OWASP IoT Security Verification Standard (ISVS)
The OWASP ISVS provides comprehensive security requirements for Internet of Things (IoT) ecosystems and their components.
⚠️ Release Candidate —
1.0.0-RC2. This documentation is a release candidate under community review and may change before the final release. It is not yet a finalized standard. Please review the content and share feedback via GitHub Discussions.
Version 1.0 - Official Release
This is the official 1.0 release of the OWASP ISVS, providing 156 security requirements across five verification categories.
Download the Standard
📄 PDF · 📱 EPUB · 📝 DOCX · 📊 CSV · 🔧 JSON · 🌐 XML
About ISVS
The OWASP ISVS is a community-driven standard for IoT security verification. It provides requirements for:
- 🏢 IoT Ecosystem Design - Security architecture and development processes
- 👤 User Space Applications - Authentication, authorization, and data protection
- 💻 Software Platforms - Bootloaders, OS configuration, and software updates
- 📡 Communication - Network protocols including Bluetooth, WiFi, Zigbee, LoRaWAN
- 🔧 Hardware Platforms - Physical security and hardware design
Three Security Levels
- Level 1: Software-only attacks, baseline security
- Level 2: Hardware-involved attacks, sensitive data protection
- Level 3: Critical systems, defense-in-depth, anti-tampering
Documentation
📖 Getting Started
🔐 Security Requirements
- V1: IoT Ecosystem Requirements
- V2: User Space Application Requirements
- V3: Software Platform Requirements
- V4: Communication Requirements
- V5: Hardware Platform Requirements
🤝 Get Involved
Project Leaders
- Cédric Bassem - [email protected]
- Aaron Guzman - [email protected]
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
