1 May 2024
The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 came into force on 29th April 2024 and extend to England and Wales, Scotland and Northern Ireland. These regulations apply to consumer connectable products which are internet-connectable or network-connectable products.
These Regulations create security requirements for manufacturers of relevant connectable products and set out conditions to be met for deemed compliance of a security requirement as part of the regulatory regime as set out in Part 1 of the Product Security and Telecommunications Infrastructure Act 2022
These Regulations also set out what connectable products are excepted from the scope of the regulatory regime and further set out requirements in relation to the statement of compliance for relevant connectable products for manufacturers and importers.
Schedule 1 sets out the security requirements with which manufacturers of relevant connectable products have to comply in relation to UK consumer connectable products.
This includes security requirements on the following:
- Passwords
- Information on how to report security issues
- Information on minimum security update periods
Schedule 2 sets out conditions which, if met, will deem the manufacturer compliant with the relevant corresponding security requirement.
Conditions are met if the manufacturer complies with the relevant sections of the following standards:
- ETSI EN 303 645 - EN 303 645 - V2.1.1 - CYBER; Cyber Security for Consumer Internet of Things: Baseline Requirements (etsi.org)
- ISO/IEC 29147 - ISO/IEC 29147:2018 - Information technology — Security techniques — Vulnerability disclosure (for more guidance on how to obtain ISO standards for the best value for your needs please see the BM guidance document found here - )
Schedule 3 sets out the list of products to be excepted from being considered relevant connectable products for the purposes of section4 (relevant connectable products) of the Act and include the following:
- Products made available to be supplied in Northern Ireland
- Charge points for electric vehicles
- Medical devices
- Smart meter products
- Computers
Schedule 4 sets out the minimum amount of information which is required to be stated in a statement of compliance and includes:
- product (type, batch)
- name and address of each manufacturer of the product and, where applicable, each authorised representative
- a declaration that the statement of compliance is prepared by or on behalf of the manufacturer of the product
- a declaration that, in the opinion of the manufacturer, they have complied with either—
- the applicable security requirements in Schedule 1; or
- the deemed compliance conditions in Schedule 2
- the defined support period for the product that was correct when the manufacturer first supplied the product
- signature, name, and function of the signatory; and
- the place and date of issue of the statement of compliance
Further information and the sull regulations can be found on the gov.uk website:
- The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 (legislation.gov.uk)
- The Product Security and Telecommunications Infrastructure (PSTI) Bill – product security factsheet - GOV.UK (www.gov.uk)
- EN 303 645 - V2.1.1 - CYBER; Cyber Security for Consumer Internet of Things: Baseline Requirements (etsi.org)
British Marine is currently seeking further guidance from OPSS with regards to the various marine products raging from navigation equipment through to connectable engine monitoring equipment to so how these regulations apply.
If you have any concerns or need further advice on these regulations please contact British Marine’s Technical team via Technical@britishmarine.co.uk