There is no SINGLE federal agency that has overall responsibility for the IoT, just as there is no one agency with overall responsibility for cyberspace. Federal agencies may find the IoT useful in helping them fulfill their missions through a variety of applications such as those discussed in this report and elsewhere. Each agency is responsible under various laws and regulations for the functioning and security of its own IoT, although some technologies, such as drones, may also fall under some aspects of the jurisdiction of other agencies.

Various agencies have regulatory, sector-specific, and other mission-related responsibilities that involve aspects of IoT. For example, entities that use wireless communications for their IoT devices will be subject to allocation rules for the portions of the electromagnetic spectrum that they use.

• The Federal Communications Commission (FCC) allocates and assigns spectrum for nonfederal entities.
• In the Department of Commerce, the National Telecommunications and Information Administration (NTIA) fulfills that function for federal entities, and the National Institute of Standards and Technology (NIST) creates standards, develops new technologies, and provides best practices for the Internet and Internet-enabled devices.

• The Federal Trade Commission (FTC) regulates and enforces CONSUMER protection policies, including for privacy and security of consumer IoT devices.
• The Department of Homeland Security (DHS) is responsible for coordinating security for the 16 critical infrastructure sectors. Many of those sectors use industrial control systems (ICS), which are often CONNECTED to the Internet, and the DHS National Cybersecurity and Communications Integration Center (NCCIC) has an ICS Cyber Emergency Response Team (ICS-CERT) to help critical-infrastructure entities address ICS cybersecurity issues.
• The Food and Drug Administration (FDA) also has responsibilities with respect to the cybersecurity of Internet-connected medical devices.
• The Department of Justice (DOJ) addresses law-enforcement aspects of IoT, including cyberattacks, unlawful exfiltration of data from devices and/or networks, and investigation and prosecution of other computer and intellectual property crimes.
• Relevant activities at the Department of Energy (DOE) include those associated with developing high-performance and green buildings, and other energy-related programs, including those related to smart electrical grids.
• The Department of Transportation (DOT) has established an Intelligent Transportation Systems Joint Program Office (ITS JPO) to coordinate various programs and activities throughout DOT relating to the development and deployment of connected vehicles and systems, involving all modes of surface transportation. DOT mode-specific agencies also engage in ITS activities. The Federal Aviation Administration (FAA) is involved in regulation and other activities relating to unmanned aerial vehicles (UAVs) and COMMERCIAL systems (UAS).
• The Department of Defense was a pioneer in the development of much of the foundational technology for the IoT. Most of its IoT deployment has related to its combat mission, both directly and for logistical and other support.

In addition to the activities described above, several agencies are engaged in research and development (R&D) related to the IoT:-

• Like NIST, the National Science Foundation (NSF) engages in cyber-physical systems research and other activities that cut across various IoT applications.
• The Networking and Information Technology Research and Development Program (NITRD), under the Office of Science and Technology Policy (OSTP) coordinates Federal agency R&D in networking and information technology. The NITRD Cyber Physical Systems Senior Steering Group “coordinates programs, budgets and policy recommendations” for IoT R&D.
• Other agencies involved in such R&D include the Food and Drug Administration (FDA), the National Aeronautics and Space Administration (NASA), the National Institutes of Health (NIH), the Department of Veterans Affairs (VA), and several DOD agencies.
• The White House has also announced a smart-cities initiative focusing on the development of a research infrastructure, demonstration projects, and other R&D activities.

There is no single federal agency that has overall responsibility for the IoT, just as there is no one agency with overall responsibility for cyberspace. Federal agencies may find the IoT useful in helping them fulfill their missions through a variety of applications such as those discussed in this report and elsewhere. Each agency is responsible under various laws and regulations for the functioning and security of its own IoT, although some technologies, such as drones, may also fall under some aspects of the jurisdiction of other agencies.

Various agencies have regulatory, sector-specific, and other mission-related responsibilities that involve aspects of IoT. For example, entities that use wireless communications for their IoT devices will be subject to allocation rules for the portions of the electromagnetic spectrum that they use.

In addition to the activities described above, several agencies are engaged in research and development (R&D) related to the IoT:-