NIST finalized IR 8259 Revision 1, "Foundational Cybersecurity Activities for IoT Product Manufacturers," in April 2026 after two public drafts across 2025. The revision splits the foundational activities cleanly across pre-market and post-market phases, pushes risk assessment and threat modeling earlier into development, and expands expectations for telling customers about security, maintenance, support and end of life.
For connected medical devices, the end-of-life piece is the sharp one. Communicating end of support in a way a hospital can plan around is exactly the gap that leaves legacy devices running unpatched for a decade. Map your secure development framework and your customer end-of-life communications to the 8259r1 activity set. It is the US IoT baseline underneath the device-specific expectations, and regulators reference it.