scope:

The present document details test purposes to ensure a minimum security level for IoT devices. The underlying requirements are a subset of the IEC 62443-4-2 [1] standard containing functional security requirements for components. IEC 62443-4-2 [1] was initially started with the focus on Industrial Automation and Control systems. Due to its generic nature, the standard turned out to be applicable also to other domains. This is in especially possible as the standard allows the application of defined subsets in terms of so-called profiles. Profiles were meant to adapt the set of requirements to particular domains beyond industrial automation and control systems. It resolves the mapping of requirements to one of the four security level. So, the selection is not bound to existing security level, which might be seen as profiles as well.

The IoT profile is a collection of those IEC 62443-4-2 [1] requirements that were seen foundational for any IoT device. Not fulfilling the IoT-profile-requirements does not mean that a device cannot be used at all. But it does mean, that the related risks need to be mitigated by other means. This applies especially to constrained devices with limited capabilities.

The starting point for the IoT profile were IEC 62443-4-2 [1] requirements mapped to the lowest security level SL1. As IoT devices are typically running standalone without any integration into a central management system, all requirements related to integration into a central management system have been excluded. This applies in especially to requirements related to:

• central account management integration;

• central event management;

• auditing.

The only requirements seen mandatory for all IoT devices although mapped to higher security level in IEC 62443-4-2 [1] relate to:

• software authenticity check (to prevent unauthorized software modifications); and

• session integrity (to prevent e.g. replay attacks).