The product security part of the PSTI Act, in force through its accompanying regulations, requires manufacturers, importers and distributors of consumer connectable products to meet three baseline requirements drawn from ETSI EN 303 645: no universal default credentials, a published point of contact for vulnerability disclosure, and transparency about the minimum period during which security updates will be provided. Each product needs a statement of compliance before sale.
The regime is deliberately narrow and enforceable rather than comprehensive, and it targets the failures behind botnets such as Mirai. It is a useful first step for any vendor, since meeting it also covers part of the EU’s broader Cyber Resilience Act. See IoT security regulation.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.