On August 31, 2026, the National Institute of Standards and Technology (NIST) opened a pre-draft call for comments to support revision of NIST SP 800-213A, the IoT Device Cybersecurity Requirement Catalog used with SP 800-213 to help federal organizations establish cybersecurity requirements for IoT acquisitions and risk management. NIST is considering how to align SP 800-213A with draft SP 800-213 Rev.

1, including whether the catalog should expand from IoT devices to complete IoT products or provide additional guidance for non-device components such as mobile applications and back-end services. NIST also seeks input on novel use cases, tailored deployments assembled from commercial off-the-shelf components, additional technical sources and document usability.

The revision is expected to align with CSF 2.0, SP 800-53 Rev. 5.2.0, current IoT standards and the evolving threat landscape.

Comments are due October 15, 2026. This pre-draft request does not establish binding requirements.

Impact

Impact assessment: Medium.

Key reasons: the initiative may broaden future federal IoT cybersecurity guidance from individual devices to complete products and connected components, influencing procurement specifications, risk assessments and supplier evidence.

Who is affected?

Federal agencies, IoT manufacturers, software and cloud providers, systems integrators and federal suppliers.

Conclusion:

no immediate mandatory change applies, but stakeholders should evaluate the consultation questions and consider submitting comments by October 15, 2026.