Buying a Device Is Buying Its Last Update

A connected device arrives with a small but consequential invisible attachment: its last update.

That could be a camera, a conference-room controller, a router, a medical-adjacent sensor, a point-of-sale peripheral, or the oddly important appliance that someone bought because it solved Tuesday’s problem. The purchase order records the price. It often does not record who will receive security notices, apply updates, decide whether an update may interrupt work, or replace the device when support ends.

NIST’s current IoT guidance treats secure updating, customer information, and end-of-support communication as part of a product’s cybersecurity lifecycle—not as optional accessories. That is a useful buying model for any organization, even when the device is not glamorous enough to make the security committee agenda.

Before approving a connected device, ask four plain questions: Who owns it? How is it updated? When does vendor support end? What is the retirement plan? If those answers do not exist, the device is not fully purchased. It is merely installed.