🛡️ Smart Office IoT Security Assessment

All connected devices (printers, cameras, sensors, smart displays, HVAC) are documented

Firmware versions, warranty dates, and end-of-life schedules are maintained

Process exists to identify unauthorized devices connecting to the network

IoT devices are on separate VLANs from corporate systems and guest WiFi

All device traffic uses TLS/SSL; no unencrypted protocols (Telnet, HTTP) in production

Specific firewall policies limit IoT device communication to necessary endpoints

Anomaly detection monitors IoT traffic patterns for suspicious behavior

All IoT devices have unique, strong passwords; no factory defaults in use

MFA required for device management consoles and admin interfaces

Device access is limited based on job function; principle of least privilege applied

Server rooms, network closets, and device locations have controlled access

Regular schedule for checking and applying IoT device firmware updates

CVE feeds and vendor advisories are monitored for devices in use

Process to replace devices when vendors stop providing security updates

Understanding of what data IoT devices collect and where it's transmitted

Defined retention periods for sensor data, camera footage, access logs

Employees and visitors informed about monitoring devices (cameras, sensors)

Documented procedures for responding to compromised IoT devices

Ability to quickly quarantine compromised devices from the network

Device configurations backed up; recovery procedures tested