Apply the CSA IoT Controls Framework across your connected estate

The CSA IoT Security Controls Framework is a free spreadsheet of security controls for enterprise Internet of Things systems, published by the Cloud Security Alliance IoT Working Group. Version 2 contains 155 controls in 22 domains, from Asset Management to Vulnerability Management. Each control is rated against low, moderate or high impact levels and allocated to devices, networks, gateways or cloud services, so teams can build a secure baseline for their own architecture.

No. The CSA IoT Controls Framework is a voluntary best practice framework, not a law or regulation, so there are no fines for not following it. Organisations adopt it to design secure IoT systems, to evaluate suppliers, or to meet customer expectations. It can still help you show due care under laws such as UK GDPR or product security rules, but it does not replace any legal obligation.

The framework is aimed at system architects, developers and security engineers who design and run IoT ecosystems, according to the Cloud Security Alliance. IoT system evaluators, such as auditors and penetration testers, use it to validate controls and implementations. It suits any organisation running connected devices with gateways, networks and cloud services, from systems handling low value data to those supporting critical services.

Start by rating your IoT system's confidentiality, integrity and availability impact as low, moderate or high, using FIPS 199 as the guide recommends. Filter the spreadsheet to the controls for those levels, then allocate each control to devices, networks, gateways or cloud services. Where a component cannot meet a control, document the residual risk and a compensating control, then collect evidence and review regularly.

Version 2, released by the Cloud Security Alliance on 28 January 2021, reviewed every control for technical clarity and introduced a new domain structure. It added a Legal domain and a Security Testing domain, and simplified infrastructure allocations by consolidating device types into a single type. The guide states version 2 reduced the control count to 155. Version 3 followed in April 2022 with 198 controls.

No formal certification scheme exists for the CSA IoT Controls Framework. Organisations use it for self-assessment, internal audit or independent review by an auditor or penetration tester. If you need a certificate, pair it with ISO 27001 certification or a SOC 2 report, using the framework to cover IoT specific controls that those standards do not describe in detail.

The framework complements broader standards rather than replacing them. Each IoT control is mapped to the CSA Cloud Controls Matrix where a related control exists, and many controls, such as asset inventory, access management, logging and change management, overlap with ISO 27001 Annex A. Running both in one control set means evidence collected once can support your ISMS and your IoT security baseline.

Yes. OneClickComply supports the CSA IoT Controls Framework v2 today, with its controls mapped into our shared control library. Automated evidence collection, continuous monitoring, AutoComplete policies and OneClickFix cover the cloud, identity and organisational controls, and our in-house auditors guide you on device and wireless controls that need manual evidence. We help you implement and evidence the controls; we do not issue certificates.