California IoT Security Law
California's Security of Connected Devices law (Civil Code 1798.91.04 to 1798.91.06, SB 327 and AB 1906 of 2018, amended by AB 2392 of 2022) requires every manufacturer of an internet- or Bluetooth-addressable device sold in California to equip it with reasonable security features appropriate to its function and data; a device reachable outside the local network is deemed compliant with a unique preprogrammed password or a forced new credential at first access, and since 2023 a manufacturer may instead rely on a NIST conforming label with third-party conformity assessment. Enforced by the Attorney General and local prosecutors, no private right of action; operative since 1 January 2020.
California IoT Security Law is a compliance framework from United States - California with 1 domains and 3 controls that map to 3 other frameworks. The largest domains are Manufacturer duty: reasonable security features (1798.91.04) – California IoT Security Law (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (1)
Manufacturer duty: reasonable security features (1798.91.04) – California IoT Security Law
| Code | Title |
|---|---|
| california-iot-security-law::1798.91.04(a) | 1798.91.04(a) Reasonable security feature or features |
| california-iot-security-law::1798.91.04(b) | 1798.91.04(b) Authentication outside a local area network: unique password or forced new credential |
| california-iot-security-law::1798.91.04(c) | 1798.91.04(c) Elective compliance through a NIST conforming labeling scheme |
Your Compliance Coverage
If you comply with California IoT Security Law, you already cover:
Maps to 3 other frameworks
Coverage is not the same as your position
This page shows what California IoT Security Law overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is California IoT Security Law and who does it apply to?
California IoT Security Law is a compliance framework from United States - California with 1 domains and 3 controls. California's Security of Connected Devices law (Civil Code 1798.91.04 to 1798.91.06, SB 327 and AB 1906 of 2018, amended by AB 2392 of 2022) requires every manufacturer of an internet- or Bluetooth-addressable device sold in California to equip it with reasonable security features appropriate to its function and data; a device reachable outside the local network is deemed compliant with a unique preprogrammed password or a forced new credential at first access, and since 2023 a manufacturer may instead rely on a NIST conforming label with third-party conformity assessment. Enforced by the Attorney General and local prosecutors, no private right of action; operative since 1 January 2020. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does California IoT Security Law actually require?
California IoT Security Law has 3 controls organised across 1 domains. The largest domains are Manufacturer duty: reasonable security features (1798.91.04) – California IoT Security Law (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of California IoT Security Law do I already cover?
California IoT Security Law maps to 3 other compliance frameworks. The top mapping partners are NIST Cybersecurity Framework 2.0 (22% coverage), US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties (11% coverage), CCPA/CPRA (11% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement California IoT Security Law?
Start your California IoT Security Law compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about California IoT Security Law requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 3 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required