HARDWARE & SECURITY
THE PSTI ACT IS LAW: TURN COMPLIANCE INTO YOUR COMPETITIVE ADVANTAGE
» DO YOU MANUFACTURE OR SUPPLY Internet of Things( IoT) products and services? The Product Security and Telecommunications Infrastructure( PSTI) Act is no longer on the horizon; it has been mandatory for nearly two years. However, it’ s clear many businesses are still navigating its implications.
You might not see your products as traditional“ IoT devices,” but the PSTI Act defines a“ connectable product” very broadly. If doors, windows or locks incorporate smart technology- such as keyless locks, status sensors, or integration with home automation systems- they are covered by this legislation. Compliance isn’ t just about avoiding penalties- although with fines reaching £ 10 million or 4 % of global turnover, that is a powerful motivator. It’ s about building trust and future-proofing your brand. Consumers are more security-conscious than ever, and demonstrating your commitment to protecting them can become a significant competitive advantage.
The Office for Product Safety and Standards( OPSS) is ensuring these rules are met. Prioritising compliance now prepares you for inevitable future regulations in the IoT space. By leveraging solutions like the Secured by Design( SBD) Secure Connected Device accreditation, businesses can confidently meet the Act’ s security requirements. This not only protects the business from risk but also positions their products as a trusted choice in a connected market.
What does the legislation require?
This groundbreaking legislation focuses on three critical security features for all consumer IoT devices:
• No more easy hacking: Forget factory-set default passwords. Devices must now require unique, user-defined passwords, slamming the door on easy access for cybercriminals
• Vulnerability reporting: Manufacturers are now required to have a clear vulnerability disclosure policy. This means they must have a plan to address security weaknesses, ensuring problems are fixed promptly and effectively
• Guaranteed software updates: Manufacturers must clearly state how long they will provide essential security updates. This ensures devices remain protected throughout their lifespan, giving consumers peace of mind
What needs to be done?
If a business manufactures or supplies any IoT connected product, they must be aware of this law and the fact that the compliance deadline- April 29, 2024- has already passed. There’ s no room for excuses. Businesses must have taken the necessary steps to ensure your products meet these critical security requirements.
These standards are based on globally recognised best practices, including the
UK’ s Code of Practice for Consumer IoT security, ETSI EN 303 645, and guidance from the National Cyber Security Centre.
And it’ s not just manufacturers. Every business in the supply chain plays a critical role in keeping insecure products off the UK market. From distributors to retailers, everyone has a responsibility.
SBD’ s Secure Connected Device accreditation can help with compliance
The SBD Secure Connected Device accreditation, developed in consultation with the Department for Science, Innovation and Technology( DSIT), helps businesses achieve compliance through the Secure Connected Device accreditation scheme. This rigorous program goes beyond the government’ s legislation, assessing products against all 13 provisions of the ETSI EN 303 645 standard.
The SBD assessment identifies a product’ s risk level and guides businesses through the certification process with approved bodies. Achieving SBD membership and accreditation earns products the prestigious SBD Secure Connected Device badge- a clear signal to customers and the industry that products meet the highest security standards. The Secure Connected Device annual appraisal also ensures compliance with evolving government requirements and cyberthreats.
This accreditation isn’ t just a mark of quality; it’ s a powerful differentiator. It demonstrates leadership in IoT security, protecting businesses, their products, and, most importantly, their customers from cyber threats. The SBD Secure Connected Device accreditation is the only way to achieve UK police recognition for the security of your IoT products.
Learn more about the SBD Secure Connected Device accreditation and see which companies have already achieved this prestigious recognition at www. securedbydesign. com / IoT
26
MAY 2026
locksmithjournal. co. uk Hardware & Security Sponsor
Issue Takeover