ChaptersEventsBlog
We're exploring how organizations adapt IAM to AI. Take the AI Identity and Risk Readiness Survey by September 5 →

Download Publication

Guide to the IoT Controls Matrix v3
Guide to the IoT Controls Matrix v3
Who it's for:
  • auditors
  • security architects
  • developers
  • security engineers
  • penetration testers

Guide to the IoT Controls Matrix v3

Release Date: 04/25/2022

Working Group: Internet of Things

The Guide to the IoT Security Controls Matrix provides instructions for using the companion CSA IoT Security Controls Matrix v3. This guide explains how to use the framework to evaluate and implement an IoT system for your organization by providing a column by column description and explanation. 

The IoT Security Controls Matrix is relevant for enterprise IoT systems that incorporate multiple types of connected devices, cloud services, and networking technologies. The Framework has utility across many IoT domains from systems processing only “low-value” data with limited impact potential, to highly sensitive systems that support critical services. The classification of a system is assigned by the system owner based on the value of the data being stored and processed and the potential impact of various types of physical security threats. 
Download this Resource

Prefer to access this resource without an account? Download it now.

Bookmark
Share
View translations
Related resources
Zero Trust Guidance for Small and Medium Size Businesses (SMBs) - Korean Translation
Zero Trust Guidance for Small and Medium Size B...
Zero Trust Automation & Orchestration and Visibility & Analytics Overview
Zero Trust Automation & Orchestration and Visib...
Zero Trust Guidance for IoT
Zero Trust Guidance for IoT
"Set It and Forget It” Access Control is No Longer Enough
"Set It and Forget It” Access Control is No Longer Enough
Published: 08/20/2025
Why You Should Say Goodbye to Manual Identity Processes
Why You Should Say Goodbye to Manual Identity Processes
Published: 08/13/2025
Agentic AI and Zero Trust
Agentic AI and Zero Trust
Published: 08/07/2025
The Ethical and Societal Considerations of an AI Impact Analysis
The Ethical and Societal Considerations of an AI Impact Analysis
Published: 08/05/2025

Acknowledgements

​Aaron Guzman
​Aaron Guzman

​Aaron Guzman

Aaron is a passionate information security professional specializing in IoT, embedded, and automotive security. He is co-author of the “IoT Penetration Testing Cookbook” and a technical editor for the "Practical Internet of Things Security” Packt Publishing books. Aaron is co-chair of CSA’s IoT working group as well as a leader for OWASP’s IoT and Embedded Application Security projects; providing practical guidance to address the most commo...

Read more

Brian Russell
Brian Russell

Brian Russell

Brian Russell is co-author of the book “Practical Internet of Things Security” and is a Chief Engineer focused on Cyber Security Solutions for Leidos (www.leidos.com). He oversees the design and development of security solutions and the implementation of privacy and trust controls for customers. Brian leads efforts that include security engineering for Unmanned Aerial Systems (UAS) and Connected Cars, and the development of hig...

Read more

Michael Roza
Michael Roza
Risk, Audit, Control and Compliance Professional at EVC

Michael Roza

Risk, Audit, Control and Compliance Professional at EVC

Michael Roza is a seasoned risk, audit, control and compliance, and cybersecurity professional with over 20 years of experience across multinational enterprises and startups. As a Cloud Security Alliance (CSA) Research member for over 10 years, he has led and contributed to more than 140 CSA projects spanning Zero Trust, AI, IoT, Top Threats, DecSecOps, Cloud Key Management, Cloud Control Matrix, and many others.

He has co-chaired...

Read more

Are you a research volunteer? Request to have your profile displayed on the website here.

Interested in helping develop research with CSA?

Related Certificates & Training