With IoT device security attracting sustained global attention, the UK government has formally brought the Product Security and Telecommunications Infrastructure Act (PSTI) into effect. This marks the point at which cybersecurity for consumer connected devices formally enters a phase of mandatory compliance.

Key dates and facts

· Name: PSTI (Product Security and Telecommunications Infrastructure Act);

· Mandatory application: 29 April 2024;

· Market: United Kingdom;

· Regulator: UK government, Department for Science, Innovation and Technology.

The regime is now in its enforcement phase and is no longer a set of recommendations.

Product scope

The PSTI applies to all internet-connectable consumer devices, including but not limited to:

· Smart cameras (CCTV and IP cameras);

· Smart home devices (locks, plugs, lighting controls);

· Routers and gateways;

· Smart home appliances;

· Wearable devices;

· IoT control terminals.

The key criterion is whether the device can connect to the internet (Wi-Fi, Ethernet, cellular and so on).

Three mandatory security principles

The requirements currently enforced under the PSTI are the three core requirements drawn from ETSI EN 303 645.

1. No default weak passwords

· Universal default passwords (such as admin/admin) are not permitted;

· Devices must support unique credentials or a user-defined password.

2. Vulnerability disclosure mechanism

· A channel for reporting security vulnerabilities must be provided;

· Response times must be stated (for example, acknowledgement within 72 hours);

· The progress of vulnerability handling must be tracked.

3. Transparent security update mechanism

· Manufacturers must state whether security updates are provided and the support period;

· This information must be clearly visible to consumers.

Mandatory manufacturer obligations

Manufacturers must provide a Declaration of Conformity setting out:

· The support period;

· The update policy;

· The vulnerability handling process.

Failure to provide it is treated as placing the product on the market unlawfully.

Risk of non-compliance

The UK regulator has enforcement powers to:

· Require products to be withdrawn from the market;

· Impose substantial fines, up to 4 percent of worldwide turnover;

· Issue market notifications, which damage brand reputation.

How companies should respond

As an information security laboratory, we recommend that companies act at three levels.

1. Product level

· Adopt security by design;

· Implement authentication and encrypted communication such as TLS;

· Eliminate hard-coded credentials.

2. Process level

· Establish a vulnerability response mechanism (PSIRT);

· Define the security support period;

· Produce the compliance declaration documents.

3. Testing and certification

Carry out testing and verification against ETSI EN 303 645.

How we can help

As a specialist information security laboratory, we can help companies complete the following quickly:

· PSTI regulatory gap analysis;

· ETSI EN 303 645 testing and assessment;

· Security documentation, including the DoC and security statement;

· Penetration testing and vulnerability verification;

· One-stop compliance with global regimes such as the PSTI, CRA and California SB-327.

The PSTI is not only a UK regulation; it is a snapshot of the global trend in IoT security supervision.

Compliance is no longer a choice but a precondition for market access.

If your products are exported to the UK or to global markets, we recommend starting security compliance planning as early as possible.