IoT Device Vendor Risk Assessment Sheet

Vendor Name		Assessment Date
Product/Device Name		Version/Firmware
Assessor(s)

Criteria	Assessment	Notes
Security Certifications (e.g., ISO 27001)	YesNo
Vulnerability Disclosure Policy	YesNo
Regular Security Updates Provided	YesNo
Secure Development Lifecycle (SDL)	YesNo

Feature	Assessment	Notes
Authentication Mechanisms	StrongWeak
Encryption of Data in Transit	YesNo
Encryption of Data at Rest	YesNo
Logging & Monitoring Capabilities	YesNo
Firmware Update Mechanism	SecureInsecure
Default Credentials Removed	YesNo

Criteria	Assessment	Notes
Geographic Origin of Components
Third-Party Software Dependencies
End-of-life Policy	YesNo
Vendor Support & Responsiveness	HighMediumLow

Risk Level	High Medium Low
Summary Comments