VoltVerify™ User Guide

IoT Manufacturer Activities and Supporting Capabilities

The final April 2026 NIST IR 8259 Rev. 1 covers nine manufacturer activities numbered 0–8: six primarily premarket and three postmarket. It revises IR 8259, not the six-capability IR 8259A baseline. The new 27-question assessment keeps manufacturer activity readiness separate from device technical readiness.

NIST IR 8259B (August 2021) covers four non-technical supporting capabilities: Documentation, Information and Query Reception, Information Dissemination, and Education and Awareness. Its 24-question assessment includes optional industrial/OT context. These are original readiness prompts, not mandatory NIST requirements.

Define the same product consistently across assessments, including device and firmware, cloud services, applications, gateways, dependencies, supporting entities, lifecycle stage, support owner, support period, and expected deployment. For premarket products, identify planned versions and assumed environments. A site can represent product engineering or support. Distinguish a documented plan from demonstrated execution in notes, evidence, and confidence.

Use the same answer states, N/A justification, autosave, evidence links, draft findings, approval workflow, retest, and signed reports as the device assessment. Unknown / Not Tested means unverified, not confirmed absence. N/A is excluded from scoring. Each assessment retains its own template version, answers, scope, and score; no results are copied automatically.

In Crosswalks, an authorized manager can add the manufacturer pathway draft, review the proposed 8259A-to-Rev. 1 and 8259B-to-IEC topic comparisons, and publish a version. Published comparisons retain their informational warning. They do not change the original assessment responses or scores.

Informational / requires qualified validation. Proposed topic comparisons to IEC 62443-4-1:2018 do not establish clause coverage, equivalence, a security level, or certification. IEC 62443-4-2 concerns technical component requirements and needs separate evaluation. IEC 62443-2-4 applies to service providers when that role is in scope. Validate the applicable edition, licensed requirements, product boundary, and organizational role with qualified industrial/OT specialists. Crosswalks never change assessment answers or scores.

NIST IR 8259A IoT Device Cybersecurity Assessments

Evaluate foundational technical capabilities for a specific connected device. The May 2020 baseline covers Device Identification, Device Configuration, Data Protection, Logical Access to Interfaces, Software Update, Cybersecurity State Awareness. The 39 prompts are original readiness interpretations, not 39 mandatory NIST requirements. No later Device Security catalog category is included.

Start from the NIST IR 8259A program page, select a site and published template, and record manufacturer, product/model, firmware, hardware, deployment, network zone, owner/operator, connectivity, interfaces, operational impact, and scope notes. This works for chargers, inverters, storage systems, sensors, gateways, and controllers without prescribing a protocol.

Choose Implemented, Partially Implemented, Not Implemented, Not Applicable, or Unknown / Not Tested. Unknown means the capability has not been verified; Not Implemented is a confirmed absence. N/A always needs a rationale based on risk and deployment context. Enter confidence and assessor/management notes; answers autosave, and you can resume from Assessments.

Use the Evidence repository to upload or link manuals, architecture, SBOMs, configurations, logs, certificates, signing documentation, inventories, scans, and test results. Follow safe testing and data-handling practices. Uploads are optional; question examples are alternatives. Unavailable or quarantined evidence does not count as available evidence.

Generate draft findings for partial or absent capabilities and investigations for unknown answers. Enable evidence-only investigations if needed. Review condition, risk, product/firmware, evidence missing, severity, operational consequences, recommendations, owner, due date, and retest requirement. The existing review, approval, assignment, remediation, retest, and closure workflow applies.

Readiness Score: implemented = 100, partial = 50, not implemented = 0, unknown/not tested and unanswered = 0 pending verification. Unknown is uncertainty, not a confirmed absence. N/A is excluded. Questions are weighted equally in the baseline. Evidence confidence: fresh available evidence = 100, stale available evidence = 70, otherwise assessor HIGH = 100, MEDIUM = 70, LOW = 40, unset = 10 for answered questions; unanswered = 0. Evidence-adjusted readiness = readiness × evidence confidence / 100. No applicable questions means no readiness conclusion (displayed as N/A).

Administrators can install the published 1.0 baseline, export JSON, import a renamed clone, create and edit a draft, publish it, or retire a template. Assessments retain their exact version. Crosswalks are separately versioned; proposed mappings require qualified validation and do not alter responses.

This assessment is a cybersecurity readiness and decision-support tool. NIST IR 8259A provides a baseline of generally applicable IoT device cybersecurity capabilities and does not mandate implementation of every capability for every device or environment. Applicability and implementation should be evaluated based on the device, deployment architecture, operating environment, threat model, organizational risk, and applicable regulatory or contractual requirements. VoltVerify does not provide certification or guarantee compliance with NIST guidance.