General Framework for Secure IoT Systems
National center of Incident readiness and Strategy for Cybersecurity (NISC)
Government of Japan
August 26, 2016
1. General Framework Objective
Internet of Things (IoT) systems consist of connected things and networks and thus should
be regarded as an integrated system of IT with physical components. It is important to ensure
physical safety in addition to existing information security measures. It is essential that IoT
systems are designed, developed and operated under the principle of “Security by Design,”
while looking ahead to the future where many individual systems are interconnected with
new vulnerabilities possibly introduced. To rationally accomplish this, a two-step approach
is appropriate: instituting general requirements on design, development, and operation of
all IoT systems, in addition, sector-specific requirements for development and operation
based on characteristics of respective sectors.
Based on this concept, this framework aims to clarify the fundamental and essential security
requirements for secure IoT systems.
It is expected that this framework will contribute to promoting the industry’s active
involvement in the development of secure IoT systems and will create an environment in
which IoT systems users can utilize the systems with a condition that security and safety is
assured, by promoting the interoperability of IoT systems and the implementation of security
requirements.
2. Perspectives of the General Framework
An IoT system is a system that produces added value by connecting things or physical objects
through the Internet. Safety needs to be considered because physical systems are involved.
However, while generating added value by connecting an IoT system to another one, there
is concern for a vulnerability in one IoT system which affect other IoT systems. Therefore,
keeping this possibility in mind, we should recognize IoT systems as aggregated IoT systems,
which should be called a “System of Systems (SoS)”. In addition, it is important to ensure
safety as well as existing information security for the services provided by such IoT system.
1