A connected sensor, camera or controller can add useful information to a business process. It also introduces a device that needs ownership, maintenance and a retirement plan. NIST’s cybersecurity work on the Internet of Things provides background for evaluating connected products. The practical buying question is what happens after the device has been installed and the original project team has moved on.
Ask how the product will be maintained
A buyer should understand the update process, the support period and the method for reporting a problem. The answers need to be specific to the product and its intended deployment. A general security statement is less useful than a clear explanation of how an operator will identify and apply an important update.
A hypothetical retailer deploying environmental sensors can also ask who keeps the inventory current. Devices may be moved, replaced or forgotten. Without an authoritative record, an organization can lose track of what is connected and which team is responsible for it.
Consider the surrounding system
The device may depend on a cloud service, mobile application or supplier account. Those dependencies affect availability and the ability to keep using the product if a contract changes. Data export, account administration and access revocation belong in the evaluation alongside battery life and measurement accuracy.
Network placement and permissions should reflect the device’s purpose. A product that needs to report a measurement should not receive broad access merely because that is convenient during installation. Appropriate technical controls require an assessment of the actual environment.
Plan the end as well as the beginning
Retirement can involve removing credentials, preserving necessary records and handling stored data. A supportable product has a credible path through that final stage. The best purchase decision considers the device’s whole working life.
