UK PSTI Security Requirements for Connectable Products

The UK Product Security and Telecommunications Infrastructure (PSTI) regime sets security requirements for connectable products in the United Kingdom. It came into force on April 29, 2024. Its aim is to make Internet of Things (IoT) products more secure and to protect consumers from cyberattacks.

Contents

1. Legal basis of the PSTI regime
2. Which products the PSTI regime covers
3. Security requirements
4. Deemed compliance through standards
5. Statement of compliance
6. Obligations of importers and distributors
7. What the PSTI regime means for manufacturers

Legal basis of the PSTI regime

The rules on the security of consumer connectable products in the United Kingdom rest on two main pieces of legislation:

1. Part 1 of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022
2. The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023

The PSTI Act received Royal Assent in December 2022. The full draft of the regulations was published in April 2023. The regulations were made on September 14, 2023, and came into force on April 29, 2024.

Which products the PSTI regime covers

The PSTI regime applies to “relevant connectable products” made available to consumers in the United Kingdom. The scope covers:

• Internet-connectable products: devices that can connect to the internet.
• Network-connectable products: devices that:
  • can send and receive data by electrical or electromagnetic means,
  • are not connected directly to the internet, and
  • can either connect directly to an internet-connectable device or be connected to several devices at the same time.

Some product categories are exempt from the requirements:

• Products for Northern Ireland: products intended for supply in Northern Ireland that fall under certain EU legislation listed in the Windsor Framework.
• Charge points for electric vehicles: charge points covered by the Electric Vehicles (Smart Charge Points) Regulations 2021.
• Medical devices: products subject to the Medical Devices Regulations 2002. This exemption does not apply to connectable products that merely have software installed that falls under these regulations.
• Smart meter products: products supplied or installed by licensed smart meter communication service providers or electricity suppliers. They must have been certified under a security scheme, such as the Commercial Product Assurance scheme of the National Cyber Security Centre.
• Computers: desktop computers, laptop computers, and tablet computers without cellular connectivity are exempt. This exemption does not apply to computers that the manufacturer states are designed exclusively for children under 14.

These exemptions take existing sector-specific rules into account and avoid double regulation. They also reflect the regime's focus on consumer products and IoT devices, while specialized or already regulated products stay outside it.

Security requirements

The PSTI regime sets three areas of security requirements.

Passwords:

• Passwords must be unique per product or defined by the user.
• They must not be based on incremental counters or publicly available information.
• They must not be easy to guess.

Reporting security issues:

• Manufacturers must publish at least one point of contact for reporting security issues.
• They must provide information on when reports will be acknowledged and on status updates.

Minimum security update period:

• Manufacturers must publish the defined support period for security updates.
• This information must be clear, transparent, and accessible free of charge.

Deemed compliance through standards

The regulations allow manufacturers to demonstrate compliance by meeting certain recognized standards:

• ETSI EN 303 645: a European standard on consumer IoT security
• ISO/IEC 29147: an international standard on vulnerability disclosure

Meeting these standards counts as meeting the corresponding PSTI requirements, provided certain additional conditions are met.

Statement of compliance

The PSTI regime relies on self-declaration by manufacturers, who must issue a formal statement of compliance. The statement must contain at least the following information:

1. The product (type and batch)
2. The name and address of each manufacturer of the product and, where applicable, of each authorized representative
3. A declaration that the statement of compliance has been prepared by or on behalf of the manufacturer
4. A declaration that, in the manufacturer's opinion, the manufacturer has either:
   • complied with the applicable security requirements, or
   • met the conditions for deemed compliance (that is, applied the standards listed above)
5. The defined support period for the product, as it stood when the manufacturer first supplied the product
6. The signature, name, and function of the signatory
7. The place and date of issue of the statement of compliance

If the manufacturer relies on compliance with standards, the statement must also give the identification number, version, and date of issue of those standards.

Obligations of importers and distributors

The PSTI Act 2022 also places obligations on importers and distributors (Part 1, sections 14 to 25). They may only make a product available in the UK if it meets the security requirements and comes with a statement of compliance or a summary of it. If they learn of a compliance failure by the manufacturer, they must not supply the product further and must, among other things, notify the enforcement authority. Importers must also investigate potential compliance failures and keep records of these investigations.

What the PSTI regime means for manufacturers

The UK PSTI regime is a significant step toward better IoT security. It sets clear requirements for manufacturers and gives consumers more transparency. Implementation may be demanding for some companies, but the long-term benefit for cybersecurity is clear.

If you sell in the UK market or plan to, you must comply with the PSTI regime. Adapting your product development and documentation early can give you a competitive advantage and strengthen consumer trust.