For two decades, the security of a connected product was whatever its maker decided, and the market rewarded speed and price over patching. The botnets that followed, and the steady stream of cameras, routers and toys found with hard-coded passwords, changed the regulators’ minds. Today a product sold in the EU, the UK or the U.S. faces security obligations that are either mandatory or commercially hard to ignore.
The four frameworks that matter most to IoT teams are the EU Cyber Resilience Act, the UK PSTI Act regime, the U.S. Cyber Trust Mark, and the baseline standard ETSI EN 303 645 that the other three lean on. This guide explains what each asks for, who it applies to, and what a product team should do. It is an engineering overview, not legal advice.
ETSI EN 303 645: the common baseline
Start with the standard, because the laws reference it. ETSI EN 303 645, first published in 2020 and revised since, defines a baseline for consumer IoT security in 13 provisions. The headline items are:
- No universal default credentials: each device gets a unique password, or the user must set one, and it must resist brute force.
- A published way to report vulnerabilities, with timely handling, which is the formal vulnerability disclosure process.
- Software updates: delivered securely, verified before installation, and provided for a stated support period that the buyer can see before purchase.
- Secure storage of keys and credentials, secure communication, and a minimized attack surface (no unused ports, no unnecessary services, hardened debug interfaces).
- Software integrity checks such as secure boot, resilience to network outages, input validation, and simple ways for users to delete their data.
A companion specification, ETSI TS 103 701, describes how test labs assess a product against these provisions. The standard is written for consumer devices but is widely applied to commercial products as well. If your product meets EN 303 645, you have done most of the technical work the laws below require.
UK: the PSTI regime
The Product Security and Telecommunications Infrastructure Act 2022, with its regulations in force since April 2024, makes a subset of EN 303 645 legally mandatory for consumer connectable products sold in the UK. Three requirements apply:
- No universal default passwords.
- A published point of contact and policy for reporting security issues.
- A published minimum period during which the product will receive security updates.
Manufacturers must produce a statement of compliance, and importers and distributors must not sell products without one. The regime is enforced by the Office for Product Safety and Standards, with penalties scaled to company revenue. It is deliberately narrow, but it applies to products made anywhere in the world if they reach UK consumers.
EU: the Cyber Resilience Act
The CRA is the broadest of the four. It is a horizontal regulation covering “products with digital elements,” which means almost any hardware or software with a network connection, consumer or industrial, from a smart bulb to a PLC to a software library sold commercially. It entered into force in December 2024, with vulnerability reporting obligations applying from September 2026 and the full set of requirements from December 2027.
The core idea is to extend the CE marking model, already familiar from safety and radio rules, to cybersecurity. To affix the CE mark, a manufacturer must:
- Design the product according to essential cybersecurity requirements: secure by default, no known exploitable vulnerabilities at release, unique identities, access control, encryption of data in transit and at rest where appropriate, minimized attack surface, and resilience.
- Run a vulnerability handling process for a support period that reflects the expected lifetime of the product, with a general minimum of five years. This includes maintaining a software bill of materials of at least the top-level dependencies, providing security updates free of charge, and publishing fixed vulnerabilities.
- Report actively exploited vulnerabilities and severe incidents to the designated authorities, with an early warning within 24 hours and a fuller notification within 72 hours.
- Carry out a conformity assessment. Most products can self-assess. Products in the “important” and “critical” classes, which include operating systems, routers, firewalls and certain industrial and smart meter components, face stricter routes involving harmonized standards or third-party assessment.
The CRA also places duties on importers and distributors and covers open-source software placed on the market commercially, with lighter treatment for non-commercial stewards. Harmonized standards giving presumption of conformity are still being developed, and EN 303 645 is expected to be one of the references for consumer devices.
U.S.: the Cyber Trust Mark
The U.S. approach is a voluntary label rather than a mandate. The FCC approved the Cyber Trust Mark program in 2024 as a shield logo that consumer products can carry after being tested against criteria derived from NIST IR 8425, the agency’s consumer IoT product profile. The logo is paired with a QR code that leads to a registry page showing the support period, update policy and related information.
The technical criteria cover familiar ground: asset identification, product configuration, data protection, interface access control, software updates and cybersecurity state awareness, plus documentation and disclosure obligations on the maker. Testing is handled by accredited labs. Because the mark is voluntary, its force comes from retailers and government procurement favoring labeled products. Separately, several U.S. states have their own IoT security laws, with California’s rule against default passwords the best known.
Industrial products
Consumer frameworks are not the whole story. Industrial and critical-infrastructure devices are assessed against IEC 62443, the series that defines security levels for components, systems and the organizations that build and operate them. Operators under the EU’s NIS2 directive increasingly demand 62443-aligned components from suppliers, so a device maker selling into factories, utilities or buildings should expect to show 62443-4-1 (secure development process) and 62443-4-2 (component requirements) evidence alongside CRA conformity.
What a product team should do
The regimes overlap heavily, so one program covers most of them:
- Build to EN 303 645 and, for industrial products, IEC 62443-4-2. This covers the UK requirements and most of the CRA’s essential requirements.
- Decide and publish a support period before launch, and budget the engineering to deliver OTA updates through it. This decision drives PSTI, CRA and Cyber Trust Mark compliance.
- Maintain an SBOM from the first build. Retrofitting one onto a shipped product is painful.
- Set up a vulnerability disclosure policy with a monitored contact, and a process to triage and report under the CRA’s deadlines.
- Classify your product under the CRA early. The assessment route and the documentation burden differ enough between default, important and critical that it affects schedule.
- Keep conformity evidence, test reports and the technical file organized; regulators and large customers will ask for them.
None of this is exotic engineering. It is the discipline described in IoT security fundamentals, now with a deadline.
Where to go next
- IoT security fundamentals covers the threats these rules are meant to address.
- Device identity, certificates and PKI for IoT explains the unique-identity requirement in practice.
- Device management and over-the-air updates is the capability every one of these regimes assumes you have.
Topics: regulation, Cyber Resilience Act, PSTI, Cyber Trust Mark, ETSI EN 303 645, compliance