UL 2900
A series of standards from UL for testing the cybersecurity of network-connectable products, with specific parts for industrial systems and healthcare devices.
UL 2900 defines a process for evaluating the software security of connected products rather than their electrical safety. The general part sets requirements such as documented software components, absence of known vulnerabilities, protection of stored and transmitted data and resistance to malformed input, and it specifies the testing used to verify them, including fuzzing and penetration testing. Separate parts tailor the requirements to industrial control systems and to medical IoT devices.
Certification is voluntary, which is both its strength and its limit. Hospitals and some regulators have accepted it as evidence of due diligence for medical devices, and it predates many government schemes. However, it is a point-in-time assessment, so manufacturers still need ongoing vulnerability management, a maintained software bill of materials and an update process. It sits alongside IEC 62443 in the industrial space rather than replacing it.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.