A device that can switch a street can be attacked.
Learning Track · Module 3: Controllers · Step 21 of 101
Showing content for Europe. Change the region at the top of the page.
- Credentials: each device has its own. No shared or default passwords.
- Encryption: TLS or the network’s own encryption between device and platform.
- Network: private APN, VPN, or network security. No open internet access.
- Updates: signed firmware. The device rejects unsigned updates.
- Access: minimum access for each role. Each switch command is logged.
- Fail-safe: the controller keeps its schedule when the connection is lost.
Rules in Europe
Europe: Radio devices must meet cybersecurity requirements under the Radio Equipment Directive (EN 18031 series). The Cyber Resilience Act adds duties for most connected products, with main duties from December 2027. The NIS2 Directive can apply to cities and utilities as operators.
Middle East: UAE: the TDRA IoT regulatory policy and national information assurance standards. Saudi Arabia: NCA Essential Cybersecurity Controls apply to government entities and their suppliers. Data residency rules can require hosting in the country.
South Asia: India: CERT-In directions require incident reporting and log retention. The Digital Personal Data Protection Act 2023 applies if you process personal data. Some government buyers ask for hosting in India.
USA: NIST IR 8259 gives baseline IoT device security. California SB-327 bans shared default passwords on connected devices sold in the state. Federal buyers may require NIST SP 800-53 controls or FedRAMP for cloud services.
Note
IEC 62443 is a common international reference for industrial control security. A network outage must never make a street go dark.
Sources
- EN 18031-1 Common security requirements for radio equipment
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- NIST IR 8259 Foundational cybersecurity activities for IoT device manufacturers
- California Civil Code 1798.91.04 (SB-327)
- IEC 62443 Industrial communication networks: security
- CERT-In directions under section 70B of the IT Act (2022)
- NCA Essential Cybersecurity Controls (Saudi Arabia)
Changes: 30 October 2026: First publication: guides for Europe, the Middle East, South Asia, and the USA; failure library; tender clause library; comparisons; tools; downloads. See the changelog. Found a mistake? Report it.