图片名称

UK Cybersecurity PSTI

Author.

LCS

Source:

Post time:

2025-02-11

Policy paper

UK Product Safety and Telecommunications Infrastructure (Product Safety) Regulations

The UK's consumer accessible product safety regulations will come into effect on April 29, 2024.

Related policy website link: https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime

Related policy documents:

Product Safety and Telecommunications Infrastructure Act of 2022- Part 1

https://www.legislation.gov.uk/ukpga/2022/46/part/1/enacted

Explanatory notes related to the 2022 Product Safety and Telecommunications Infrastructure Law

https://www.legislation.gov.uk/ukpga/2022/46/notes/division/1/index.htm

Product Security and Telecommunications Infrastructure (Regulations on Connected Product Security) Regulations 2023

https://www.legislation.gov.uk/uksi/2023/1007/contents/made

Memorandum of Interpretation on the 2023 Product Security and Telecommunications Infrastructure (Regulations on Connecting Product Security) Regulations

https://www.legislation.gov.uk/uksi/2023/1007/pdfs/uksiem_20231007_en_001.pdf

ETSI EN 303 645: Consumer IoT Network Security: Benchmark Requirements

https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02.01.01_60/en_303645v020101p.pdf

The law now requires manufacturers of connected products (or "smart" products) to comply with the relevant obligations under the law, including ensuring that they and their products meet the minimum safety requirements.

This system consists of two pieces of legislation:
*Decree No. 2022 on Product Safety and Telecommunications Infrastructure Part 1 (PSTI);
*Regulations on Product Safety and Telecommunications Infrastructure (Security Requirements for Related Connectable Products) in 2023.

The PSTI Act was approved in December 2022. The government released a complete draft of the PSTI (Safety Requirements for Connected Products) Regulations in April 2023. These regulations were signed into law on September 14, 2023. Emphasis was placed on the key terms that companies should consider when seeking compliance with the system.

Related connectable products

The bill stipulates the conditions under which relevant personnel must fulfill specific obligations. If these conditions or responsibilities themselves are related to 'related connectable products', then Article 4 of the Act provides a definition for that term. If the product is an Internet connection product or a network connection product, the product is a relevant connectable product, not an "exceptional product".

Therefore, manufacturers seeking to determine whether a product is a "relevant connectable product" should review the definitions of "Internet connectable product" and "network connectable product" in Article 5 of the Act, as well as the products designated as "exceptional products" in Schedule 3 of the Regulations.

Security requirements

Security requirements are actions that must be taken by relevant businesses in the supply chain, and "related connectable products" must be met to address security issues or eliminate potential security vulnerabilities.

Schedule 1 of the 2023 regulations lists specific requirements that must be complied with in relation to "related connectable products".

1. Password
The password for each product must be unique; Or it can be defined by the user of the product.

Further provisions are made in paragraph 1 (3) of Schedule 1 of the Regulation regarding the unique password for each product. They cannot be based on incremental counters; Based on or derived from publicly available information; Based on or derived from a unique product identifier, such as a serial number, unless completed using encryption methods or key hashing algorithms, which is a recognized good industry practice; Otherwise, it's easy to guess.

2. Information on how to disclose vulnerability security issues

Manufacturers must provide information on how to disclose information about their product vulnerability security issues to them, implement a method to manage vulnerability reports, implement vulnerability disclosure policies, and provide information on the length of time for receiving confirmation and status updates of vulnerability security issues until the disclosed vulnerability security issues are resolved.

This method should be provided for free in English and be accessible, clear, and transparent.
3. Information about the minimum security update period
Information regarding the minimum security update period must be disclosed and provided to consumers in an accessible, clear, and transparent manner. The minimum duration and end date for security updates must be provided.

Declaration of Conformity

The Product Safety and Telecommunications Infrastructure Act 2022 stipulates that a Statement of Conformity (SoC) must accompany the product and define SoC as a "document".

The bill does not define the terms' document 'or' attachment ', so each enterprise within the scope of the system must determine how they will comply with the requirements related to' related connectable products'. Manufacturers, importers, and distributors must ultimately ensure that their products comply with the PSTI Act.

Standard references

 

Network Security Summary

Lixun Testing has professional network security compliance services and product testing capabilities, providing you with one-stop network security testing and certification services.

Media Center

Latest News

Contact Us

图片名称
图片名称

National 24-hour service hotline

400-116-2629

Group Headquarters

Cell phone:18126505465

E-mail: webmaster@lcs-cert.com

Address: Shenzhen City, Baoan District, Shajing Street, Nga side of the school of Wei Juji Industrial Park, Building A 1 ~ 2 floor, Building C 3 floor