IoT Security evaluation questionnaire

This evaluation is stored in your browser only. We cannot see it, and it is not tied to any account. Save it to a link or create an account to keep it across devices — you can export it at any time either way.

All 36 vendors in this category.

• baselineRFIHow does the platform discover and fingerprint IoT devices on the network — passive traffic analysis, active scanning, or both — and what percentage of device types can it accurately identify (manufacturer/model/firmware version) versus a generic "unknown IoT device" bucket?weight 3
  Answer key — what a strong answer shows

  Passive-plus-active discovery with a stated accurate-identification percentage is stronger than a vendor claiming blanket visibility with no number; a large unknown-device bucket is a real red flag.

• baselineRFPDetail how the platform assesses IoT device risk — known CVEs matched to the specific firmware version, default/weak credentials, insecure protocols in use — and how risk scores translate into prioritized remediation guidance, with a customer reference.weight 3
  Answer key — what a strong answer shows

  Firmware-version-specific CVE matching (not just device-model-level) plus a named customer outcome is stronger than a generic risk score with no remediation path.

• baselineRFIWhat network segmentation/microsegmentation enforcement does the product provide for IoT devices — can it automatically quarantine or restrict a device flagged as vulnerable or behaving anomalously, or is enforcement purely advisory?weight 3
  Answer key — what a strong answer shows

  Automated enforcement (quarantine/restrict) is materially stronger than advisory-only alerting that requires a manual network change.

• baselineRFPExplain support for OT/ICS-adjacent protocols (Modbus, BACnet, DNP3, etc.) if the deployment spans both IT and OT/building-automation environments, and whether monitoring is passive-only or can actively probe those devices.weight 3
  Answer key — what a strong answer shows

  Passive-only monitoring for OT is the safer, more mature answer; active probing of fragile OT devices is a real operational risk the vendor should acknowledge, not gloss over.

• baselineRFIHow does the platform handle firmware/patch management at scale — can it push firmware updates directly, or does it only alert that a device is out of date and require a separate process to remediate?weight 3
  Answer key — what a strong answer shows

  Many IoT security tools are detection-only; a vendor that can actually push firmware updates (or integrate with a system that can) is a materially stronger, rarer capability worth verifying with evidence.

• baselineRFIWhat is the deployment model for device discovery/monitoring sensors — dedicated hardware appliances, virtual appliances, or agentless network-tap/SPAN-based — and what is the typical time-to-full-visibility for a mid-size deployment (e.g., 10,000 devices)?weight 3
  Answer key — what a strong answer shows

  A concrete time-to-visibility figure at a stated device-count scale is stronger evidence than a "fast deployment" claim with no numbers.

• baselineRFPDescribe integration with existing NAC, SIEM, and ticketing systems for automated response workflows when a high-risk IoT device is detected, and quantify mean-time-to-remediation improvement with a customer reference.weight 3
  Answer key — what a strong answer shows

  Named integrations plus a real MTTR figure from a customer is stronger evidence than a generic "integrates with your stack" claim.

• baselineRFIHow does the platform handle device lifecycle — detecting when a device is decommissioned/removed from the network versus simply going offline temporarily — to avoid stale inventory and false "missing device" alerts?weight 3
  Answer key — what a strong answer shows

  Look for explicit decommission-detection logic (e.g., a grace period plus confirmation) rather than every offline device immediately flagged as an incident.

• baselineRFIWhat is the pricing model — per device, per site, or a flat enterprise tier — and given that device discovery inherently reveals more IoT devices than initially estimated, how does pricing respond to that discovery-driven growth?weight 3
  Answer key — what a strong answer shows

  Same tension as other discovery-driven categories: successful IoT discovery inherently increases the counted device population — ask explicitly how pricing handles a large post-onboarding jump in discovered devices.

• baselineRFPDescribe incident-response/forensic capability for a confirmed compromised IoT device, given many IoT devices lack traditional endpoint logging — can the platform reconstruct what happened from network-level telemetry alone, and what is a customer-referenced example?weight 3
  Answer key — what a strong answer shows

  IoT forensics is genuinely harder than traditional endpoint forensics due to limited on-device logging — ask for a specific network-telemetry-based reconstruction capability and a real customer example.

• baselineRFIDoes the platform map coverage to IoT-specific regulatory requirements (EU Cyber Resilience Act, California/Oregon IoT security laws) with audit-ready reporting, and can it flag devices that don't meet applicable regulatory security baselines?weight 3
  Answer key — what a strong answer shows

  IoT-specific regulation is a distinct and growing compliance requirement — ask for a specific, named regulatory mapping rather than a generic 'security best practices' claim.

• baselineRFPDetail historical trend reporting on IoT device risk posture (vulnerable-device count, unpatched-device trend) over time, suitable for demonstrating program maturity to leadership.weight 3
  Answer key — what a strong answer shows

  Trend-over-time reporting is a distinct capability from a real-time dashboard — confirm this exists as a maintained, exportable report.

• baselineRFIHow does the platform integrate with (versus duplicate) the customer's existing CAASM/asset-inventory tooling so IoT device findings feed into the same unified asset view rather than a disconnected IoT-specific dashboard?weight 3
  Answer key — what a strong answer shows

  Look for genuine integration into a unified asset view; a standalone IoT dashboard disconnected from the broader asset-inventory picture creates real reconciliation burden.

• baselineRFIHow consistent is discovery and protection quality across a large, multi-site or multi-campus deployment — does coverage degrade at smaller or less-actively-managed sites, or is it uniform regardless of site size?weight 3
  Answer key — what a strong answer shows

  A vendor should give an honest answer about whether smaller/remote sites get materially weaker coverage — a common real gap for large multi-site organizations.

• baselineRFPDoes the platform distinguish and appropriately handle unmanaged, personally-owned IoT/smart devices brought onto a corporate guest network, versus company-purchased and centrally managed IoT devices — and what policy differentiation exists between the two?weight 3
  Answer key — what a strong answer shows

  BYO-IoT on guest networks is a distinct risk category from managed corporate IoT — a vendor should clarify how policy differs for each rather than treating all discovered devices identically.

• baselineRFIFor building-automation/facility IoT specifically (HVAC, physical access control, elevators), does risk scoring incorporate physical-safety/facility-disruption impact, or is scoring purely IT-style CVSS severity with no facility-impact context?weight 3
  Answer key — what a strong answer shows

  A compromised building-automation device carries physical-safety and facility-disruption risk that generic IT-style CVSS scoring doesn't capture — ask for a specific answer on facility-impact-aware risk scoring for this device class.

These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.