ASTM F3463-20
(Guide)Standard Guide for Ensuring the Safety of Connected Consumer Products
Standard Guide for Ensuring the Safety of Connected Consumer Products
SIGNIFICANCE AND USE
3.1 This guide is intended to apply in conjunction with applicable end product specific standard requirements to address the overall system safety of a connected consumer product. This guide is not a substitute for the performance requirements in the end product standard. Property damage, including non-functionality of the connected consumer product, is only included to the extent that such property damage leads to a safety issue. Data security beyond the extent necessary to ensure system safety, or privacy-related issues, are not addressed in this guide although measures to address the protection of personal information may help mitigate connected consumer product safety issues.
3.2 This guide provides guidelines for:
3.2.1 Remote updates;
3.2.2 Software, firmware, and configuration risk management designed to ensure compliance with an end product safety standard and to prevent the creation of an unanticipated hazard from the connected consumer product; and
3.2.3 Cybersecurity risk controls for the software, firmware, and configuration of architecture and design.
SCOPE
1.1 This guide provides guidance for connected consumer products, as defined in 1.1.1, as it relates to physical product safety hazards created by virtue of their connectivity. It applies to connected products that need testing and evaluation to prevent cybersecurity vulnerabilities and weaknesses that could compromise the safety-related performance of the product, create a physical safety hazard in the product or its operation, or result in a noncompliance to the underlying end product safety standard.
1.1.1 Connected consumer product or Internet of Things (IoT) consumer device means any consumer device or physical object that is capable of connecting to the internet or other network, directly or indirectly, and is assigned an internet, Bluetooth, or other communication protocol address or identifier. A non-exhaustive list of examples includes:
1.1.1.1 Connected children’s toys;
1.1.1.2 Connected safety-related products such as smoke alarms and door locks;
1.1.1.3 Connected TVs and speakers;
1.1.1.4 Wearable connected health trackers and smart apparel;
1.1.1.5 Connected home automation, security or surveillance cameras, and alarm systems;
1.1.1.6 Connected appliances (for example, washing machines and refrigerators);
1.1.1.7 Connected smart home assistants; and
1.1.1.8 Connected baby monitors.
1.2 Safety, for this guide, is defined as the freedom from an unreasonable risk of physical injury or illness resulting from mechanical contact, hazardous energy release, or exposure to hazardous chemicals from the connected product. Physical injury or illness may include burns, lacerations, strains, contusions, suffocation, strangulation, poisoning, disease, seizures, internal injuries, shock, or other injuries to the body. Property damage related to non-functionality of the connected device is only included to the extent that such property damage leads to a safety issue. Safety, for this standard, does not include privacy or personal data security, or physical harms potentially resulting from privacy or personal data breaches.
1.3 The values stated in SI units are to be regarded as standard. No other units of measurement are included in this standard.
1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.
1.5 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.
General Information
Standards Content (Sample)
NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
Designation: F3463 − 20
Standard Guide for
1
Ensuring the Safety of Connected Consumer Products
This standard is issued under the fixed designation F3463; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope include privacy or personal data security, or physical harms
potentially resulting from privacy or personal data breaches.
1.1 This guide provides guidance for connected consumer
products, as defined in 1.1.1, as it relates to physical product
1.3 The values stated in SI units are to be regarded as
safety hazards created by virtue of their connectivity. It applies
standard. No other units of measurement are included in this
to connected products that need testing and evaluation to
standard.
prevent cybersecurity vulnerabilities and weaknesses that
1.4 This standard does not purport to address all of the
could compromise the safety-related performance of the
safety concerns, if any, associated with its use. It is the
product, create a physical safety hazard in the product or its
responsibility of the user of this standard to establish appro-
operation, or result in a noncompliance to the underlying end
priate safety, health, and environmental practices and deter-
product safety standard.
mine the applicability of regulatory limitations prior to use.
1.1.1 Connected consumer product or Internet of Things
1.5 This international standard was developed in accor-
(IoT) consumer device means any consumer device or physical
dance with internationally recognized principles on standard-
object that is capable of connecting to the internet or other
ization established in the Decision on Principles for the
network, directly or indirectly, and is assigned an internet,
Development of International Standards, Guides and Recom-
Bluetooth, or other communication protocol address or identi-
mendations issued by the World Trade Organization Technical
fier. A non-exhaustive list of examples includes:
Barriers to Trade (TBT) Committee.
1.1.1.1 Connected children’s toys;
1.1.1.2 Connected safety-related products such as smoke
2. Terminology
alarms and door locks;
1.1.1.3 Connected TVs and speakers; 2.1 Definitions:
1.1.1.4 Wearable connected health trackers and smart ap-
2.1.1 connected consumer product, n—anyconsumerdevice
parel;
or physical object that is capable of connecting to the internet
1.1.1.5 Connected home automation, security or surveil-
or other network directly or indirectly and is assigned an
lance cameras, and alarm systems;
internet, Bluetooth, or other communication protocol address
1.1.1.6 Connected appliances (for example, washing ma-
or identifier.
chines and refrigerators);
2.1.2 cyber security, n—protection against network-based
1.1.1.7 Connected smart home assistants; and
threats that could lead to criminal or unauthorized access to the
1.1.1.8 Connected baby monitors.
connected consumer product or to data obtained from the
1.2 Safety, for this guide, is defined as the freedom from an
connected consumer product that could result in an introduced
unreasonable risk of physical injury or illness resulting from
hazard to the product or noncompliance with an underlying
mechanical contact, hazardous energy release, or exposure to
standard, including the measures taken to achieve this.
hazardous chemicals from the connected product. Physical
2.1.3 firmware, n—machine instructions (programs) in-
injury or illness may include burns, lacerations, strains,
stalled on the memory chip or other programmable component
contusions, suffocation, strangulation, poisoning, disease,
of a connected consumer product intended to provide instruc-
seizures, internal injuries, shock, or other injuries to the body.
tions for the execution of the product’s operating functions.
Property damage related to non-functionality of the connected
2.1.4 hazard, n—potential source of physical injury.
device is only included to the extent that such property damage
leads to a safety issue. Safety, for this standard, does not
2.1.5 Internet of Things, IoT, n—system of connected prod-
ucts (consumer and non-consumer) that transfer data at local,
national, and global levels.
1
This guide is under the jurisdiction of ASTM Committee F15 on Consumer
Products and is the direct responsibility of Subcommittee F15.75 on Connected
2.1.6 remote update, n—update of a consumer connected
Products.
product in which its embedded software, firmware, or configu-
Current edition approved Sept. 15, 2020. Published October 2020. DOI:
10.1520/F3463-20. ration data is changed through a connection to the Internet.
Copyright © ASTM International, 100 Barr Harbor
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.