Published by ETSI, EN 303 645 groups its provisions under thirteen headings, starting with no universal default passwords, a means to manage vulnerability reports and keeping software updated, and continuing through secure storage of security parameters, secure communication, a minimized attack surface, software integrity, protection of personal data, resilience to outages, examination of telemetry, easy deletion of user data, easy installation and validation of input data. Each provision is marked as mandatory or recommended.
The standard is outcome-based rather than prescriptive, so it applies to a smart bulb and a connected washing machine alike. The UK PSTI Act adopted its first three provisions as law, and labeling schemes in several countries test against it. IoT security regulation explains how it maps to the legal regimes.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.