Under the Product Security and Telecommunications Infrastructure Act 2023, enacted in the United Kingdom on 29 April 2023, the UK will begin enforcing cybersecurity requirements for consumer connectable products from 29 April 2024, applying to England, Scotland, Wales and Northern Ireland. Only a little over three months now remain, and manufacturers exporting to the UK market need to complete PSTI certification as soon as possible to ensure smooth access to the UK market.

1. Detailed introduction to the PSTI regime

The UK consumer connectable product security regime will take effect and be enforced on 29 April 2024. From that date, the law will require manufacturers of UK consumer connectable products to comply with minimum security requirements. These minimum security requirements are based on the UK Code of Practice for Consumer IoT Security, the globally leading consumer IoT security standard ETSI EN 303 645, and the recommendations of the National Cyber Security Centre, the UK's technical authority on cyber threats. The regime will also ensure that other businesses in the supply chain of these products play their part, preventing insecure consumer products from being sold to UK consumers and businesses.

The regime comprises two pieces of legislation:

Part 1 of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022

The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023

Timeline for the publication and implementation of the PSTI regime

The PSTI Act received approval in December 2022. The government published the full draft of the PSTI (Security Requirements for Relevant Connectable Products) Regulations in April 2023, and these were signed into law on 14 September 2023. The consumer connectable product security regime will take effect on 29 April 2024.

2. PSTI documents

1. The UK Product Security and Telecommunications Infrastructure (Product Security) regime

https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime

2. Product Security and Telecommunications Infrastructure Act 2022

https://www.legislation.gov.uk/ukpga/2022/46/part/1/enacted

3. The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023

https://www.legislation.gov.uk/uksi/2023/1007/contents/made

3. Specific requirements of the UK PSTI regime

The cybersecurity requirements of the PSTI regime fall mainly into three areas:

Universal default password security

Vulnerability reporting management and enforcement

Software updates

These requirements can be assessed directly against the PSTI regime, or compliance can be demonstrated by assessment against ETSI EN 303 645, the cybersecurity standard for consumer IoT products. In other words, meeting the requirements of the three sections and provisions of ETSI EN 303 645 is equivalent to complying with the UK PSTI requirements.

ETSI EN 303 645, the standard for IoT product security and privacy, contains the following 13 categories of requirements:

1. Universal default password security

2. Vulnerability reporting management and enforcement

3. Software updates

4. Securely storing sensitive security parameters

5. Communication security

6. Reducing the exposed attack surface

7. Protecting personal data

8. Software integrity

9. Resilience to system outages

10. Examining system telemetry data

11. Making it easy for users to delete personal data

12. Making installation and maintenance easy

13. Validating input data

PSTI and ETSI EN 303 645 testing process:

4. How to demonstrate compliance with the UK PSTI requirements

The minimum requirement is to meet the three PSTI requirements on passwords, the software maintenance period and vulnerability reporting, to provide technical documentation such as an assessment report against these requirements, and to make a statement of conformity. We recommend using ETSI EN 303 645 to assess compliance with the UK PSTI regime. This also lays the best possible groundwork for meeting the cybersecurity requirements of the EU CE RED Directive, which will become mandatory on 1 August 2025.