Guidelines for Securing the Internet of Things: Reference guide on Internet of Things supply chain security

The proliferation of IoT devices raises specific security challenges arising from the complexity of their supply chain, which involves multiple manufacturers, integrators, suppliers, and end users. ENISA commissioned this guide to help all of these players make better security decisions when building, deploying, or evaluating IoT technologies.

The objectives of the project were:

• To analyze the different phases of the IoT supply chain and the security risks associated with each one.
• To propose security best practices applicable throughout the entire life cycle of IoT products and services.
• To serve as a complementary reference to ENISA's previous studies on IoT security.

The guide was built around the following pillars:

• Supply chain reference model: analysis of the phases of the IoT life cycle, from conception to retirement.
• Threat analysis: identification of specific risks at each phase of the supply chain.
• Security recommendations: best practices focused on secure-by-default design, strengthening relationships among players in the chain, and making use of existing standards.

CTIC developed the guide for ENISA under its accreditation contract as a cybersecurity service provider for the agency.