IoT supply chain cybersecurity: From manufacturer to deployment

In today's world, with the rapid growth of connected Internet of Things (IoT) devices, supply chain cybersecurity has become a paramount concern for every enterprise. Balancing cost, device availability, and the imperative to minimize risks from compromised components—from hardware to firmware and software—is a key challenge for CISOs, procurement heads, IoT solution architects, and compliance specialists.

Understanding IoT supply chain risks: From chip to cloud

IoT device supply chains are incredibly complex and globally distributed, making them attractive targets for cyberattacks. Risks can emerge at any stage: from chip manufacturing to the deployment of the end device. Common threats include malicious functionality embedded in hardware or software, the use of counterfeit components, or vulnerabilities passed from suppliers to end-users.

The scale of the problem is striking: as of 2024, there are over 21 billion connected devices worldwide, with approximately 820,000 cyberattacks recorded daily. More than 50% of all IoT devices contain critical vulnerabilities that can be immediately exploited by attackers, and 60% of data breaches are linked to unpatched firmware. This underscores the critical need for robust cybersecurity practices throughout the entire device lifecycle.

Assessing and qualifying IoT device suppliers: Cybersecurity criteria

Building a resilient supply chain begins with thorough supplier assessment and qualification. It's crucial to move beyond traditional criteria and focus on their cybersecurity practices. Recognized standards and recommendations exist for this purpose:

• ETSI EN 303 645: This global standard sets baseline cybersecurity requirements for consumer IoT devices, covering secure communication, software updates, password protection, and vulnerability handling. While not a harmonized standard under the EU Cyber Resilience Act as of May 2026, it serves as a strong foundation for evaluation.
• NIST SP 800-161: Provides guidance on Cyber Supply Chain Risk Management (C-SCRM) for systems and organizations. It helps identify, assess, and mitigate risks originating from suppliers, including hardware, software, and services.
• ISO 27036: This standard offers guidance on information security risk management when acquiring goods and services from third parties, particularly for ICT supply chains (Part 3).

When auditing suppliers, attention should be paid to the presence of security certifications (e.g., ISO 27001), vulnerability response policies, and transparency regarding their own component supply chain.

Ensuring component integrity: From manufacturing to warehouse

To minimize risks from compromised components, their integrity must be ensured at all stages. Key tools here include:

• Software Bill of Materials (SBOM) and Hardware Bill of Materials (HBOM): An SBOM is a complete inventory of all software components running on a device, including version, programming language, and libraries. It provides transparency in the software supply chain, allowing for quick identification of vulnerabilities and application of patches. An HBOM, in turn, lists all physical components used to build the device.

Manufacturers should provide SBOMs containing author name, supplier, component name, version string, cryptographic hash, and a unique identifier. This enables end-users to understand and mitigate risks. Secure packaging and transportation of devices are also crucial to prevent unauthorized access and modification. Hardware Security Modules (HSMs) and Trusted Platform Modules (TPMs) play a vital role by providing hardware-based cryptographic functions and secure storage for sensitive data, enhancing device integrity.

Secure onboarding and deployment of IoT devices: First steps into the ecosystem

IoT device onboarding is the process of securely connecting a new device to a network and bringing it into an operational, trusted state. It involves establishing the device's identity, authenticating it, provisioning credentials and configuration, applying firmware updates, and enforcing security policies before the device is authorized to communicate.

Key aspects of secure onboarding:

• Device Identity Management: Each IoT device should be assigned a unique cryptographic identity early in its lifecycle, ideally during manufacturing or initial boot-up. This can be a digital certificate that enables secure, authenticated communication.
• Secure Over-the-Air (OTA) Firmware Updates: OTA update systems must be designed so that each update is signed with a private key and verified on the device using the corresponding public key. This ensures that only trusted updates are installed, prevents tampering during transmission, and includes rollback protection against vulnerable versions.
• Initial Security Configuration: After onboarding, devices are typically in a default mode. It's crucial to change default passwords, configure access restrictions, and ensure network segmentation to minimize potential attack vectors.
• Automated Provisioning (Zero-touch provisioning): For large-scale IoT deployments, automating registration, broker assignment, and network connection processes is critical for scalability and reducing human error.

Compliance and regulatory requirements: Navigating the IoT security landscape

Adhering to regulatory requirements is an integral part of managing IoT supply chain cyber risks. The global IoT security landscape is rapidly evolving, and B2B buyers must stay informed about key standards:

• EU Cyber Resilience Act (CRA): Adopted in October 2024, the CRA introduces stringent cybersecurity requirements for all products with digital elements sold in the EU market. It mandates manufacturers to integrate security-by-design principles, provide SBOMs, ensure vulnerability handling, secure updates, and cryptographic flexibility throughout the product lifecycle. Obligations for vulnerability reporting begin in September 2026, with full regulation enforcement expected in December 2027.
• ETSI EN 303 645: As mentioned, this standard is an important foundation for baseline IoT device security, helping manufacturers ensure cybersecurity at the design stage.
• ISO 27036: This standard, particularly Part 3, provides guidance on information security risk management in the supply chain for hardware, software, and services.

Understanding and integrating these standards into procurement and deployment processes is critical for ensuring compliance and mitigating legal and operational risks.

IoT device supplier assessment matrix

To make informed decisions regarding IoT device procurement, it is recommended to use a structured assessment matrix that considers key aspects of supply chain cybersecurity:

For B2B buyers aiming to minimize cyber risks and ensure regulatory compliance, AZIOT offers expertise in designing and implementing comprehensive IoT solutions that consider supply chain security from device selection to integration and ongoing management. Intecracy solutions and inbase.com.ua solutions provide robust platforms for secure IoT deployments.

Building a reliable IoT device procurement and deployment process is not a one-time action but a continuous process that requires vigilance and adaptation to the evolving threat landscape. Integrating security principles at all stages, from supplier selection to onboarding, is the only way to create a resilient and protected IoT ecosystem. This not only ensures compliance with regulatory requirements but also safeguards critical operations and data from growing cyber threats.