Law 116-207 prohibits procuring or using an IoT device when the agency CIO determines that its use prevents compliance with the NIST standards and guidelines (SP 800-213) or the vulnerability disclosure guidelines. The prohibition took effect on 4 December 2022 and can be waived for national security, research, or alternative and effective security methods.

How does the Cyber Trust Mark fit into this picture?

The FCC adopted the voluntary US Cyber Trust Mark framework in Report and Order FCC 24-26 (adopted 14 March 2024). It covers consumer wireless IoT products and builds on NIST IR 8425 (September 2022), the consumer profile of the 8259A and 8259B baselines. UL Solutions withdrew as Lead Administrator effective 19 December 2025, and the FCC selected ioXt Alliance as the new Lead Administrator on 13 April 2026.

Is NISTIR 8259B optional relative to 8259A?

8259B (August 2021) is the companion non-technical baseline, with four capabilities: Documentation, Information and Query Reception, Information Dissemination, Education and Awareness. It is written to be used together with 8259A, and SP 800-213A catalogues both kinds of capabilities. Like 8259A, it is a flexible starting point that the manufacturer adapts to its customers, not a pass or fail checklist.

How does SP 800-213A relate to SP 800-213?

SP 800-213A is the catalogue: seven technical families (the six 8259A capabilities plus Device Security) and four non-technical families (the 8259B capabilities), each split into capability groups, and cross-referenced to SP 800-53 controls. Its Appendix A defines the federal profile, calibrated on the SP 800-53 Rev. 5 low-impact baseline, which replaced the withdrawn draft NISTIR 8259D.

What common mistakes should be avoided with 8259A?

Treating it as a regulation or a mandatory checklist, quoting NISTIR 8259 (2020) after its withdrawal in April 2026, claiming that 8259A mandates FIPS 140-3 modules, secure elements or rollback (it names none of these as obligations), and describing the Cyber Trust Mark as a fully running label with UL Solutions as Lead Administrator.

NIST SP 800-213 and IR 8259A: US IoT security baseline

Hugues Orgitello updated 7 Oct 2026 16 min read

The US baseline for IoT cybersecurity is a family of NIST publications: NISTIR 8259A (device capabilities, May 2020), NISTIR 8259B (manufacturer support, August 2021), SP 800-213 and SP 800-213A (federal requirements and catalogue, November 2021), and since April 2026 NIST IR 8259 Rev. 1, which replaced the original 8259. The legal hook is the IoT Cybersecurity Improvement Act of 2020 (Public Law 116-207), which governs what federal agencies may buy, not what can be sold to everyone else. The consumer branch, NIST IR 8425 and the FCC Cyber Trust Mark, reuses the same capabilities. This guide reads each document and the Act section by section, gives the status of every document as of October 2026, and maps 8259A to ETSI EN 303 645 and the Cyber Resilience Act.

Status of the NIST IoT documents (October 2026)

Document	Published	Audience	Status on 7 October 2026
NISTIR 8259, Foundational Cybersecurity Activities for IoT Device Manufacturers	May 2020	Manufacturers	Withdrawn on 20 April 2026, superseded by IR 8259 Rev. 1
NIST IR 8259 Rev. 1, Foundational Cybersecurity Activities for IoT Product Manufacturers	April 2026 (drafts 13 May 2025 and 30 September 2025)	Manufacturers	Current
NISTIR 8259A, IoT Device Cybersecurity Capability Core Baseline	May 2020	Manufacturers, integrators, buyers	Current (not revised)
NISTIR 8259B, IoT Non-Technical Supporting Capability Core Baseline	August 2021	Manufacturers and supporting parties	Current (not revised)
Draft NISTIR 8259C, Creating a Profile Using the IoT Core Baseline and Non-Technical Baseline	Initial public draft, December 2020	Any organisation building a profile	Draft only, comments closed 26 February 2021
Draft NISTIR 8259D, federal profile	Initial public draft, December 2020	Federal government	Withdrawn on 29 November 2021, content moved to an appendix of SP 800-213A
NIST SP 800-213	November 2021	Organisations integrating IoT devices into systems	Current
NIST SP 800-213A	November 2021	Same	Current
NIST SP 800-216, federal vulnerability disclosure guidelines	May 2023	Federal agencies	Current
NIST IR 8425, consumer IoT profile	September 2022	Consumer IoT manufacturers	Current, technical basis of the Cyber Trust Mark
NIST IR 8425A, consumer-grade router profile	September 2024	Router manufacturers	Current

Two changes in the last eighteen months matter for anyone citing these texts. First, NIST IR 8259 Rev. 1 now describes nine foundational activities (Activity 0 to Activity 8: six pre-market, three post-market), where the 2020 edition described six (four pre-market, two post-market). It also moves from "IoT device" to "IoT product", meaning the device plus its companion apps, cloud back ends and other components. NIST presented the revision as part of the Act requirement to revisit its IoT guidelines every five years. Second, NISTIR 8259A and 8259B were not revised with it: the Rev. 1 page still lists them as its publication parts.

The IoT Cybersecurity Improvement Act, section by section

H.R. 1668 passed the House on 14 September 2020 and the Senate on 17 November 2020, and was approved on 4 December 2020 as Public Law 116-207. Its title is narrow: minimum security standards for IoT devices "owned or controlled by the Federal Government".

Section	What it says	What followed
2	Sense of Congress; IoT devices described with reference to the second draft of NISTIR 8259 (January 2020): at least one transducer, at least one network interface, not conventional IT such as smartphones and laptops	Same scope used in SP 800-213
4(a)	NIST to publish, within 90 days of enactment, standards and guidelines on the use and management of IoT devices by agencies, including minimum information security requirements	Drafts released in December 2020; SP 800-213 and SP 800-213A final in November 2021
4(b)	OMB to review agency policies within 180 days after NIST completes those standards, in consultation with CISA; national security systems excluded	OMB policy
4(c)	NIST to review and revise the standards at least every 5 years; OMB to update its policies within 180 days of a NIST revision	NIST cites this cycle for IR 8259 Rev. 1
4(d) and 6(d)	Federal Acquisition Regulation to be revised as necessary
5	NIST guidelines, within 180 days, on reporting and receiving vulnerability information, for agencies and for contractors and subcontractors at any tier, aligned "to the maximum extent practicable" with ISO/IEC 29147 and 30111	SP 800-216 (May 2023)
6	OMB, within 2 years, to set vulnerability disclosure policies for agency information systems
7(a)	Agency head prohibited from procuring, renewing or using an IoT device if the CIO determines that its use prevents compliance with the section 4 standards or section 5 guidelines; applies also below the simplified acquisition threshold
7(b)	Waiver by the agency head if the CIO determines it is needed for national security, for research, or the device is secured by alternative and effective methods	OMB to set a standardised waiver process
7(c)	GAO reports to Congress every 2 years during the 6 years after enactment
7(d)	Prohibition effective 2 years after enactment	4 December 2022
8	GAO briefing (1 year) and report (2 years) on IT, IoT and OT convergence

Two consequences follow. The Act does not apply to commercial sales, and it does not mention NISTIR 8259A by name: the binding link runs through the section 4 standards (SP 800-213) and the agency CIO determination. And vulnerability disclosure is a contractor obligation route of its own (section 5), which is why the 8259B capability on receiving vulnerability information matters as much as any device feature.

Executive Order 14028 of 12 May 2021 is a separate track. Its section 4(e) lists, among secure software development practices, providing a purchaser a Software Bill of Materials (SBOM) and participating in a vulnerability disclosure programme; sections 4(s) and 4(t) asked NIST to start consumer IoT labelling pilots and to identify IoT criteria for a consumer label, which produced NIST IR 8425.

NISTIR 8259A: the six device capabilities, element by element

8259A defines a "core baseline" as "a default for minimally securable devices". Two sentences of the text govern how it may be used: "the implementation of all capabilities is not considered mandatory", and the baseline "does not specify how the device cybersecurity capabilities are to be achieved". The table below lists the common elements the document gives for each capability, and the ETSI TS 103 645 V1.1.1 provisions it cites as related references.

Capability (8259A definition)	Common elements in 8259A	ETSI TS 103 645 references cited
Device Identification: the device can be uniquely identified logically and physically	1. unique logical identifier; 2. unique physical identifier accessible to authorised entities	none
Device Configuration: software configuration can be changed, by authorised entities only	1. change configuration settings; 2. restrict changes to authorised entities; 3. restore a secure configuration defined by an authorised entity	none
Data Protection: protect stored and transmitted data from unauthorised access and modification	1. demonstrably secure cryptographic modules for standardised algorithms; 2. render all data on the device inaccessible (wipe, key destruction); 3. configuration of the cryptography, such as key length	4.4-1, 4.5-1, 4.5-2, 4.11-1, 4.11-2, 4.11-3
Logical Access to Interfaces: restrict access to local and network interfaces to authorised entities	1. disable unnecessary local and network interfaces; 2. restrict access to each network interface (device or user authentication); 3. configurable lockout or delay after failed authentication attempts	4.1-1, 4.4-1, 4.6-1, 4.6-2
Software Update: update by authorised entities only, using a secure and configurable mechanism	1. remote and/or local update; 2. verify and authenticate before installing; 3. roll back to a previous version; 4. restrict updating to authorised entities; 5. enable or disable updating; 6. configure automatic or manual updates and update notifications	4.3-1, 4.3-2, 4.3-7
Cybersecurity State Awareness: report the cybersecurity state, accessible to authorised entities only	1. report the state; 2. distinguish expected operation from a degraded state; 3. restrict access to the state indicator; 4. prevent unauthorised editing of the state; 5. make state information available to another device, such as a log server	4.7-2, 4.10-1

Three points are often misquoted. The Data Protection capability asks for "demonstrably secure cryptographic modules" and does not name FIPS 140-3, SP 800-175B, a secure element or a trusted execution environment. Rollback is an element, but the rationale adds that other organisations "may prefer to eliminate the risk" of rolling back to a vulnerable version. And the hardware debug ports (UART, JTAG, SWD) are not named: the closest element is the ability to disable unnecessary local interfaces.

8259A also lists its reference sources: AgeLight, BITAG, CSA, CSDE, CTIA, ENISA, ETSI, GSMA, IEC 62443-4-2, IIC, IoTSF, ISOC/OTA, NEMA, OCF and PSA Certified.

NISTIR 8259B: the four non-technical capabilities

8259B describes "four recommended non-technical supporting capabilities" that manufacturers, or supporting parties such as a cloud provider or a contracted service provider, provide around the device.

Capability	What the text says it covers
Documentation	Information customers and others (including auditors and assessors) need before purchase and throughout the lifecycle; a pillar used by the other three
Information and Query Reception	After purchase, customers and others (researchers, product rating organisations) can submit questions and information, including vulnerability reports, and the manufacturer responds
Information Dissemination	Continued flow of information: disclosure of newly discovered vulnerabilities, and notifications about updates, algorithm changes, new protocols or vendor changes
Education and Awareness	Content that helps customers use the device and its cybersecurity capabilities securely

The old version of this page split vulnerability disclosure into a capability of its own and attributed ISO/IEC 29147, ISO/IEC 30111, SP 800-50 and SP 800-150 to 8259B. 8259B does not cite those: for vulnerability information it points to SP 800-216 (then in draft). ISO/IEC 29147 and 30111 come from section 5 of the Act.

SP 800-213: the integrator and buyer view

SP 800-213 is aimed at organisations that integrate IoT devices "into an existing information system as system elements". In scope are devices with at least one transducer and at least one network interface. The document is structured as follows.

Section	Content
2	Background: systems and elements, how IoT devices support security, how they may create security challenges
3.1	IoT device cybersecurity considerations (questions on the use case)
3.2	Assessing risk and determining required controls: effects on threat sources, vulnerabilities, likelihood, magnitude of impact, updated risk assessment
3.3	Identifying device cybersecurity requirements, using SP 800-213A (3.3.1) or other resources (3.3.2)
4	Risk management options: potential challenges meeting requirements (4.1), managing gaps (4.2)

The federal profile is the practical starting point. It is Appendix A of SP 800-213A, it uses the SP 800-53 Rev. 5 controls catalogue as its input, and it targets the low-impact control baseline, on the assumption that the low baseline is the minimum for every federal system. SP 800-213 warns that this may not suit a device integrated into a moderate or high-impact system, and states that organisations "shall identify all applicable IoT device cybersecurity requirements". When a device or its manufacturer cannot meet them, section 4 points to risk management options rather than an automatic rejection. A footnote adds that manufacturers may choose to build in the federal profile requirements, especially when federal agencies are expected customers.

SP 800-213A: the catalogue, family by family

Family	Type	Capability groups (as listed in SP 800-213A)
DI, Device Identification	Technical	3 (identifier management, actions based on identity, physical identifiers)
DC, Device Configuration	Technical	5
DP, Data Protection	Technical	4 (cryptography, key management, secure storage, secure transmission)
LA, Logical Access to Interfaces	Technical	9
SU, Software Update	Technical	2
CS, Cybersecurity State Awareness	Technical	9 (including logging, audit log storage, reliable time)
DS, Device Security	Technical	6 (secure execution, communication, resource usage, device integrity, network onboarding, operation)
DO, Documentation	Non-technical	5
IQ, Information and Query Reception	Non-technical	2 (vulnerability information, query response)
ID, Information Dissemination	Non-technical	2
EA, Education and Awareness	Non-technical	6 (including end of life, data back-up, vulnerability management options)

That is eleven families and 53 capability groups, each cross-referenced to SP 800-53 controls. Device Security is the one family that does not exist in 8259A. The catalogue offers one predefined profile, the federal profile; it does not contain sector profiles for medical, industrial or automotive devices.

NIST IR 8425 and the FCC Cyber Trust Mark

NIST IR 8425 (September 2022) is the consumer profile of the 8259A and 8259B baselines, developed in response to Executive Order 14028. Its outcomes apply to the whole IoT product, and several names change: Asset Identification, Product Configuration, Data Protection, Interface Access Control, Software Update, Cybersecurity State Awareness, then Documentation, Information and Query Reception, Information Dissemination and Product Education and Awareness. NIST IR 8425A (September 2024) adds a profile for consumer-grade routers.

Date	Cyber Trust Mark event	Source
14 March 2024	FCC adopts Report and Order FCC 24-26 (released 15 March 2024), PS Docket 23-239	FCC 24-26
10 September 2024	Filing window for Cybersecurity Label Administrators (CLA) and Lead Administrator	DA 24-900, cited in DA 26-18
4 December 2024	UL LLC (UL Solutions) selected as Lead Administrator	cited in DA 26-18
11 December 2024	11 CLAs conditionally approved	DA 24-1241, cited in DA 26-18
19 December 2025	UL Solutions withdrawal as Lead Administrator takes effect	DA 26-18
7 to 28 January 2026	New filing window for Lead Administrator applications	DA 26-18
13 April 2026	FCC selects ioXt Alliance as new Lead Administrator, to "finalize implementation of the program"	FCC news release
28 September 2026	A2LA and ANAB recognised to accredit CLAs (ISO/IEC 17065) and CyberLABs (ISO/IEC 17025)	DA 26-1029

The initial programme covers wireless consumer IoT devices (intentional radiators, under FCC section 302 authority) and excludes wired devices; following the NIST definition it also excludes general-purpose computers, smartphones and routers. For an industrial or federal product, 8259A, 8259B and SP 800-213 remain the reference; for a consumer product aiming at the label, the 8425 outcomes and the FCC standards are.

Mapping 8259A to ETSI EN 303 645

8259A cites ETSI TS 103 645 V1.1.1 (2019), the specification that became EN 303 645. Its thirteen guidelines (4.1 to 4.13) became provisions 5.1 to 5.13 in EN 303 645, with the same titles in the same order, and data protection received a clause 6 of its own. The mapping below follows the references that 8259A itself gives; individual provision numbers inside each clause changed between the TS and the EN, so check the current EN text before quoting a provision.

8259A capability	TS 103 645 clauses cited by 8259A	Corresponding EN 303 645 clause
Device Identification	none	none cited
Device Configuration	none	none cited
Data Protection	4.4 credentials and security-sensitive data, 4.5 communicate securely, 4.11 deletion of personal data	5.4, 5.5, 5.11
Logical Access to Interfaces	4.1 no universal default passwords, 4.4, 4.6 minimise exposed attack surfaces	5.1, 5.4, 5.6
Software Update	4.3 keep software updated	5.3
Cybersecurity State Awareness	4.7 software integrity, 4.10 system telemetry data	5.7, 5.10

TS 103 645 clause 4.2 (managing reports of vulnerabilities) is not cited by 8259A because it is a manufacturer activity: it corresponds to 8259B Information and Query Reception. No percentage of overlap is published by NIST or ETSI, and none should be quoted.

Relationship with the Cyber Resilience Act and the RED

Text	Geography	Scope	Status
NIST 8259A, 8259B, SP 800-213	United States	Federal acquisition and use; voluntary elsewhere	Section 7 prohibition in force since 4 December 2022
ETSI EN 303 645	International (ETSI)	Consumer IoT	Voluntary standard
RED Article 3(3)(d)(e)(f) delegated act	EU	Internet-connected radio equipment	Applies since 1 August 2025, EN 18031-1/-2/-3 cited with restrictions (Decision (EU) 2025/138)
Cyber Resilience Act	EU	Products with digital elements	Reporting obligations since 11 September 2026, full application 11 December 2027
NIST IR 8425 / Cyber Trust Mark	United States	Consumer wireless IoT	Voluntary, FCC programme being implemented by the new Lead Administrator

The CRA is a regulation with mandatory essential requirements and conformity assessment, which the NIST baselines are not. Work done against 8259A and 8259B is reusable, but it has to be mapped explicitly to the CRA essential requirements and, for radio products, to EN 18031.

Claims the texts contradict

Common claim (some made by earlier versions of this page)	What the text says
NISTIR 8259 (2020) is the current manufacturer guidance	Withdrawn on 20 April 2026, superseded by NIST IR 8259 Rev. 1 with nine activities
8259A was published after 8259, and 8259A, 8259B and SP 800-213 date from 2020	8259 and 8259A both May 2020; 8259B August 2021; SP 800-213 and 213A November 2021
NIST IR 8425 dates from March 2024	September 2022; March 2024 is the FCC Report and Order
8259A requires FIPS 140-3 modules, SP 800-175B suites and a hardware secure element	8259A asks for "demonstrably secure cryptographic modules for standardized cryptographic algorithms" and names none of these
A rollback path is mandatory	Rollback is a common element, and 8259A notes that some organisations prefer to eliminate it; no capability is mandatory
8259B has a "Query reception and vulnerability disclosure" capability citing ISO/IEC 29147 and 30111	The capability is "Information and Query Reception"; ISO/IEC 29147 and 30111 are named in section 5 of the Act, not in 8259B
SP 800-213A has fourteen families and predefined medical and industrial profiles	Eleven families (seven technical, four non-technical) and one federal profile in Appendix A
SP 800-213 relies on FIPS 199 categorisation in four steps with template contract clauses	It works through risk assessment (section 3.2), requirement identification (3.3) and gap management (4); it contains no contract clause templates
8259A maps to EN 303 645 at "more than eighty per cent"	No such figure exists in NIST or ETSI texts
NIST opened a revision of 8259A and 8259B in 2024	The revision that happened is IR 8259 Rev. 1 (drafts 2025, final April 2026); 8259A and 8259B are unchanged
The Act makes 8259A mandatory for US sales	The Act covers devices owned or controlled by federal agencies; it does not name 8259A
The Cyber Trust Mark is run by UL Solutions	UL Solutions withdrew effective 19 December 2025; ioXt Alliance was selected on 13 April 2026

For a manufacturer: a practical approach

1. Market and reference scoping. Separate federal customers (SP 800-213 and the federal profile in SP 800-213A), US consumer products aiming at the Cyber Trust Mark (NIST IR 8425), and EU markets (RED delegated act and EN 18031, then the CRA). A single requirements matrix with one column per text avoids duplicated assessment work.

2. Design against the capabilities. Build in the six 8259A capabilities: unique logical and physical identifiers, restorable secure configuration, cryptographic data protection and data wipe, interface restriction, authenticated updates, and a reportable security state. Mechanisms such as a hardware root of trust are design choices, not 8259A requirements, but they help argue several capabilities at once.

3. Non-technical support. Put in place documentation, a channel to receive questions and vulnerability reports, a way to disseminate vulnerability and update information, and user education material before market placement.

4. Evidence for buyers. Under SP 800-213 the buying organisation "shall determine which device cybersecurity requirements are provided by the IoT device" and documents any gap. NIST does not certify devices against 8259A, so the evidence is whatever the manufacturer supplies: documentation, test reports or a written attestation. Prepare a capability-by-capability response referencing the SP 800-213A identifiers.

What to watch

OMB policy updates. Section 4(c)(2) of the Act requires OMB to update its policies within 180 days of a revision of the NIST section 4 standards. SP 800-213 itself has not been revised since November 2021.
The Cyber Trust Mark restart. The FCC described the ioXt selection as a step to finalise implementation; the Lead Administrator is to recommend additional standards, testing procedures and label design. On 28 September 2026 the FCC recognised A2LA and ANAB to accredit CLAs and CyberLABs (DA 26-1029); no CLA is yet authorised to grant the label.
GAO reporting. Section 7(c) requires GAO reports every two years for six years after enactment, a period that ends in December 2026.

US state laws are a separate layer: California Civil Code section 1798.91.04 and Oregon ORS 646A.813 require reasonable security features for connected devices, independently of the NIST documents.

Frequently asked questions

What is NISTIR 8259A and what is its legal status?: NISTIR 8259A (May 2020) defines a core baseline of six device cybersecurity capabilities. It is a NIST Interagency or Internal Report, not a regulation, and it states that implementing all capabilities is not mandatory: each may be implemented in full, in part or not at all, depending on the risk context. Its federal weight comes from SP 800-213, which agencies use to set device requirements, and from section 7 of the IoT Cybersecurity Improvement Act of 2020.
What is the difference between NISTIR 8259A and NIST SP 800-213?: 8259A lists what a device should be able to do (identification, configuration, data protection, logical access to interfaces, software update, cybersecurity state awareness). SP 800-213 (November 2021) is written for the organisation that integrates the device into an information system: it explains how to assess risk and identify device cybersecurity requirements, using the SP 800-213A catalogue and its federal profile as a starting point.
Is NISTIR 8259 still current?: No. NIST withdrew the original NISTIR 8259 (May 2020) on 20 April 2026 and replaced it with NIST IR 8259 Rev. 1, Foundational Cybersecurity Activities for IoT Product Manufacturers. Rev. 1 describes nine activities (six pre-market, three post-market) instead of six, and speaks of IoT products rather than devices. NISTIR 8259A and 8259B have not been revised and remain current.
Is 8259A required to sell an IoT product in the United States?: Not for the commercial market: no federal law requires 8259A for products sold to consumers or businesses. For federal agencies, section 7 of Public Law 116-207 prohibits procuring or using an IoT device when the agency CIO determines that its use prevents compliance with the NIST standards and guidelines (SP 800-213) or the vulnerability disclosure guidelines. The prohibition took effect on 4 December 2022 and can be waived for national security, research, or alternative and effective security methods.
How does the Cyber Trust Mark fit into this picture?: The FCC adopted the voluntary US Cyber Trust Mark framework in Report and Order FCC 24-26 (adopted 14 March 2024). It covers consumer wireless IoT products and builds on NIST IR 8425 (September 2022), the consumer profile of the 8259A and 8259B baselines. UL Solutions withdrew as Lead Administrator effective 19 December 2025, and the FCC selected ioXt Alliance as the new Lead Administrator on 13 April 2026.
Is NISTIR 8259B optional relative to 8259A?: 8259B (August 2021) is the companion non-technical baseline, with four capabilities: Documentation, Information and Query Reception, Information Dissemination, Education and Awareness. It is written to be used together with 8259A, and SP 800-213A catalogues both kinds of capabilities. Like 8259A, it is a flexible starting point that the manufacturer adapts to its customers, not a pass or fail checklist.
How does SP 800-213A relate to SP 800-213?: SP 800-213A is the catalogue: seven technical families (the six 8259A capabilities plus Device Security) and four non-technical families (the 8259B capabilities), each split into capability groups, and cross-referenced to SP 800-53 controls. Its Appendix A defines the federal profile, calibrated on the SP 800-53 Rev. 5 low-impact baseline, which replaced the withdrawn draft NISTIR 8259D.
What common mistakes should be avoided with 8259A?: Treating it as a regulation or a mandatory checklist, quoting NISTIR 8259 (2020) after its withdrawal in April 2026, claiming that 8259A mandates FIPS 140-3 modules, secure elements or rollback (it names none of these as obligations), and describing the Cyber Trust Mark as a fully running label with UL Solutions as Lead Administrator.