What is a device cybersecurity questionnaire?
Security reviews in tenders ask the same questions again and again: what the device collects, where the data goes, how it is protected, how it is updated and who to call when a flaw is found. This file puts those questions in one document that any buyer can send to any vendor.
The sections follow the topics of NIST IR 8259, the foundational guidance for IoT device makers, and its two baselines. The form is blank on purpose. It describes no product.
How to use the questionnaire
- Fill in the details on the cover: model, firmware version, tender reference.
- Remove questions that do not apply and ask your legal and technical advisers to review the file.
- Send it to the vendor. The vendor answers for the exact model and firmware version.
- Review the answers on the last pages: count answers by section, mark red flags and record your decision.
Reading the answers: red flags
A good answer is specific, names a document and can be checked. A weak one repeats the question or uses a label.
- No written end date for security updates.
- Default or shared passwords or keys.
- Firmware that is not signed, or no answer on signing.
- No stated time to tell customers about an incident.
- Data location that is not stated or not confirmed in writing.
Personal data and drivers
Position tied to a named driver and video of the cab are personal data in many countries. Section I asks what is collected, how long it is kept and who decides. What the law requires of you, and what notice drivers must receive, is a question for your lawyer.
Where to check
Read NIST IR 8259 and its baselines at the NIST site, and the data-protection law of your own country, in their current official versions. NIST published a revision, IR 8259 Rev. 1, in April 2026 and the 2020 edition is superseded. This form follows the topics of the 2020 edition, so read the current NIST publication first. We read the NIST page, last checked 2026-11-03. This page does not summarize them and does not say that any product meets them. csrc.nist.gov
Limits of this file
It is a questionnaire, not a test. Answers come from the vendor, and a written answer is not proof. Ask for evidence, test what you can, and keep the signed review page with the tender file.