Edited 4.4.1.1 IoT network with monitoring data collection and began edits on...

Manufacturer's technical documentation may benefit fromn including or refering to these use cases and to security profiles.

An NMS is a product controlling at least partially connected devices with network access. Despite its central positioning, an NMS can be aggregated out of several components, including but not to limited end-to-end management systems, dedicated configuration management systems, or controllers for software-defined networking as described in chapter 1.2.

An NMS is a product controlling at least partially connected devices with network access. Despite its central positioning, an NMS can be an aggregate of several components, including but not limited to: end-to-end management systems, dedicated configuration management systems, or controllers for software-defined networking as described in chapter 1.2.

An aggregated NMS implements further components for operation that are out of scope of the present standards. One example of this type of aggregate product design would an implementation where the operating system acts as abstraction layer for the system(s) that host the NMS, or special networking interfaces.

An aggregated NMS can implement additional components for functions that are outside the scope of the present standards. One example of this type of aggregate product design would an implementation where the operating system acts as abstraction layer for the system(s) that host the NMS, or special networking interfaces.

### 4.4.1 Distributed deployment

![Figure 4.4.1.1-1: IoT network with monitoring data collection](./media/2025-08-10_iot.drawio.png)

**Figure 4.4.1.1-1: IoT network with monitoring data collection**

An IoT network is a network of devices, each of which almost always has limited computational capabilities and consumes a low amount of power. The exact purpose of these device varies, but they are all connected to an NMS, and often to each other and to an IoT buisness logic, which may be a RDPS. The main focus of an IoT network is almost always data collection, and the NMS in this use case usually visualises the collected data metrics and provides them to the end-user. The NMS-analysis of the data metrics can be automated, including triggering warnings, alarms, or even taking actions based on discovered abnormal events. 

The main focus of an IoT network is often data collection, whereas the NMS usually visualises the collected data metrics to the end-user. The NMS-analysis of the data metrics can be automated including the triggering of warnings, alarms, or even actions based on discovered abnormal events. The IoT device has often limited computational capabilities and consumes a low amount of power.

The NMS controls the configuration of the connected devices, and has a two minimum functions:

The NMS controls the configuration of the connected devices. As a minimum, the NMS maintains

1.  Establishes and maintains a trust-based relation between itself and the devices.

1. an inventory of devices that are part of the managed network,

1. establishes and maintains a trust-based relation between itself and the device.

To initialize a trust-based relationship between this type of network managment system and connected devices, both store credentials, usually in the form of pre-installed keys, identity confirming certificates, or unique serial numbers. These credentials are used during initialisation to create the trusted relationship between the NMS, the devices and, if present, with the IoT device business logic. Credential or key initialisation, and key enrollement or establishment limit the NMS's ability to establish a trusted relationship to the intended devices, an ability further limnited as these methods require physical access or close proximity to the IoT device. For example, an IoT devicve user can pair the IoT device and establish a trust-based relationship with the NMS through Bluetooth (tm) mechanisms or with a physical cable connection.

The latter can be used for secured identification, authentication and communication with other applications on the device.

The NMS collects the meta traffic data and management related data from the devices, or forwards those to other systems for data collection and storage.

All transmitted data from the devices to the NMS and vice versa is cryptographically protected with authentication of the endpoints, and with integrity and confidentiality protection.

In dependency of the host system capabilities, the NMS can also be remote accessible.

Once the trust-based relationship has been established, the NMS can provide cryptographically protected configuration and update services to the devices at runtime. Depending on the initial NMS and managed element configurations, the device can either request its configuration from the NMS, or the NMS can push the configuration to the device. The trust-based relation can also provide for secured identification, authentication, and communication with other applications on a device.

The NMS’s and the devices can store pre-installed keys, identity confirming certificates, or unique serial numbers. These credentials serve for the initialisation of the trusted relationship between the NMS, the devices and, if applicable, with the IoT device business logic.

The establishment of a trusted relationship requires key initialisation respectively key enrolment or establishment. That requires physical access or proximity to the IoT device. The user can pair the IoT device with the NMS with Bluetooth mechanisms or with a physical cable connection.

The IoT network NMS collects the meta traffic data and management related data from networked devices, or forwards it to other systems for data collection and storage. All data transmitted from the devices to the NMS and all data transmitted from the NMS to the devices is cryptographically protected with authentication of the endpoints, and with integrity and confidentiality protection. Independent of any of the host system's capabilities, the NMS can also be remotely accessible.

Once the trusted relationship has been established, the NMS can provide cryptographically protected configuration and update services to the devices at runtime. Depending on the initial NMS and managed element configurations, the device can either request its configuration from the NMS, or the NMS can push the configuration to the device.

2.  Generates and maintains an inventory of devices that are part of the managed network,

One of the NMS minimum functions is generating, keeping and maintaining a network inventory. New devices extent the inventory and the NMS holds information about the connectivity capabilities for each connected device.

The second primary function of an IoT network NMS is to generate, keep, and maintain a network inventory. This inventory holds information about the connectivity capabilities for each connected device. When new devices are added and a trust-based relationship is established with them, they extend the network and the inventory is amended.

Users of the IoT device business logic or of the managed element interacting with each other, or with the NMS are protected from unauthorised access. Malicious impact on these communication channels, such as interception, interruption, or inducing data packets are detected and form an event that is recorded, and if applicable reported.

Users of the IoT device business logic or of managed elements are protected from unauthorised access when interacting with each other or with the NMS. Malicious impact on these communication channels, such as interception, interruption, or inducing data packets is detected and the system creates an event that is recorded, and if applicable, reported.

The above given example architecture of figure 3 can serve as explanation help during the conformity assessment to meet CRA [\[i.1\]](#_ref_i.1) Annex I part 1.

**Figure 4.4.1.2-1: Home network deployment**

The access point is a device that is physically deployed to the service requesting users home.

It is a router, switch, modem, wireless or wired device that is controlled and governed by a NMS.

The access point provides connectivity for the home making the upstream connection technology transparent for the user.

In this use case, connectivity for the user's home is provided by an access point mkaing the upstream connection technology transparent to the user. Access points are devices such as a router, switch, modem, or other wireless or wired device controlled and governed by the NMS and physically deployed to the service requesting user's home.

The NMS is either local to the device, runing on a different device within the same network, or a RDPS.

The NMS is either locally installed on the access point device, running on a different device within the same network, or a RDPS. All varities of home deployment 

The local access point can serve multiple devices in the same network and provide supporting services like DHCP and DNS caching.

The local access point can serve multiple devices in the same network and provide supporting services like DHCP and DNS caching. The minimum of supporting services 

Provided supporting services can be bare minimum, but they can include remote connectivity options like VPN server depending on the product.

The device actively sends metrics towards the NMS where from the user can perceive the operation of the device and can control the configuration which is set to the device.