Many companies focus on the EU CRA and the UK PSTI but overlook a regulation that has been in force for years and directly affects the US market: California Senate Bill No. 327, Information privacy: connected devices. It is one of the earliest state-level laws in the United States to impose mandatory cybersecurity requirements on connected devices. For companies exporting smart devices to the United States, SB-327 is no longer a trend but a present obligation.

When does SB-327 apply?

SB-327 was signed into law on 28 September 2018 and took effect on 1 January 2020.

In other words, since 2020 connected devices sold in California have had to meet the requirements.

California is one of the largest consumer markets in the United States, and its rules often set the direction for the whole country.

Many retailers, distributors and brand customers also use the regulation as a reference when requiring suppliers to improve product security.

What SB-327 requires

The core requirement of SB-327 is clear:

Manufacturers must equip connected devices with reasonable security features

That is, devices must have security appropriate to their function, the type of information they collect and the environment in which they are used.

This means security must be considered at the design stage rather than fixed reactively after launch.

Key requirements

1. Default password management

Where a device can be accessed from outside the network, it must meet one of the following:

· Each device is pre-programmed with a unique password; or

· The user is forced to set a new password at first use.

A universal default password shared by all devices, such as admin/admin, is prohibited.

2. Prevention of unauthorised access

Devices must have reasonable measures to reduce the risk of unlawful access, control or exploitation, for example:

· Authentication mechanisms;

· Access control;

· Secure configuration management.

3. Security design matched to product risk

Different products have different requirements, for example:

· Cameras need particular attention to remote access security;

· Routers need particular attention to management port security;

· Door locks need particular attention to control permissions and authentication.

Why companies cannot ignore SB-327

Many companies assume that "this is only a California rule and does not matter much". In practice:

1. California is a very large market

Mainstream US channels, platforms and brand customers attach great importance to California law.

2. Customer audits are increasingly common

Buyers will ask about:

· Whether default passwords exist;

· Whether security testing has been done;

· Whether a vulnerability response mechanism exists.

3. SB-327 points the same way as other regimes

· The UK PSTI;

· Australia's Cybersecurity Rules;

· The EU CRA.

The underlying logic in each case is moving security design upstream.

What services can an information security laboratory provide?

For products exported to the United States we provide:

1. SB-327 compliance assessment

Identifying whether a product has:

· Default password risk;

· Weak authentication mechanisms;

· Defective update mechanisms;

· Unauthorised access risk.

2. Security testing

· Firmware security analysis;

· App security testing;

· Wi-Fi and Bluetooth security testing;

· Cloud interface and API testing;

· Penetration testing.

3. Remediation consulting

Helping development teams quickly implement:

· Unique password mechanisms;

· Forced password change at first login;

· Secure update mechanisms;

· Improved permission control.

Why act now?

SB-327 essentially requires connected devices to carry basic security responsibility.

Whoever completes the security upgrade first will find it easier to enter the US market.

If your products involve smart home devices, cameras or door locks, routers, consumer electronics or app-connected devices, contact NTEK Information Security Laboratory for product pre-assessment and security testing.

Let compliance win orders rather than block shipments.