ETSI EN 303 645: the baseline for consumer IoT security

What it is

ETSI EN 303 645, Cyber Security for Consumer Internet of Things: Baseline Requirements, is a standard from the European Telecommunications Standards Institute. It first appeared as a technical specification in 2019 and became a European Norm in 2020. Version 3.1.3 was published in September 2024. It applies to consumer devices that connect to a network, such as smart TVs, cameras, doorbells, speakers, toys, wearables, smart home hubs and connected appliances, along with their associated apps and cloud services.

The provisions are outcome-focused and grouped into 13 categories, plus a section on data protection. Some are mandatory "shall" statements; others are recommendations.

Why it matters

The Mirai botnet in 2016 showed what weak IoT security allows: hundreds of thousands of cameras and routers, many still using factory default credentials, were recruited into DDoS attacks large enough to disrupt major websites. Consumers cannot reasonably assess firmware security when buying a gadget, and many devices were never updated. A common baseline, written so that test labs can assess it, lets regulators, retailers and buyers demand minimum quality.

Key ideas

• No universal default passwords. Each device must have a unique password or require the user to set one. Shared defaults like "admin/admin" are not allowed.
• Implement a means to manage reports of vulnerabilities. Manufacturers publish a vulnerability disclosure policy with a contact point and act on reports in a timely way.
• Keep software updated, securely, and tell users clearly how long the device will receive security updates (the defined support period).
• Securely store sensitive parameters, such as keys, and do not hard-code credentials in firmware.
• Communicate securely using appropriate, up-to-date cryptography for sensitive data and remote management.
• Minimise exposed attack surfaces: disable unused interfaces, debug ports and network services.
• Make it easy for users to delete their data and to install and maintain the device securely.

What changed recently

Regulation has turned parts of the baseline into law. In the UK, the product security regime under the Product Security and Telecommunications Infrastructure (PSTI) Act came into force on 29 April 2024. It requires manufacturers, importers and distributors of most consumer connectable products to meet three requirements drawn directly from the top provisions of EN 303 645: no universal default passwords, a published way to report vulnerabilities, and a clear statement of the minimum security update period. In the EU, the Radio Equipment Directive delegated act applying cybersecurity requirements to wireless devices took effect in August 2025, and the Cyber Resilience Act will apply broad essential requirements from December 2027, with reporting duties already active from September 2026. EN 303 645 is widely used as a reference in these schemes, and ETSI publishes a companion conformance assessment specification (TS 103 701) that test labs use.

How practitioners apply it

1. Manufacturers: design unique per-device credentials into manufacturing, set up a disclosure process and security update pipeline, and publish the support period on packaging and websites.
2. Test against the provisions using TS 103 701 test cases, or commission an accredited lab.
3. Enterprises and schools: include the top three provisions as minimum procurement requirements for cameras, displays and building devices.
4. Network teams: place IoT devices in their own segment with restricted outbound access (see VLANs and trunks) because even compliant devices can be flawed.
5. Researchers and students: use the standard as a structured checklist for assessing a device in a lab, for example checking open ports, update mechanisms and credential handling.

A simple lab assessment of a smart plug or camera against the baseline might proceed like this. Reset it and check whether setup forces a unique password. Scan it from a test network to list open ports and services, and ask whether each is needed. Watch its traffic during setup and normal use to see whether it uses encrypted protocols. Look for a firmware update mechanism and whether updates are signed. Finally, search the manufacturer’s website for a vulnerability disclosure page and a stated support period. Each finding maps to a numbered provision, which makes the report easy to structure.

Tip: Before buying a device, look for the manufacturer’s published security update period and vulnerability reporting contact. If neither exists, treat that as a warning sign.

Limitations and open questions

• A baseline, not high assurance. The provisions are deliberately achievable for cheap devices; they do not make devices resistant to determined attackers.
• Self-declaration is common, so actual quality depends on enforcement and market surveillance.
• Cloud and app back ends are part of the product but are harder to test than the device.
• End of support. The standard requires a declared update period but cannot force manufacturers to support devices for as long as people keep using them.