PSTI Act: consumer connectable product security regime in force

29 Apr 2024 2 years ago Already applies

Regime in force, still operative · Product Security and Telecommunications Infrastructure Act 2022, Part 1; PSTI (Security Requirements) Regulations 2023 · Office for Product Safety and Standards (Department for Business and Trade)

IndustryInfrastructure United Kingdom Law

Since 29 April 2024 manufacturers, importers and distributors of consumer connectable products sold in the UK must meet three security requirements. Devices must not ship with universal default passwords, the manufacturer must publish a vulnerability disclosure contact and must state a minimum security update period. It covers smart cameras, routers, sensors and similar products that end up on industrial and vessel networks. OPSS enforces it with compliance, stop and recall notices and fines.

GOV.UK · legislation.gov.uk

What to do 0 of 5 done

List connectable products you buy for sites and vessels and check each one has a statement of compliance
Ask suppliers for the published minimum security update period before buying
Reject devices that use a shared default password across units
Record the vendor vulnerability disclosure contact for each product family
If you import or resell devices in the UK, put a compliance check in the purchasing process

Ticks are kept in this browser only. Sign in to the client portal to share them with your team.

PSTI Act: consumer connectable product security regime in force

PSTI Act: consumer connectable product security regime in force

Need this tracked for your fleet or plant?