SESIP: An optimized security evaluation methodology, designed for IoT devices

GlobalPlatform is here to support IoT device makers and certification bodies to adopt the Security Evaluation Standard for IoT Platforms (SESIP) methodology and establish their own IoT device security certification schemes.

SESIP provides a common and optimized approach for evaluating the security of connected products that meets the specific compliance, security, privacy and scalability challenges of the evolving IoT ecosystem.

GlobalPlatform is also aligning certification bodies and laboratories, to ensure comparable evaluations across the entire IoT ecosystem. GlobalPlatform welcomes engagement from certification bodies and laboratories.

CEN CENELEC has publicly cited its intention to adopt SESIP as a European Standard (prEN 17927). SESIP delivers greater efficiency, cost-savings and ensures defined assurance levels across a broad range of regulatory and security frameworks including ETSI, ISO/IEC and NIST, as well as specific, vertical regulations.

From Complexity to Consistency: What is SESIP?

IoT products are far more complex than the products traditional security evaluation approaches address. SESIP recognizes this with a common security evaluation methodology that is designed specifically for the IoT platforms and platform parts on which these products are based. It addresses the need for a standardized approach that supports a broad range of regulatory and security frameworks, while at the same time providing a methodology that’s adaptable to the IoT environment and accessible to IoT developers who aren’t security experts.

SESIP:

• Delivers a flexible and efficient security evaluation methodology dedicated to addressing the complexity of the IoT ecosystem.
• Drives consistency by providing a common and recognized methodology that can be adopted across certification schemes.
• Reduces complexity, cost and time-to-market for IoT stakeholders by offering a methodology that’s mappable to other evaluation methodologies, and compliant with standards and regulations.
• Facilitates device certification, by composition of certified parts, and reuse of certification across different evaluations.
• Establishes a consistent and flexible way for IoT developers to demonstrate the security capability of their IoT products and service providers to select a product that matches their security needs.