Security Basics for Connected (IoT) Products

Why the rules arrived

Connected products sit in homes and offices for years, often with little attention from their owners. The European Commission's Cyber Resilience Act page names the two problems the law targets: an inadequate level of cybersecurity in many products, and a lack of timely security updates. The FCC makes the same point for the US, noting that smart products such as door locks, alarms and baby monitors can be open to a range of security vulnerabilities.

The three regimes below differ in detail, but they share a core: no weak default passwords, a way for people to report security problems, security updates for a stated period, and clear information for the buyer.

UK: the PSTI product security regime

The UK's product security regime came into effect on 29 April 2024. It is made up of Part 1 of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022 and the PSTI (Security Requirements for Relevant Connectable Products) Regulations 2023. Its duties apply to the manufacturers, importers and distributors of consumer connectable, or "smart", products. A product is in scope if it can connect to the internet or a network and is not on the list of excepted products in schedule 3 to the Regulations, so check that list first.

GOV.UK sets out three security requirements:

• Passwords. Each password must be unique per product or set by the user. A unique password must not be based on incremental counters, publicly available information or, unless properly encrypted or hashed, a serial number or other identifier, and must not be otherwise easily guessable.
• Reporting security issues. The manufacturer must publish how to report security issues to them, and how soon the person reporting can expect an acknowledgement and status updates until the issue is resolved. This must be available in English, free of charge, without anyone having to ask for it.
• Minimum security update period. The manufacturer must publish the minimum length of time security updates will be provided, with an end date, in a way a reader without technical knowledge can understand.

Manufacturers must also produce a statement of compliance that accompanies the product, and importers and distributors must not make a product available without one. GOV.UK notes that the Act does not require it to be physical, so it could be digital. The Office for Product Safety and Standards (OPSS) enforces the regime.

ETSI EN 303 645: the common baseline

The European standard ETSI EN 303 645 (V3.1.3, 2024) sets a baseline for consumer IoT security, and GOV.UK lists it among the resources for PSTI compliance. The UK's three requirements match some of its provisions. It goes further, covering, among other things:

• keeping software updatable, with the device checking that each update delivered over a network is authentic before installing it;
• securely storing sensitive security parameters such as keys;
• communicating securely and protecting personal data;
• keeping the attack surface small, for example by switching off unused interfaces;
• making it easy for users to delete their data.

Even where it is not required by law, working to this standard from the design stage is a sensible starting point, because the newer laws ask for many of the same things.

EU: the Cyber Resilience Act

Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), is much wider than the UK law. It covers "products with digital elements": hardware and software products, including components sold separately, whose intended or reasonably foreseeable use includes a data connection to a device or network. The definition also includes the product's remote data processing, meaning software the manufacturer is responsible for that runs at a distance and without which the product could not perform one of its functions.

The dates, from the Commission's summary:

• 10 December 2024: the CRA entered into force.
• 11 June 2026: the rules on notifying conformity assessment bodies apply.
• 11 September 2026: the reporting obligations in Article 14 apply, including for products already on the market.
• 11 December 2027: the regulation is fully applicable.

The Commission's page for manufacturers describes the steps. Before sale, carry out a cybersecurity risk assessment, meet the essential requirements in Annex I, document how, and complete a conformity assessment. Most products can use self-assessment. Some "important" and "critical" products need a third-party assessment by a notified body or, where available, a European certification scheme. Then affix the CE marking, issue a declaration of conformity, and state the support period: the end date, including month and year, must be clear at the time of purchase. After sale, handle vulnerabilities for the whole support period.

Reporting is the part already in force. A manufacturer that becomes aware of an actively exploited vulnerability or a severe incident affecting the product's security must notify the national CSIRT and ENISA: an early warning within 24 hours, the main notification within 72 hours, and a final report within 14 days of a fix being available (for vulnerabilities) or within one month (for severe incidents).

US: the Cyber Trust Mark

The U.S. Cyber Trust Mark is a voluntary FCC labelling programme for wireless consumer IoT products, based largely on criteria from NIST. The FCC adopted the rules for its framework in March 2024. Products that qualify carry the logo with a QR code linking to a registry of security details, such as the support period and whether updates are automatic. Testing is by accredited labs, with approved third-party administrators handling applications. Medical devices, vehicles, wired devices and industrial or enterprise products are outside it. The FCC describes the programme as still being set up, so check its page for the current status before planning around it.

What it means for the app and the cloud

Most connected products are used through a phone app and a cloud service. Under the CRA, remote data processing the product needs is part of the product, so the backend and the app are not a separate question. In practice:

• Updates need a pipeline. Plan signed over-the-air firmware updates from the first prototype, and a way to update the app and the server together. Our guide to connecting a device to a mobile app covers how devices and apps talk.
• The support period is a commitment. The date you publish has to be met for the device, the app and the server. Phone apps also need regular work to stay in the stores; see mobile app maintenance.
• Setup is where passwords go wrong. Onboarding should create a unique credential per device or have the user set one, never a shared default.
• Someone must own vulnerability reports. Publish a security contact, decide who reads it, and know how you would meet a 24-hour early warning.

A practical checklist

• List the markets you sell in and check whether your product is in scope of each regime, including the UK's excepted products.
• No universal default passwords: unique per device or set by the user.
• A public page explaining how to report security issues, with response timescales.
• A published support period with an end date, which you have planned and budgeted to meet.
• Signed, verified firmware updates and a tested way to ship them.
• A statement of compliance for the UK; for the EU, the risk assessment, technical documentation, declaration of conformity and CE marking.
• A named owner and process for CRA incident and vulnerability reporting.
• Design reviewed against ETSI EN 303 645.

Frequently asked questions

Does the UK PSTI law apply to my product?

It applies to consumer connectable products that can connect to the internet or a network, unless the product is on the list of excepted products in schedule 3 to the 2023 Regulations. The duties fall on manufacturers, importers and distributors. Check the GOV.UK guidance and the Regulations for your specific product.

When does the EU Cyber Resilience Act apply?

It entered into force on 10 December 2024. Its reporting obligations have applied since 11 September 2026, and it becomes fully applicable on 11 December 2027.

Does the Cyber Resilience Act cover apps and cloud services?

Software products are in scope, and so is a product's remote data processing: software the manufacturer is responsible for, running at a distance, without which the product could not perform one of its functions.

Is the US Cyber Trust Mark mandatory?

No. It is a voluntary FCC labelling programme for wireless consumer IoT products, but products that take part must follow the programme's requirements.

Is this guide legal advice?

No. It summarises official sources as checked on 30 October 2026. Confirm how the rules apply to your product with the official texts or a qualified adviser.

Building a connected product? We design the device connectivity, the cloud and the apps as one system. See our IoT product development and mobile app development services, or email info@creahive.com.