Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{189606,
        author = {Adeel Sadaqat},
        title = {Secure Onboarding & Zero-Touch Provisioning for Millions of Smart City Devices with Compliance Mapping to Saudi Smart-City Guidance: A Systematic Review (2020–2025)},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {8},
        pages = {257-269},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=189606},
        abstract = {Saudi smart city schemes involve the use of cyber-physical systems on a massive scale, such as environmental sensors, smart meters, intelligent transport endpoints, and video analytics cameras installed all over the city. With a potential increase from thousands to millions of units per fleet, the viable approach of manually enrolling units (performing credential injection, site-by-site configuration, and ad-hoc authorization decisions) becomes implausible from the standpoint of operational feasibility and/or security risks. This systematic review integrates the 2020-2025 peer-reviewed literature with widely accepted standards and regulative control frameworks relating to secure enrollment procedures of massive numbers of IoT devices. The literary sources cover voucher-based bootstrap and transfer-of-ownership provisioning, device management bootstraps, remote attestation frameworks and token structures, firmware update frameworks, and policy-based authorization according to the principles of the Zero Trust Architecture. From these sources, we extract four primitives described below for modern-day enrollment: (P1) device-anchored identity with protected roots, (P2) ownership transfer w.r.t late binding to limit trusted installers, (P3) posture attestation as a statement w.r.t verifiable evidence, and (P4) policy-based authorization as a least-privilege and purpose-bound directive. We combine the above primitives to form a reference architecture by composition, which is called the Zero-Touch Assurance Stack (Z-TAS). We then align the Z-TAS controls over lifecycles to Saudi smart city best practices, which include NCA Essential Cybersecurity Controls (ECC-2:2024), Cloud Cybersecurity Controls (CCC-2:2024), NDMO data management norms (2021), Saudi Personal Data Protection Law (PDPL, 2023), and CST IoT Regulations (2024). The alignment is useful for forming the basis of a compliance-by-design conclusion that, for Saudi smart cities, trust on-boarding has to be considered as an auditable lifecycle governance process that generates robust evidence artefacts (identity lineage, enrollment data, attestation appraisal results, policy decisions, and data governance markers).},
        keywords = {zero-touch provisioning; secure onboarding; device identity; ownership transfer; remote attestation; Zero Trust; smart cities; Saudi Arabia; ECC; PDPL; NDMO; CST IoT},
        month = {January},
        }