Sharpening the Focus on Product Requirements and Cybersecurity Risks: Updating Foundational Activities for IoT Product Manufacturers

**Executive summary:** NIST released the second public draft of NIST IR 8259 Revision 1, outlining updates based on community feedback—including adding Activity 0, splitting and revising activities, strengthening risk assessment and threat modeling guidance, and improving document clarity—and announced the public comment period extension through December 10, 2025, with further engagement planned.