From today, the Product Security and Telecommunications Infrastructure (PSTI) Act 2022 and the PSTI (Security Requirements for Relevant Connectable Products) Regulations 2023 apply.
Manufacturers, importers and distributors of consumer connectable products (such as smart TVs, cameras, speakers and other IoT devices) must ensure that:
- There are no universal default passwords.
- A vulnerability disclosure policy is published.
- The minimum security update period is stated clearly to customers.
The requirements align with the ETSI EN 303 645 standard for consumer IoT security. Organisations should also consider these requirements when procuring connected devices for business use.
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
