arXiv: CERTIoT-6G: Continuous Cybersecurity Certification for IoT Devices in 5G/6G Networks

A new academic paper, CERTIoT-6G, proposes a framework for continuous cybersecurity certification of Internet of Things (IoT) devices operating within 5G and 6G networks. Published on arXiv, this is not a binding regulation but a technical proposal that outlines how dynamic, real-time security assessments could replace the current static, one-time certification models. The framework suggests using automated monitoring and AI-driven analysis to maintain a device’s compliance status throughout its lifecycle, rather than at a single point of issuance.

This publication is most relevant to IoT device manufacturers, telecommunications operators, and any organization deploying connected devices in critical infrastructure, healthcare, or industrial settings. It also signals a direction for EU regulators and notified bodies, as it aligns with ongoing discussions under the Cyber Resilience Act and the proposed EU certification schemes for 5G/6G. Compliance teams in these sectors should treat this as an early indicator of future requirements, not an immediate obligation.

Compliance teams should begin by mapping their current certification processes against the proposed continuous model, identifying gaps in telemetry, patch management, and incident reporting. They should also monitor the European Commission’s work on dynamic certification and engage with standardization bodies to ensure their product roadmaps can accommodate automated compliance checks. Finally, they should assess their data collection capabilities, as continuous certification will likely require sharing operational security data with regulators or third-party auditors.