图片名称

Information | Starting from April 29, 2024, the UK is about to enforce the Cybersecurity PSTI Act

Author.

LCS

Source:

Post time:

2024-03-12

According to the Product Safety and Telecommunications Infrastructure Act 2023 issued by the UK on April 29, 2023, the UK will begin enforcing network security requirements for connected consumer devices from April 29, 2024, applicable to England, Scotland, Wales, and Northern Ireland. As of now, it has only been just over 3 months, and major manufacturers exporting to the UK market need to complete PSTI certification as soon as possible to ensure smooth entry into the UK market.
01
The detailed introduction of the PSTI Act is as follows
The UK Consumer Connect Product Safety Policy will take effect and be enforced on April 29, 2024. Starting from this date, the law will require manufacturers of products that can be connected to British consumers to comply with minimum safety requirements. These minimum security requirements are based on the UK Consumer Internet of Things Security Practice Guidelines, the globally leading consumer Internet of Things security standard ETSI EN 303 645, and recommendations from the UK's authoritative body for cyber threat technology, the National Cybersecurity Center. This system will also ensure that other businesses in the supply chain of these products play a role in preventing unsafe consumer goods from being sold to British consumers and businesses.
This system includes two pieces of legislation
Part 1 of the Product Safety and Telecommunications Infrastructure (PSTI) Act 2022
Product Security and Telecommunications Infrastructure (Security Requirements for Related Connected Products) Act 2023
PSTI Act Release and Implementation Timeline
The PSTI bill was approved in December 2022. The government released the complete draft of the PSTI (Safety Requirements for Related Connected Products) bill in April 2023, which was signed into law on September 14, 2023. The consumer connected product safety system will take effect on April 29, 2024.
02
PSTI Act Documents
The UK Product Security and Telecommunications Infrastructure (Product Security) regulation
Website: https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime

2. Product Safety and Telecommunications Infrastructure Act 2022
Product Security and Telecommunications Infrastructure Act 2022
Website: https://www.legislation.gov.uk/ukpga/2022/46/part/1/enacted
3. Product Security and Telecommunications Infrastructure (Security Requirements for Related Connected Products) Act 2023
The Product Security and Telecommunications Infrastructure (Security Requirements for Retired Connected Products) Regulations 2023
Website: https://www.legislation.gov.uk/uksi/2023/1007/contents/made

03
Specific requirements of the UK PSTI Act
The requirements for network security under the PSTI Act are mainly divided into three aspects:
Universal default password security
Weakness Report Management and Execution
Software updates
These requirements can be directly evaluated under the PSTI Act, or evaluated by referencing the network security standard ETSI EN 303 645 for consumer IoT products to demonstrate compliance with the PSTI Act. That is to say, meeting the requirements of the three chapters and projects of the ETSI EN 303 645 standard is equivalent to complying with the requirements of the UK PSTI Act.
The ETSI EN 303 645 standard for the security and privacy of IoT products includes the following 13 categories of requirements:
Universal default password security
Weakness Report Management and Execution
Software updates
Smart safety parameter saving
Communication security
Reduce exposure of attack surface
Protecting personal information
Software Integrity
System anti-interference ability
Check system telemetry data
Convenient for users to delete personal information
Simplify equipment installation and maintenance
Verify input data
PSTI Act and ETSI EN 303 645 Testing Process:

04
How to prove compliance with the UK PTSI Act requirements
The minimum requirement is to meet the three requirements of the PSTI Act regarding passwords, software maintenance cycles, and vulnerability reporting, and provide technical documents such as evaluation reports for these requirements, while also making a self declaration of compliance. We suggest using ETSI EN 303 645 for the evaluation of the UK PSTI Act. This is also the best preparation for the mandatory implementation of the EU CE RED directive's cybersecurity requirements starting from August 1, 2025!

Media Center

Latest News

Contact Us

图片名称
图片名称

National 24-hour service hotline

400-116-2629

Group Headquarters

Cell phone:18126505465

E-mail: webmaster@lcs-cert.com

Address: Shenzhen City, Baoan District, Shajing Street, Nga side of the school of Wei Juji Industrial Park, Building A 1 ~ 2 floor, Building C 3 floor