Cities should govern IoT identity as a lifecycle process, not a one-time setup task. That means every device needs a verified identity, defined ownership, authenticated communications, and a clear retirement path. If any of those steps are missing, connected infrastructure can become trusted long after it should have been removed or replaced.
Why city IoT identity has to be managed as a lifecycle
smart city devices are not static assets. Sensors, cameras, meters, traffic controllers, and environmental monitors are installed, replaced, reassigned, and decommissioned over time, so identity governance has to follow the device from onboarding through retirement. That means cities need a repeatable way to discover devices, assign owners, issue credentials, and remove trust when a device is no longer in service.
Without that lifecycle view, the city can end up trusting devices that are unpatched, unmanaged, or physically gone. Identity is the control plane that lets the city decide which devices are legitimate, which systems they may reach, and when their access should end.
For device identity basics, the strongest starting point is Device and IoT Identity Guide, which covers secure onboarding, device certificates, attestation, and lifecycle trust for connected devices.
What “verified identity, ownership, and authenticated communications” should mean
Verified identity means each device can be distinguished from every other device in a way the city can trust, not just labeled by hostname or asset tag. In practice, that usually requires a cryptographic identity, secure onboarding, and some form of attestation so the city can confirm the device is the one it expects and is running in a trusted state.
Defined ownership is the operational side of the same problem. Every device needs a responsible team, department, vendor, or service owner who can approve enrollment, handle exceptions, and accept retirement decisions. If ownership is vague, devices tend to become orphaned, and orphaned devices are where access drift and stale trust accumulate.
Authenticated communications close the loop by ensuring device traffic is not only connected, but mutually trusted. Cities should prefer device-to-platform authentication that resists credential sharing and makes reuse across devices hard, because insecure shared secrets scale poorly across large deployments. For a broader view of how device identity should be structured, Ultimate Guide to NHIs — What are Non-Human Identities explains the identity types that often sit behind service, application, and device authentication.
How cities should retire trust when devices are replaced or removed
Retirement is not a paperwork step. When a device is replaced, decommissioned, transferred, or permanently offline, its identity, certificates, tokens, credentials, and access paths should be revoked in a way that is traceable and complete. The city should treat retirement as an explicit control point, because abandoned trust is one of the easiest ways for old infrastructure to stay reachable long after its operational life has ended.
Good retirement practice also depends on inventory accuracy. Cities need to know which device identities still exist, which are active, and which have been superseded. If the inventory is incomplete, revocation becomes partial, and partially revoked device trust can still expose networks, APIs, or operational systems.
Lifecycle-oriented operating models help here, especially where large fleets cross departments and vendors. A practical governance path is to align onboarding, ownership, rotation, and offboarding under one process so the city can prove when access started, who approved it, and when it ended. NHI Lifecycle Management Guide is useful for that ownership and offboarding model, and Ultimate Guide to NHIs, Lifecycle Processes for Managing NHIs reinforces the same lifecycle sequence from a governance perspective.
Risk and Threat Considerations
Smart city IoT identity failures create long-lived trust problems. The main risk is not only device compromise, but stale trust: devices that no longer belong, still hold valid credentials, or still look authoritative to the systems that depend on them. At city scale, that can turn a small onboarding mistake into persistent unauthorized access, lateral movement, or hidden exposure across traffic, utilities, facilities, and public-safety systems.
Failure mechanism: A device that was never uniquely enrolled, never properly assigned, or never fully revoked can continue to authenticate after it should have been removed, replaced, or isolated.
Impact: Attackers or negligent operators can abuse that residual trust to keep access alive, impersonate legitimate infrastructure, or create hard-to-detect pathways into operational systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | City devices must lose trust when retired or replaced. |
| NHI-04 — Insecure Authentication | Smart city IoT relies on device authentication for trusted communications. | |
| NHI-07 — Long-Lived Secrets | IoT devices often depend on credentials that outlive ownership changes. | |
| Recommendation — Revoke every device credential and access path at decommissioning. Use strong device authentication and reject shared secrets. Rotate device secrets and certificates on a defined schedule. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Non-Organizational Users) | City IoT devices are non-organizational actors that must authenticate. |
| IA-5 — Authenticator Management | Device credentials and certificates need lifecycle control and revocation. | |
| AC-2 — Account Management | Device ownership and retirement depend on lifecycle governance. | |
| Recommendation — Authenticate each device with unique credentials or certificates. Manage issuance, rotation, and revocation of device authenticators. Track each device identity from enrollment through retirement. | ||
| CIS Controls v8 | 5 — Account Management | Lifecycle control of device identities reduces orphaned access. |
| 6 — Access Control Management | Cities need to remove device access when trust ends. | |
| Recommendation — Maintain an accurate inventory of active device identities. Remove device access promptly when ownership or status changes. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Smart city devices should be continuously verified, not permanently trusted. |
| Recommendation — Continuously verify device trust before granting access. | ||
Practitioner Guidance
What to prioritise: Start with identity inventory, ownership, and retirement, because those are the controls that prevent trusted-but-dead devices from lingering in the environment. If you cannot answer who owns a device, how it was enrolled, and how it will be revoked, the rest of the program will be fragile.
What to verify: Confirm that each device has a unique identity, that communications are authenticated end to end, and that revocation really removes access from every dependent system. Cities often overestimate how well decommissioning works because one certificate or token was revoked, when the device still has another path to be trusted.
Practitioner takeaway: City IoT governance succeeds when identity is treated as a managed lifecycle with clear ownership and enforced retirement, not as a one-time procurement checkbox.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org