IoT security standards and laws: ETSI EN 303 645, NIST IR 8259 and the UK PSTI Act
In short: IoT security has moved from voluntary guidance to law. ETSI EN 303 645 and NIST IR 8259 set out baseline expectations for device makers, and the UK PSTI Act and EU Cyber Resilience Act make key parts mandatory. Almost all of them require no universal default passwords, a way to report vulnerabilities and a stated update period.
Why standards and laws arrived
For years, cheap connected devices were sold with shared passwords, no updates and no way to report flaws. Botnets such as Mirai showed the cost fell on everyone, not just the buyer. Governments responded first with guidance and then with legislation that makes a short list of basics compulsory. If you design, sell, buy or audit IoT products, you need to know these documents.
The main documents
| Document | Type | What it covers |
|---|---|---|
| ETSI EN 303 645 | European standard (voluntary on its own) | Baseline for consumer IoT: 13 groups of provisions plus data protection, from no universal default passwords to making installation easy. Widely used as the basis for laws and certification schemes. |
| NIST IR 8259 series | US guidance | 8259 describes activities manufacturers should do before and after sale; 8259A defines a technical core baseline (device identification, configuration, data protection, logical access to interfaces, software update, cybersecurity state awareness); 8259B covers non-technical support such as documentation and education. |
| NIST SP 800-213 | US guidance for federal buyers | How organisations should set requirements when buying and deploying IoT. |
| UK PSTI Act 2022 | UK law, product security regime in force since 29 April 2024 | Bans universal default passwords, requires a published way to report vulnerabilities and a stated minimum security update period for consumer connectable products. |
| EU Cyber Resilience Act | EU regulation, obligations phase in up to late 2027 | Security requirements across the lifecycle for products with digital elements, including vulnerability handling, incident reporting and CE marking. |
| IEC 62443 | International standard series | Industrial automation and control systems: zones, conduits, security levels and secure development. |
The common core
Read these documents side by side and the same ideas keep appearing. The UK PSTI regime took the three ETSI provisions judged most urgent and made them law:
- No universal default passwords. Each device has a unique password, or the user must set one before use.
- A vulnerability disclosure policy. The maker publishes how to report security issues and how reports are handled.
- Transparency about updates. The buyer is told, at the point of sale, the minimum period during which security updates will be provided.
Beyond these, the baselines ask for secure update mechanisms, secure storage of credentials, encrypted communication, minimal exposed services, resilience to outages, easy deletion of personal data and validation of input.
Applying them in practice
- If you build products: map each provision to a requirement and a test, keep evidence, and publish your disclosure policy and support period. ETSI TS 103 701 describes how to assess conformance to EN 303 645.
- If you buy for an organisation: ask suppliers for a statement of conformance, the support end date and their disclosure contact. Reject products that cannot answer.
- If you audit: check what is actually shipped. A product can claim compliance yet still expose Telnet with a shared password.
- Industrial settings: use IEC 62443 rather than consumer baselines, because it addresses safety, zones and long equipment lifetimes.
Tip: regulations change and deadlines move. Before relying on a date for a project or exam, check the current version on the official government or standards body site.
Practice
Which three requirements does the UK PSTI product security regime make mandatory?
What is the difference between NIST IR 8259 and 8259A?
A factory wants to secure its control network. Should it use ETSI EN 303 645?
Key takeaways
- IoT security has moved from voluntary guidance to binding law.
- ETSI EN 303 645 is the consumer IoT baseline behind many laws and schemes.
- NIST IR 8259 and 8259A guide manufacturers on activities and device capabilities.
- The UK PSTI Act requires unique passwords, a disclosure route and a stated support period.
- Industrial systems should follow IEC 62443 instead.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.