Internet of Things (IoT)

Mission

The core mission of the IoT Work Group is to create profiles, guidance, and specifications tailored for memory-constrained and low-power IoT devices that cannot easily adopt traditional PC-oriented TPM implementations. The IoT WG aims to provide a standardized TPM ecosystem that reduces software integration effort, gives flexibility, and improves security across the diverse landscape of connected embedded systems.

What the group does

The IoT WG adapts TPM 2.0 technologies to the unique requirements of IoT and embedded systems. Its primary focus is on enabling trusted computing capabilities for memory-constrained, low-power, RTOS-based, bare-metal, and non-UEFI platforms that cannot easily adopt traditional PC Client TPM profiles. The group defines practical security architectures, interoperability requirements, and TPM features that support core IoT use cases such as secure communication, secure storage, secure device provisioning, measured boot, attestation, and firmware integrity validation.

The IoT Work Group emphasizes the creation of a lightweight interoperable TPM profile that preserves the security benefits of TPM 2.0 while reducing complexity for embedded deployments. This includes standardized PCR mappings for non-UEFI systems, simplified authorization mechanisms for resource-constrained devices, guidance on secure use of TPM non-volatile memory, and support for device identity and attestation workflows optimized for IoT environments.

Why it matters

The Internet of Things is rapidly expanding into critical infrastructure, industrial systems, healthcare, energy, transportation, and consumer environments. Many of these devices operate with limited memory, processing power, and software complexity, making it difficult to adopt security architectures that were originally designed for PCs and servers. At the same time, compromised IoT devices can become entry points into larger networks, expose sensitive operational data, disrupt critical services, or enable large-scale cyberattacks. The IoT Working Group addresses this gap by defining specifications specifically tailored for resource-constrained embedded systems, bringing strong hardware-rooted security to devices that have historically lacked practical trusted computing solutions.

Key deliverables

• TCG Guidance for Secure Update of Software and Firmware on Embedded Systems
• Architect's Guide IoT Security
• Guidance for TPM and Smart Buildings
• TCG Guidance for Securing IoT

Technology the group develops

The IoT Work Group develops IoT-focused specifications of TPM 2.0 technology that enables trusted computing capabilities on resource-constrained embedded devices. The group defines how TPM 2.0 can be adapted for systems with limited memory and processing resources, including RTOS-based, bare-metal, and non-UEFI platforms, while preserving interoperability across the broader trusted computing ecosystem.

The IoT Work Group develops the new IoT TPM Profile specification to help systems with limited memory and processing resources adapt TPM 2.0 solutions. The specification enables quicker adoption of TCG technologies in RTOS-based and bare-metal systems while preserving interoperability across the broader trusted computing ecosystem. Non-UEFI platforms that may run a rich OS may also benefit from the IoT TPM Profile.