services and components to self-assess the conformance of their products, services and components to the GSMA IoT Security Guidelines. Completing a GSMA IoT Security Assessment Checklist allows an entity to demonstrate the security measures they have taken to protect their products, services and components from cybersecurity risks. Assessment declarations can be made by submitting a completed declaration to the GSMA. 5.2.2 Key Findings – Security standards and guidelines are required for development and operations to stimulate the adoption of secure IoT devices. – A number of IoT security good practices, guidelines and recommendations exist, but efforts from established standards development organisations such as ETSI and NIST are very recent. – Manufacturers may not have the expertise to make use of the available guidelines and recommendation. Usability of security guidelines is a challenge and requires more research. – Harmonisation of IoT security guidelines and recommendations is required to stimulate adoption. Harmonisation should be supported by global cybersecurity research initiatives. – It is important for standardisation processes to stay aligned with technological developments without stifling innovation. 5.3 EVALUATION AND CERTIFICATION A comprehensive global IoT certification framework or self-certification solution does not yet exist; it remains an open challenge to develop globally recognised and adopted cybersecurity evaluation and certification regimes for IoT 44 130 https://www.ul.com/inside-ul/ul-2900-2-3-helps-mitigate-iot-cybersecurityrisk/ --- New Standard for Software Cybersecurity for Network-Connectable Products UL 2900 / ANSI https://industries.ul.com/blog/ new-standard-for-software-cybersecurity-for-network-connectable-products 131 https://www.brightsight.com/en/archieven/1111 132 https://www.riscure.com/market/iot-healthcare/ devices. Given that a system of secure components is not by definition a secure ecosystem, evaluation and certification regimes should include individual components, the wider network of systems and components, and the global ecosystem. An evaluation and certification scheme should be based on a generic and common framework, possibly with businessor application-specific provisions. Such a framework may provide assurance similar to the Common Criteria for Information Technology Security Evaluation (ISO/IEC 15408). An alternative approach to certification may be to strengthen and modernise liability laws to encompass IoT products and ecosystems; this is discussed in the section on Responsible Industry Ecosystem. 5.3.1 Current Landscape and Recent Developments Independent laboratories such as UL130, Brightsight131, and Riscure132, as well as government bodies such as US-CERT of the U.S. Department of Homeland Security, provide cybersecurity assessment and certification services and typically focus on vulnerability scanning and architecture design reviews. While they have taken early steps in IoT, they may not be ready for more comprehensive functional testing of IoT devices or for domain-specific testing; for instance, the security of a software application can be tested but not the effects that cascade from cybersecurity to functional safety. This is also because of the lack of globally-accepted IoT security standards and certification schemes to test and certify against. Trusted IoT security labels An IoT security label should give a baseline security requirement of protection, and the level of assurance for