A bill presented to the U.S. Congress on Monday would enforce minimum security standards for “internet of things” devices purchased by the U.S. government.

The Internet of Things Cybersecurity Improvement Act of 2019 was introduced in the Senate by a bipartisan group of senators — Mark Warner, Cory Gardner, Maggie Hassan and Steve Daines — and representatives Robin Kelly and Will Hurd.

The bill, an updated version of a similar bill introduced in 2017 that failed to be adopted, would require the U.S. government to make sure that any devices it purchases meet minimum security requirements.

Under the proposed law, the National Institute of Standards and Technology would issue recommendations addressing the secure development, identity management, patching and configuration of IoT devices.

NIST would then direct the Office of Management and Budget to issue guidelines consistent with the NIST recommendations for each federal agency. At that point, federal agencies would be required to ensure that any internet-connected devices they purchase comply with the recommendations.

To sell their products to the government, IoT providers would be required to provide verification that their devices don’t contain any known security vulnerabilities, use industry standard technology and don’t have any fixed credentials.

In addition, so-called “behavioral requirements” would include notifying the government of any vulnerabilities as they are found as well as providing ongoing security support for the devices.

All this wouldn’t necessarily mean that all consumer devices would be safer, but the theory is that by forcing minimum security standards for the government purchases, a major purchaser of IoT devices, those minimum standards would flow on to consumers as well.

“While I’m excited about their life-changing potential, I’m also concerned that many IoT devices are being sold without appropriate safeguards and protections in place, with the device market prioritizing convenience and price over security,” Sen. Warner said in a statement. “This legislation will use the purchasing power of the federal government to establish some minimum security standards for IoT devices.”

Image: 111692634@N04/Flickr