IoT systems are too diverse for one set of characteristics, so the standard distinguishes common characteristics from application-specific ones. Common: IoT devices are specific hardware and software used with or attached to physical things; they are network-connected, wired or wireless, and transmit and receive data; they usually sense (environment states, movements) and can actuate (receiving controlling data to initiate physical actions); IoT applications process device data, generate controlling data and integrate with other systems; operational components set up and operate devices and applications; and the systems support human or digital users. Specific: consumer IoT is price-sensitive with privacy often critical; industrial IoT can replace or join plant control systems and inherits high-availability and safety requirements, where process safety can depend on a device's security characteristics; vehicle IoT sits in reliability or safety functions with privacy or high integrity and availability requirements. IoT service providers often run on cloud infrastructure, especially public cloud for low initial cost and scalability, and as cloud consumers should ensure the cloud service has adequate controls that, with their own, fully address the IoT users' security and privacy requirements including PII, the provider being in a supplier role; ISO/IEC 27036-4, 27017 and 27018 apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.