Industrial Internet of Things Safety and Security Protocol

The World Economic Forum's IIoT Safety and Security Protocol establishes a set of baseline requirements for insurability and differentiated premiums to incentivize the 'active hardening' of industrial connected systems. The framework focuses on three pillars: device safeguards, internal governance, and record-keeping, aiming to shift the IIoT ecosystem toward a model of shared responsibility and preventive cybersecurity.

• The IIoT ecosystem faces critical security vulnerabilities that extend beyond digital data loss to physical threats, including risks to public safety and catastrophic attacks on shared public infrastructure. The document cites the Mirai botnet and cyberattacks in Ukraine—specifically a 2015 attack on the electrical utility control system that caused power outages for 225,000 customers—as evidence of these risks.
• Market forces alone are insufficient to drive IIoT security because the economy currently prioritizes time-to-market and profitability, while the consequences of security breaches often impact a diffuse group of third parties rather than the producers. The Protocol suggests that insurance can correct this market failure by providing financial incentives for compliance and disincentives for poor security practices.
• The Protocol defines specific 'Line of Business IIoT Device Safeguards' required for insurability, including the use of risk-assessment models, network segmentation, encryption for data at rest and in transit, and a rigorous software development lifecycle. It also emphasizes the need for coordinated vulnerability disclosure and the ability to update software from trusted sources.
• Effective IIoT security requires robust internal governance, including formal board-level oversight of cyber strategy and the appointment of a 'responsible officer' for cybersecurity/resilience. The framework advocates for the implementation of a responsibility assignment matrix (RAM) to ensure accountability across the organization.
• The Protocol recommends the creation of a consortium of IIoT insurers and entities deploying IIoT systems to pool data on security breaches and incidents. This consortium would establish insurability indicators and risk assessments to better understand the security posture of the IIoT ecosystem.

APA

World Economic Forum (2018). Industrial Internet of Things Safety and Security Protocol. http://www3.weforum.org/docs/47498_Industrial_Internet_Things_Safety_Security_Protocol_WP-FINAL.pdf

Chicago

World Economic Forum. Industrial Internet of Things Safety and Security Protocol. 2018. http://www3.weforum.org/docs/47498_Industrial_Internet_Things_Safety_Security_Protocol_WP-FINAL.pdf.

Wikipedia

{{cite report |author=World Economic Forum |title=Industrial Internet of Things Safety and Security Protocol |date=April 2018 |url=http://www3.weforum.org/docs/47498_Industrial_Internet_Things_Safety_Security_Protocol_WP-FINAL.pdf |access-date=23 October 2026 |via=Climate Insights Directory}}

BibTeX

@techreport{worldeconomicforum2018industrial, author = {{World Economic Forum}}, title = {{Industrial Internet of Things Safety and Security Protocol}}, institution = {World Economic Forum}, year = {2018}, month = apr, url = {http://www3.weforum.org/docs/47498_Industrial_Internet_Things_Safety_Security_Protocol_WP-FINAL.pdf}, urldate = {2026-10-23}, note = {Indexed by Climate Insights Directory} }