Security support period
The minimum time, ideally stated as an end date, during which a manufacturer commits to fix vulnerabilities and ship security updates for a connected product.
Photo: Towfiqu barbhuiya / Unsplash
A security support period is the manufacturer’s promise of how long a product will keep receiving security fixes, typically delivered as over-the-air updates. It is separate from the warranty, which covers defects in the goods, and from any promise to keep a cloud service or app running. Once the period ends, newly found vulnerabilities stay open, so the date is a practical replacement point in the device lifecycle.
Regulators now require it to be stated. The UK PSTI regime obliges manufacturers of consumer connectable products to publish a support period with an end date, which can be extended but not shortened. The EU Cyber Resilience Act sets a minimum of five years, or the expected time in use if shorter, and requires the end date to be shown at the time of purchase. The U.S. Cyber Trust Mark registry is designed to display it as well. When comparing statements, check whether a date or a duration is given, what it covers and when the clock starts. The IoT security regulation guide explains each regime.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.