ETSI EN 303 645¶
ETSI EN 303 645, Cyber Security for Consumer Internet of Things: Baseline Requirements, is a European standard. It sets a minimum level of security for connected consumer products such as smart speakers, cameras, toys, appliances and home hubs. It was first published in 2020 and grew out of the UK government’s 2018 Code of Practice for consumer IoT security. It is now the usual reference for IoT security regulation and certification. Its requirements are good practice for any connected device, consumer or not.
The thirteen provisions¶
| No. | Provision | In short |
|---|---|---|
| 5.1 | No universal default passwords | Each device has a unique password, or the user must set one |
| 5.2 | Implement a means to manage reports of vulnerabilities | Publish a vulnerability disclosure policy and act on reports |
| 5.3 | Keep software updated | Secure updates, and a stated period for which they will be provided |
| 5.4 | Securely store sensitive security parameters | Protect keys and credentials; no hard-coded credentials shared across devices |
| 5.5 | Communicate securely | Use current cryptography; encrypt sensitive data in transit |
| 5.6 | Minimise exposed attack surfaces | Disable unused interfaces, services and debug ports |
| 5.7 | Ensure software integrity | Verify software with secure boot |
| 5.8 | Ensure that personal data is secure | Protect personal data in transit and at rest |
| 5.9 | Make systems resilient to outages | Keep working locally when the network or cloud fails |
| 5.10 | Examine system telemetry data | Monitor for security anomalies |
| 5.11 | Make it easy for users to delete user data | Provide a simple way to wipe personal data |
| 5.12 | Make installation and maintenance of devices easy | Secure set-up with minimal steps |
| 5.13 | Validate input data | Check data from interfaces and networks |
The thirteen cyber security provisions, summarised.
A further clause covers data protection: telling users what personal data is processed and getting consent where needed. Each provision contains individual requirements, some mandatory and some recommended. ETSI TS 103 701 defines how to assess a product against them.
Why it matters: regulation¶
The first three provisions became law in the UK under the Product Security and Telecommunications Infrastructure (PSTI) Act, in force since 29 April 2024. Products sold to UK consumers must have no universal default passwords and a published way to report vulnerabilities. They must also state the minimum period for which they will receive security updates. Meeting the corresponding parts of EN 303 645 is a recognised way to comply.
In the EU, the radio equipment rules have required cybersecurity for internet-connected radio products since August 2025, through the EN 18031 standards. The Cyber Resilience Act goes further: it sets security requirements for almost all products with digital elements, with its main obligations applying from December 2027. EN 303 645 is a good foundation for both.
Applying it¶
- Treat it as the baseline, not the goal. It sets out what a device must do, not how; pair it with secure coding practices and a threat model.
- Map each requirement to a design decision and to evidence (test results, documents) early in development. Retro-fitting secure boot or unique credentials after launch is expensive.
- Many provisions need factory and back-end support: unique credentials per device (PKI and certificates), a firmware update service, and a vulnerability handling process.
Where next¶
- Bootloaders covers secure boot (5.7), and TLS and DTLS covers secure communication (5.5).
- The Standards section covers how these requirements apply here.
- The standard is free to download from etsi.org.