The recent FCC Workshop provided extensive information on cybersecurity testing and certification for IoT products. Drawing from the workshop content, BTL has conducted further research and consolidated the findings. These insights offer a comprehensive view of global requirements for cybersecurity in IoT products.
| Country | Statute | Name | Applicable Subject (Product/Scope) | State | Labelin requirements | Effective Date |
| India | ITSARs : 3GPP TS 33.117（Version 14）/MTCTE | India Telecom Security | • All kinds of telecommunications products • Wi-Fi CPEs, IP routers, 5G session management functions (SMF, OLTs, ONTs/PON) must be MTCTE certified | compulsion | \ | \ |
| Singapore | Common Standard (CC) and Common Method (CEM) | Cyber Security in Singapore | • Wi-Fi routers • Consumer IoT devices (e.g., IP cameras) • All smart devices (smart door locks, smart lights, smart printers, etc.) | \ | CLS（IoT）Label
| 2023/07/01 |
Japan （IPA） | Cyber STAR（JC-STAR） | Japan Cyber STAR (JC-STAR) Voluntary Program | • Direct or indirect connection to Internet devices (consumer and industrial products) via IP • Covered devices: routers, IP cameras, hubs, smart home devices, PLCs, sensors, controllers, etc. | Voluntary |  | 2025/03 (Japanese version)
2026 STAR-2, STAR-3, STAR-4 launched |
| Korea | ITU-T X.1352 Label | Korea Internet of Things Cyber Security (KISA). | Security assessment of Internet of Things (IoT) devices | Voluntary |  | \ |
| Finland | EN 303 645 | Transport and communication in Finland (Traficom) | Mainly covered: • Smart home devices, smart cameras, smart lamps, etc., to ensure that products have basic network security protection | Voluntary(RED-DA & CRA) | CE marking | \ |
| Brazil | Act 9281 | ANATEL (National Telecommunications Service of Brazil) | At present, market surveillance is mainly focused on IPTV devices: • ANATEL is committed to reducing and possibly discontinuing the operation of IPTV equipment. • ANATEL has a dedicated laboratory that monitors IPTV servers, identifies their locations, and attempts to block their functionality. | \ | \ | \ |
| Saudi Arabia | IoT Cybersecurity Guide (CGIoT-1:2024) | Saudi Arabia's National Cyber Security Agency (NCA) | There is no need for a certificate or Declaration of Conformity (DoC), but instead a code of conduct is provided to guide the security of IoT products | \ | \ | \ |
| China | GB 42250:2022 | CCRC Cyber Security Office | What covers: Technical requirements for cybersecurity-specific products. Covers 33 product categories, including: • All wireless and networking products (e.g., routers, switches, firewalls, etc.). • The automotive industry has recently added the GB 44495 standard to standardize vehicle information security. | \ | \ | \ |
| Australia | Australian Cyber Security Act 2024 (IoT Home Devices) | Australian Information Security Assessment Program (AISEP). | Manufacturer's Obligations • Declaration of Conformity • Regulatory Agencies Commodity Testing • Foreign Manufacturer Obligations • Support Period | compulsion | \ | Effective Date: 2025 Date of Compliance: 2026/03/06 The first three principles of the ETSI EN 303 645 standard |
United Kingdom | Consumer IoT Cybersecurity Regulation (PSTI) | Consumer IoT Cybersecurity Regulation (PSTI) | An initial security baseline is intended for manufacturers to ensure that the product has basic security protections. Safety requirements 2 and 3 Expansion applies: • Cybersecurity technology that cannot be installed on a physical device. • Equipment provided by the manufacturer of the product. | Voluntary | CE marking | 2025/08/01 according to EN 303 645 part |
| EU RED | RED 3.3(d)、3.3(e)、3.3(f) | Notified Body EU-TEC Certification | Applicability of the standard: • If the product is within the scope of application, the applicable terms of EN 18031-x (if the harmonised standard route is chosen) will be determined. • Products are evaluated against the standard and, if necessary, EU-TEC certification from a Notified Body. | Voluntary | CE marking | 2025/08/01 |
| EU CRA | CRA (Cyber Resilience Act) reporting obligations | ENISA (European Network and Information Security Agency). | Report Object: • The manufacturer submits a report to ENISA (European Network and Information Security Agency). • Use the Single Reporting Platform (SRA) established by ENISA (see Article 16 of the CRA for details). Time frame for reporting: • Initial Notice: Submitted within 24 hours of becoming aware of the incident. • Initial assessment: impact and mitigation measures within 72 hours. • Final Report: Submit a full incident report within one month of the initial assessment, including impact, root cause, and remediation options. Covers a wide range of goods, including: • Photo editing, word processing software. • Digital products such as smart speakers, hard drives, and gaming devices. • Products with network security needs, such as VPNs, password managers, routers, switches, etc. | \ | CE marking | 2026/09/11 |
BTL is currently building relevant Cybersecurity testing capabilities. If you are interested, please contact us for further information.
