UK PSTI Security and Compliance Interpretation

I. Regulation Developments

The UK Government enacted the Product Security and Telecommunications Infrastructure Act in 2022, and the supporting regulation, the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, came into force on 29 April 2024.

II. Regulation Requirements

The regulation establishes four requirements for consumer connectable products:

1. Password requirement — Factory-default weak passwords are prohibited. Passwords must be unique per product or user-defined (note: cryptographic keys, Bluetooth pairing PINs, etc. are not considered “passwords”).

2. Vulnerability disclosure policy — Manufacturers must provide the following information:

a. A public vulnerability disclosure channel (e.g., an email address);

b. The time frame within which a user will receive an acknowledgment after reporting a vulnerability through that channel;

c. Status updates until the user’s reported security issue is resolved (e.g., updates issued every few days).

3. Security update support period — Manufacturers must publish the minimum security update support period for the product and must not shorten it. If the support period is extended, the new period must be promptly updated and republished. The notice of the security update support period should be presented in a way that can be understood without prior technical knowledge.

Users must not be required to provide their personal information in order to access the information in items 2 and 3 above. The published information must be provided in English and free of charge.

4. The manufacturer shall issue a Statement of Compliance, which must include at least the following:

a. Product — type, batch;

b. Manufacturer information — name, address, and the authorised representative’s name and address (where applicable);

c. A statement indicating that the declaration is prepared by the manufacturer of the product or by their representative;

d. A statement indicating that the product complies with the PSTI security requirements;

e. The signatory’s signature, name, and position, as well as the place and date of issue of the Statement of Compliance, etc.

III. Excepted Products

1. Products made available for supply in Northern Ireland that are subject to relevant legislation;

2. Charge points for electric vehicles;

3. Medical devices;

4. Smart meter products;

5. Desktop/laptop computers.