ETSI EN 303 645: Cybersecurity for Consumer IoT

ETSI EN 303 645 is a European standard that sets baseline security and data protection requirements for consumer Internet of Things (IoT) devices. It was developed by the European Telecommunications Standards Institute (ETSI) in response to the rapid spread of connected devices in everyday life, which makes IoT security a central challenge.

The standard is aimed primarily at manufacturers. It gives them a framework for developing secure IoT products and takes into account the specific needs of different device categories, from smart home applications to connected household appliances.

This page covers the core aspects of ETSI EN 303 645, its significance for the IoT, and how it improves cybersecurity for consumers. It explains the main requirements of the standard and their impact on manufacturers, consumers, and the market for IoT devices.

Contents

1. Purpose and scope of ETSI EN 303 645
2. Main requirements of ETSI EN 303 645
3. Significance and impact of the standard
4. Testing and certification against ETSI EN 303 645
   1. ETSI EN 303 645: Cyber Security for Consumer Internet of Things: Baseline Requirements
   2. ETSI TS 103 701: Cyber Security for Consumer Internet of Things: Conformance Assessment of Baseline Requirements
   3. BSI TR-03173: Amendments for Conformance Assessments (Germany)
5. ETSI EN 303 645 and the Radio Equipment Directive (RED)
6. ETSI EN 303 645 and EN 18031

Purpose and scope of ETSI EN 303 645

ETSI EN 303 645 was developed specifically for manufacturers of IoT devices, to support them in implementing security measures in their products. It applies to consumer IoT devices of all kinds, from smart home products such as thermostats and cameras to connected household appliances. Devices that are not consumer IoT devices, for example those primarily intended for manufacturing, healthcare, or other industrial applications, are not in scope. The main goal of the standard is to minimize security risks and prevent cyberattacks that vulnerabilities in IoT devices could otherwise make possible.

Main requirements of ETSI EN 303 645

The standard contains a wide range of requirements. The main categories include:

1. No universal default passwords: IoT devices must not use default passwords that are easy to guess or the same across devices. Each device should ship with a unique password.
2. Secure communication: All communication channels used by IoT devices must be encrypted to ensure data integrity and confidentiality.
3. Secure software updates: The ability to update software securely is an essential requirement. This includes mechanisms to authenticate updates and to prevent attacks through manipulated software.
4. Storage of personal data: The standard requires that personal data is stored and processed securely to ensure data protection and data security.
5. Vulnerability reporting: Manufacturers must implement a process for reporting and fixing vulnerabilities so that vulnerabilities are addressed efficiently and responsibly.
6. Minimal exposure of services: IoT devices should expose only the services that are strictly necessary, to minimize the risk of attacks.

Significance and impact of the standard

The introduction of ETSI EN 303 645 is an important step toward standardized security requirements for IoT devices. It helps strengthen consumer trust in IoT technologies and supports the development of more secure products. For manufacturers, compliance with the standard improves product security. It can also help them stand out in the market, because security is becoming an increasingly important selling point.

Testing and certification against ETSI EN 303 645

IoT devices must meet the baseline security requirements of ETSI EN 303 645 to be considered secure. ETSI TS 103 701 provides the means to assess this conformance. In Germany, the Federal Office for Information Security (BSI) has also published the national technical guideline BSI TR-03173. It adds specific criteria that improve the quality and accuracy of conformity assessments.

ETSI EN 303 645: Cyber Security for Consumer Internet of Things: Baseline Requirements

ETSI EN 303 645 sets the baseline requirements for the cybersecurity of consumer IoT devices. It aims to create a security foundation by giving manufacturers guidance on designing their products securely from the start (security by design). The standard covers a wide range of devices. It contains mandatory security provisions as well as additional recommendations that may be departed from only under specific circumstances.

ETSI TS 103 701: Cyber Security for Consumer Internet of Things: Conformance Assessment of Baseline Requirements

ETSI TS 103 701 complements ETSI EN 303 645 with a test specification for conformity assessment. It contains test cases for every security requirement and recommendation in EN 303 645 and a method for assessing whether an IoT device meets them. TS 103 701 makes it easier for manufacturers and test laboratories to check the security properties of IoT devices systematically.

BSI TR-03173: Amendments for Conformance Assessments (Germany)

BSI TR-03173 is a German national supplement. This technical guideline complements ETSI EN 303 645 and ETSI TS 103 701 by setting specific refinements for carrying out conformity assessments. The refinements make the generic aspects of the standard and the test specification more precise, especially in areas such as usability, which the original test specification treats only as informative.

The BSI provides further information on consumer IoT certification.

ETSI EN 303 645 and the Radio Equipment Directive (RED)

The delegated act under the Radio Equipment Directive (RED), Commission Delegated Regulation (EU) 2022/30, is a binding EU legal act. It sets specific security and data protection requirements for radio equipment. ETSI EN 303 645, by contrast, is a technical standard. Its cybersecurity recommendations for IoT devices are not legally binding.

Manufacturers can use ETSI EN 303 645 to meet the requirements of the RED Delegated Act, especially for the cybersecurity of consumer IoT devices. However, the standard is designed specifically for consumer products and does not suit every type of product covered by the RED. Manufacturers whose products fall outside this category must consider other standards to fully meet the RED requirements.

However, ETSI EN 303 645 is not harmonized under the RED. Only EN 18031-1, -2, and -3 are listed as harmonized standards for Article 3(3)(d), (e), and (f) (Implementing Decision (EU) 2025/138). If you apply ETSI EN 303 645, you therefore do not get a presumption of conformity. For the requirements concerned, a notified body must be involved, through EU-type examination or full quality assurance.

Delegated Regulation (EU) 2022/30 will be repealed with effect from December 11, 2027 by Delegated Regulation (EU) 2026/339. From then on, the cybersecurity requirements for these products follow from the Cyber Resilience Act.

For more detail, see our pages on the Radio Equipment Directive and on EN 18031, the standards series for cybersecurity in radio equipment.

ETSI EN 303 645 and EN 18031

ETSI EN 303 645 and the EN 18031 series complement each other in improving the cybersecurity of connected devices. ETSI EN 303 645 focuses on consumer IoT devices and defines baseline security requirements. The EN 18031 series specifically addresses the cybersecurity of radio equipment under the Radio Equipment Directive (RED).

The EN 18031 series consists of several parts and sets detailed technical specifications for different aspects of radio equipment security. It covers protection from harm to the network, protection of personal data and privacy, and protection from fraud. ETSI EN 303 645, by contrast, offers a broader but less specific approach for IoT devices in general.

If your IoT devices are also classified as radio equipment, you may have to consider both standards. ETSI EN 303 645 can serve as a starting point for baseline security measures. The EN 18031 series adds specific requirements for the radio aspects of the device. Together, these standards form a broad framework for the security of connected devices in Europe.