One Passport to Govern Them All: Bringing Order to IoT Security and Compliance

The increasing complexity of the Internet of Things ecosystems has exposed critical gaps in visibility, traceability, and governance of device security throughout the supply chain. Current practices rely on fragmented descriptors that, although valuable individually, lack a unified framework for integration, traceability, and lifecycle management.
These limitations are particularly pressing in light of emerging regulatory requirements, most notably the EU Cyber Resilience Act (CRA), which demands structured, transparent, and auditable security documentation. To bridge this gap, we introduce the Device Security Passport (DSP), a structured, extensible, and lifecycle-aware model to consolidate and exchange security-related information about IoT devices. Built upon the Open Security Controls Assessment Language, the DSP integrates multiple security descriptors such as software and hardware bills of materials, vulnerability disclosures, and behavioral specifications, into a cohesive, hierarchical framework that evolves with the device from manufacturing to decommissioning. By allowing collaborative contributions from manufacturers, integrators, and operators, the DSP facilitates continuous security assurance, automated policy enforcement, and compliance with regulatory frameworks such as the CRA, thereby fostering greater transparency and accountability throughout the IoT supply chain.