ETSI EN 303 645 V2.1.1 (2020-06)

SLOVENSKI STANDARD
SIST EN 303 645 V2.1.1:2020
01-september-2020
CYBER - Kibernetska varnost za uporabnike interneta stvari: osnovne zahteve
CYBER - Cyber Security for Consumer Internet of Things: Baseline Requirements
Ta slovenski standard je istoveten z: ETSI EN 303 645 V2.1.1 (2020-06)
ICS:
35.030 Informacijska varnost IT Security
SIST EN 303 645 V2.1.1:2020 en

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

The present document may be made available in electronic versions and/or in print. The content of any electronic and/or

print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any

existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI

deliverable is the one made publicly available in PDF format at www.etsi.org/deliver.

Users of the present document should be aware that the document may be subject to revision or change of status.

Information on the current status of this and other ETSI documents is available at

If you find errors in the present document, please send your comment to one of the following services:

No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying

The content of the PDF version shall not be modified without the written authorization of ETSI.

DECT™, PLUGTESTS™, UMTS™ and the ETSI logo are trademarks of ETSI registered for the benefit of its Members.

3GPP™ and LTE™ are trademarks of ETSI registered for the benefit of its Members and

oneM2M™ logo is a trademark of ETSI registered for the benefit of its Members and

Intellectual Property Rights ................................................................................................................................ 4

Foreword ............................................................................................................................................................. 4

Modal verbs terminology .................................................................................................................................... 4

Introduction ........................................................................................................................................................ 4

1 Scope ........................................................................................................................................................ 6

2 References ................................................................................................................................................ 6

2.1 Normative references ......................................................................................................................................... 6

2.2 Informative references ........................................................................................................................................ 7

3 Definition of terms, symbols and abbreviations ....................................................................................... 9

3.1 Terms .................................................................................................................................................................. 9

3.2 Symbols ............................................................................................................................................................ 11

3.3 Abbreviations ................................................................................................................................................... 12

4 Reporting implementation ...................................................................................................................... 12

5 Cyber security provisions for consumer IoT .......................................................................................... 13

5.1 No universal default passwords ........................................................................................................................ 13

5.2 Implement a means to manage reports of vulnerabilities ................................................................................. 14

5.3 Keep software updated ..................................................................................................................................... 15

5.4 Securely store sensitive security parameters .................................................................................................... 18

5.5 Communicate securely ..................................................................................................................................... 19

5.6 Minimize exposed attack surfaces .................................................................................................................... 20

5.7 Ensure software integrity .................................................................................................................................. 21

5.8 Ensure that personal data is secure ................................................................................................................... 22

5.9 Make systems resilient to outages .................................................................................................................... 22

5.10 Examine system telemetry data ........................................................................................................................ 23

5.11 Make it easy for users to delete user data ......................................................................................................... 23

5.12 Make installation and maintenance of devices easy ......................................................................................... 24

5.13 Validate input data............................................................................................................................................ 24

6 Data protection provisions for consumer IoT ......................................................................................... 24

Annex A (informative): Basic concepts and models ............................................................................ 26

A.1 Architecture ............................................................................................................................................ 26

A.2 Device states ........................................................................................................................................... 28

Annex B (informative): Implementation conformance statement pro forma ................................... 31

History .............................................................................................................................................................. 34

IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The information

pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found

in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in

respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web

Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee

can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web

The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners.

ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no

right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does

not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks.

This European Standard (EN) has been produced by ETSI Technical Committee Cyber Security (CYBER).

In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and

"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of

"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.

As more devices in the home connect to the Internet, the cyber security of the Internet of Things (IoT) becomes a

growing concern. People entrust their personal data to an increasing number of online devices and services. Products

and appliances that have traditionally been offline are now connected and need to be designed to withstand cyber

The present document brings together widely considered good practice in security for Internet-connected consumer

devices in a set of high-level outcome-focused provisions. The objective of the present document is to support all

parties involved in the development and manufacturing of consumer IoT with guidance on securing their products.

The provisions are primarily outcome-focused, rather than prescriptive, giving organizations the flexibility to innovate

The present document is not intended to solve all security challenges associated with consumer IoT. It also does not

focus on protecting against attacks that are prolonged/sophisticated or that require sustained physical access to the

device. Rather, the focus is on the technical controls and organizational policies that matter most in addressing the most

significant and widespread security shortcomings. Overall, a baseline level of security is considered; this is intended to

protect against elementary attacks on fundamental design weaknesses (such as the use of easily guessable passwords).

The present document provides a set of baseline provisions applicable to all consumer IoT devices. It is intended to be

complemented by other standards defining more specific provisions and fully testable and/or verifiable requirements for

specific devices which, together with the present document, will facilitate the development of assurance schemes.

Many consumer IoT devices and their associated services process and store personal data, the present document can

help in ensuring that these are compliant with the General Data Protection Regulation (GDPR) [i.7]. Security by design

ETSI TS 103 701 [i.19] provides guidance on how to assess and assure IoT products against provisions within the

The provisions in the present document have been developed following a review of published standards,

recommendations and guidance on IoT security and privacy, including: ETSI TR 103 305-3 [i.1], ETSI

TR 103 309 [i.2], ENISA Baseline Security Recommendations [i.8], UK Department for Digital, Culture, Media and

Sport (DCMS) Secure by Design Report [i.9], IoT Security Foundation Compliance Framework [i.10], GSMA IoT

Security Guidelines and Assessment [i.11], ETSI TR 103 533 [i.12], DIN SPEC 27072 [i.20] and OWASP Internet of

NOTE: Mappings of the landscape of IoT security standards, recommendations and guidance are available in

ENISA Baseline Security Recommendations for IoT - Interactive Tool [i.15] and in Copper Horse

As consumer IoT products become increasingly secure, it is envisioned that future revisions of the present document

will mandate provisions that are currently recommendations in the present document.

The present document specifies high-level security and data protection provisions for consumer IoT devices that are

connected to network infrastructure (such as the Internet or home network) and their interactions with associated

services. The associated services are out of scope. A non-exhaustive list of examples of consumer IoT devices includes:

• connected home automation and alarm systems, especially their gateways and hubs;

Moreover, the present document addresses security considerations specific to constrained devices.

EXAMPLE: Window contact sensors, flood sensors and energy switches are typically constrained devices.

The present document provides basic guidance through examples and explanatory text for organizations involved in the

development and manufacturing of consumer IoT on how to implement those provisions. Table B.1 provides a schema

Devices that are not consumer IoT devices, for example those that are primarily intended to be used in manufacturing,

healthcare or other industrial applications, are not in scope of the present document.

The present document has been developed primarily to help protect consumers, however, other users of consumer IoT

Annex A (informative) of the present document has been included to provide context to clauses 4, 5 and 6 (normative).

Annex A contains examples of device and reference architectures and an example model of device states including data

References are either specific (identified by date of publication and/or edition number or version number) or

non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the

Referenced documents which are not found to be publicly available in the expected location might be found at

NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee

The following referenced documents are necessary for the application of the present document.

References are either specific (identified by date of publication and/or edition number or version number) or

non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the

NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee

The following referenced documents are not necessary for the application of the present document but they assist the

[i.1] ETSI TR 103 305-3: "CYBER; Critical Security Controls for Effective Cyber Defence; Part 3:

[i.2] ETSI TR 103 309: "CYBER; Secure by Default - platform security technology".

[i.3] NIST Special Publication 800-63B: "Digital Identity Guidelines - Authentication and Lifecycle

NOTE: Available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf.

[i.4] ISO/IEC 29147: "Information technology - Security techniques - Vulnerability Disclosure".

NOTE: Available at http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.

[i.7] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and on the free

movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

[i.8] ENISA: "Baseline Security Recommendations for IoT in the context of Critical Information

NOTE: Available at https://op.europa.eu/en/publication-detail/-/publication/c37f8196-d96f-11e7-a506-

[i.9] UK Department for Digital, Culture, Media and Sport: "Secure by Design: Improving the cyber

[i.10] IoT Security Foundation: "IoT Security Compliance Framework", Release 2 December 2018.

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2018/12/IoTSF-IoT-Security-

NOTE: Available at https://www.gsma.com/iot/iot-security/iot-security-guidelines/.

[i.12] ETSI TR 103 533: "SmartM2M; Security; Standards Landscape and best practices".

[i.13] Commission Notice: The "Blue Guide" on the implementation of EU products rules 2016 (Text

NOTE: Available in the Official Journal of the European Union, https://eur-lex.europa.eu/legal-

NOTE: Available at https://www.enisa.europa.eu/topics/iot-and-smart-infrastructures/iot/baseline-security-

[i.16] IoT Security Foundation: "Understanding the Contemporary Use of Vulnerability Disclosure in

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2018/11/Vulnerability-

[i.17] F-Secure: "IoT threats: Explosion of 'smart' devices filling up homes leads to increasing risks".

[i.19] ETSI TS 103 701: "CYBER; Cybersecurity assessment for consumer IoT products".

[i.20] DIN SPEC 27072: "Information Technology - IoT capable devices - Minimum requirements for

NOTE: Available at https://www.gsma.com/security/gsma-coordinated-vulnerability-disclosure-programme/.

[i.22] IoT Security Foundation: "Vulnerability Disclosure - Best Practice Guidelines".

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2017/12/Vulnerability-

NOTE: Available at https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=IoT_Top_10.

NOTE: Available at https://standards.ieee.org/content/ieee-standards/en/standard/802_15_4-2015.html.

[i.25] ETSI TS 102 221: "Smart Cards; UICC-Terminal interface; Physical and logical characteristics".

[i.27] ISO/IEC 27005:2018: "Information technology - Security techniques - Information security risk

NOTE: Available at https://msdn.microsoft.com/en-us/library/ee823878(v=cs.20).aspx.

[i.29] ETSI TR 121 905: "Digital cellular telecommunications system (Phase 2+) (GSM); Universal

Mobile Telecommunications System (UMTS); LTE; Vocabulary for 3GPP Specifications (3GPP

administrator: user who has the highest-privilege level possible for a user of the device, which can mean they are able

associated services: digital services that, together with the device, are part of the overall consumer IoT product and that

EXAMPLE 1: Associated services can include mobile applications, cloud computing/storage and third party

EXAMPLE 2: A device transmits telemetry data to a third-party service chosen by the device manufacturer. This

EXAMPLE: An authentication mechanism can be the requesting of a password, scanning a QR code, or use of a

authentication value: individual value of an attribute used by an authentication mechanism

EXAMPLE: When the authentication mechanism is to request a password, the authentication value can be a

character string. When the authentication mechanism is a biometric fingerprint recognition, the

best practice cryptography: cryptography that is suitable for the corresponding use case and has no indications of a

NOTE 1: This does not refer only to the cryptographic primitives used, but also implementation, key generation and

NOTE 2: Multiple organizations, such as SDOs and public authorities, maintain guides and catalogues of

EXAMPLE: The device manufacturer uses a communication protocol and cryptographic library provided with

the IoT platform and where that library and protocol have been assessed against feasible attacks,

constrained device: device which has physical limitations in either the ability to process data, the ability to

communicate data, the ability to store data or the ability to interact with the user, due to restrictions that arise from its

NOTE 1: Physical limitations can be due to power supply, battery life, processing power, physical access, limited

functionality, limited memory or limited network bandwidth. These limitations can require a constrained

device to be supported by another device, such as a base station or companion device.

EXAMPLE 1: A window sensor's battery cannot be charged or changed by the user; this is a constrained device.

EXAMPLE 2: The device cannot have its software updated due to storage limitations, resulting in hardware

replacement or network isolation being the only options to manage a security vulnerability.

EXAMPLE 3: A low-powered device uses a battery to enable it to be deployed in a range of locations.

Performing high power cryptographic operations would quickly reduce the battery life, so it relies

EXAMPLE 4: The device has no display screen to validate binding codes for Bluetooth pairing.

EXAMPLE 5: The device has no ability to input, such as via a keyboard, authentication information.

NOTE 2: A device that has a wired power supply and can support IP-based protocols and the cryptographic

EXAMPLE 6: A device is mains powered and communicates primarily using TLS (Transport Layer Security).

consumer: natural person who is acting for purposes that are outside her/his trade, business, craft or profession

NOTE: Organizations, including businesses of any size, use consumer IoT. For example, Smart TVs are

frequently deployed in meeting rooms, and home security kits can protect the premises of small

consumer IoT device: network-connected (and network-connectable) device that has relationships to associated

services and are used by the consumer typically in the home or as electronic wearables

NOTE 1: Consumer IoT devices are commonly also used in business contexts. These devices remain classified as

NOTE 2: Consumer IoT devices are often available for the consumer to purchase in retail environments. Consumer

critical security parameter: security-related secret information whose disclosure or modification can compromise the

EXAMPLE: Secret cryptographic keys, authentication values such as passwords, PINs, private components of

debug interface: physical interface used by the manufacturer to communicate with the device during development or to

perform triage of issues with the device and that is not used as part of the consumer-facing functionality

defined support period: minimum length of time, expressed as a period or by an end-date, for which a manufacturer

NOTE: This definition focuses on security aspects and not other aspects related to product support such as

device manufacturer: entity that creates an assembled final consumer IoT product, which is likely to contain the

factory default: state of the device after factory reset or after final production/assembly

NOTE: This includes the physical device and software (including firmware) that is present on it after assembly.

initialization: process that activates the network connectivity of the device for operation and optionally sets

isolable: able to be removed from the network it is connected to, where any functionality loss caused is related only to

that connectivity and not to its main function; alternatively, able to be placed in a self-contained environment with other

devices if and only if the integrity of devices within that environment can be ensured

EXAMPLE: A Smart Fridge has a touchscreen-based interface that is network-connected. This interface can be

logical interface: software implementation that utilizes a network interface to communicate over the network via

manufacturer: relevant economic operator in the supply chain (including the device manufacturer)

ETSI EN 303 645 V2.1.1 (2020-06)
EUROPEAN STANDARD
CYBER;
Cyber Security for Consumer Internet of Things:
Baseline Requirements
---------------------- Page: 1 ----------------------
2 ETSI EN 303 645 V2.1.1 (2020-06)
Reference
REN/CYBER-0048
Keywords
cybersecurity, IoT, privacy
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88
Important notice
The present document can be downloaded from:
http://www.etsi.org/standards-search

The present document may be made available in electronic versions and/or in print. The content of any electronic and/or

print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any

existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI

deliverable is the one made publicly available in PDF format at www.etsi.org/deliver.

Users of the present document should be aware that the document may be subject to revision or change of status.

Information on the current status of this and other ETSI documents is available at

If you find errors in the present document, please send your comment to one of the following services:

No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying

The content of the PDF version shall not be modified without the written authorization of ETSI.

DECT™, PLUGTESTS™, UMTS™ and the ETSI logo are trademarks of ETSI registered for the benefit of its Members.

3GPP™ and LTE™ are trademarks of ETSI registered for the benefit of its Members and

oneM2M™ logo is a trademark of ETSI registered for the benefit of its Members and

Intellectual Property Rights ................................................................................................................................ 4

Foreword ............................................................................................................................................................. 4

Modal verbs terminology .................................................................................................................................... 4

Introduction ........................................................................................................................................................ 4

1 Scope ........................................................................................................................................................ 6

2 References ................................................................................................................................................ 6

2.1 Normative references ......................................................................................................................................... 6

2.2 Informative references ........................................................................................................................................ 7

3 Definition of terms, symbols and abbreviations ....................................................................................... 9

3.1 Terms .................................................................................................................................................................. 9

3.2 Symbols ............................................................................................................................................................ 11

3.3 Abbreviations ................................................................................................................................................... 12

4 Reporting implementation ...................................................................................................................... 12

5 Cyber security provisions for consumer IoT .......................................................................................... 13

5.1 No universal default passwords ........................................................................................................................ 13

5.2 Implement a means to manage reports of vulnerabilities ................................................................................. 14

5.3 Keep software updated ..................................................................................................................................... 15

5.4 Securely store sensitive security parameters .................................................................................................... 18

5.5 Communicate securely ..................................................................................................................................... 19

5.6 Minimize exposed attack surfaces .................................................................................................................... 20

5.7 Ensure software integrity .................................................................................................................................. 21

5.8 Ensure that personal data is secure ................................................................................................................... 22

5.9 Make systems resilient to outages .................................................................................................................... 22

5.10 Examine system telemetry data ........................................................................................................................ 23

5.11 Make it easy for users to delete user data ......................................................................................................... 23

5.12 Make installation and maintenance of devices easy ......................................................................................... 24

5.13 Validate input data............................................................................................................................................ 24

6 Data protection provisions for consumer IoT ......................................................................................... 24

Annex A (informative): Basic concepts and models ............................................................................ 26

A.1 Architecture ............................................................................................................................................ 26

A.2 Device states ........................................................................................................................................... 28

Annex B (informative): Implementation conformance statement pro forma ................................... 31

History .............................................................................................................................................................. 34

IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The information

pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found

in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in

respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web

Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee

can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web

The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners.

ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no

right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does

not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks.

This European Standard (EN) has been produced by ETSI Technical Committee Cyber Security (CYBER).

In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and

"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of

"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.

As more devices in the home connect to the Internet, the cyber security of the Internet of Things (IoT) becomes a

growing concern. People entrust their personal data to an increasing number of online devices and services. Products

and appliances that have traditionally been offline are now connected and need to be designed to withstand cyber

The present document brings together widely considered good practice in security for Internet-connected consumer

devices in a set of high-level outcome-focused provisions. The objective of the present document is to support all

parties involved in the development and manufacturing of consumer IoT with guidance on securing their products.

The provisions are primarily outcome-focused, rather than prescriptive, giving organizations the flexibility to innovate

The present document is not intended to solve all security challenges associated with consumer IoT. It also does not

focus on protecting against attacks that are prolonged/sophisticated or that require sustained physical access to the

device. Rather, the focus is on the technical controls and organizational policies that matter most in addressing the most

significant and widespread security shortcomings. Overall, a baseline level of security is considered; this is intended to

protect against elementary attacks on fundamental design weaknesses (such as the use of easily guessable passwords).

The present document provides a set of baseline provisions applicable to all consumer IoT devices. It is intended to be

complemented by other standards defining more specific provisions and fully testable and/or verifiable requirements for

specific devices which, together with the present document, will facilitate the development of assurance schemes.

Many consumer IoT devices and their associated services process and store personal data, the present document can

help in ensuring that these are compliant with the General Data Protection Regulation (GDPR) [i.7]. Security by design

ETSI TS 103 701 [i.19] provides guidance on how to assess and assure IoT products against provisions within the

The provisions in the present document have been developed following a review of published standards,

recommendations and guidance on IoT security and privacy, including: ETSI TR 103 305-3 [i.1], ETSI

TR 103 309 [i.2], ENISA Baseline Security Recommendations [i.8], UK Department for Digital, Culture, Media and

Sport (DCMS) Secure by Design Report [i.9], IoT Security Foundation Compliance Framework [i.10], GSMA IoT

Security Guidelines and Assessment [i.11], ETSI TR 103 533 [i.12], DIN SPEC 27072 [i.20] and OWASP Internet of

NOTE: Mappings of the landscape of IoT security standards, recommendations and guidance are available in

ENISA Baseline Security Recommendations for IoT - Interactive Tool [i.15] and in Copper Horse

As consumer IoT products become increasingly secure, it is envisioned that future revisions of the present document

will mandate provisions that are currently recommendations in the present document.

The present document specifies high-level security and data protection provisions for consumer IoT devices that are

connected to network infrastructure (such as the Internet or home network) and their interactions with associated

services. The associated services are out of scope. A non-exhaustive list of examples of consumer IoT devices includes:

• connected home automation and alarm systems, especially their gateways and hubs;

Moreover, the present document addresses security considerations specific to constrained devices.

EXAMPLE: Window contact sensors, flood sensors and energy switches are typically constrained devices.

The present document provides basic guidance through examples and explanatory text for organizations involved in the

development and manufacturing of consumer IoT on how to implement those provisions. Table B.1 provides a schema

Devices that are not consumer IoT devices, for example those that are primarily intended to be used in manufacturing,

healthcare or other industrial applications, are not in scope of the present document.

The present document has been developed primarily to help protect consumers, however, other users of consumer IoT

Annex A (informative) of the present document has been included to provide context to clauses 4, 5 and 6 (normative).

Annex A contains examples of device and reference architectures and an example model of device states including data

References are either specific (identified by date of publication and/or edition number or version number) or

non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the

Referenced documents which are not found to be publicly available in the expected location might be found at

NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee

The following referenced documents are necessary for the application of the present document.

References are either specific (identified by date of publication and/or edition number or version number) or

non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the

NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee

The following referenced documents are not necessary for the application of the present document but they assist the

[i.1] ETSI TR 103 305-3: "CYBER; Critical Security Controls for Effective Cyber Defence; Part 3:

[i.2] ETSI TR 103 309: "CYBER; Secure by Default - platform security technology".

[i.3] NIST Special Publication 800-63B: "Digital Identity Guidelines - Authentication and Lifecycle

NOTE: Available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf.

[i.4] ISO/IEC 29147: "Information technology - Security techniques - Vulnerability Disclosure".

NOTE: Available at http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.

[i.7] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and on the free

movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

[i.8] ENISA: "Baseline Security Recommendations for IoT in the context of Critical Information

NOTE: Available at https://op.europa.eu/en/publication-detail/-/publication/c37f8196-d96f-11e7-a506-

[i.9] UK Department for Digital, Culture, Media and Sport: "Secure by Design: Improving the cyber

[i.10] IoT Security Foundation: "IoT Security Compliance Framework", Release 2 December 2018.

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2018/12/IoTSF-IoT-Security-

NOTE: Available at https://www.gsma.com/iot/iot-security/iot-security-guidelines/.

[i.12] ETSI TR 103 533: "SmartM2M; Security; Standards Landscape and best practices".

[i.13] Commission Notice: The "Blue Guide" on the implementation of EU products rules 2016 (Text

NOTE: Available in the Official Journal of the European Union, https://eur-lex.europa.eu/legal-

NOTE: Available at https://www.enisa.europa.eu/topics/iot-and-smart-infrastructures/iot/baseline-security-

[i.16] IoT Security Foundation: "Understanding the Contemporary Use of Vulnerability Disclosure in

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2018/11/Vulnerability-

[i.17] F-Secure: "IoT threats: Explosion of 'smart' devices filling up homes leads to increasing risks".

[i.19] ETSI TS 103 701: "CYBER; Cybersecurity assessment for consumer IoT products".

[i.20] DIN SPEC 27072: "Information Technology - IoT capable devices - Minimum requirements for

NOTE: Available at https://www.gsma.com/security/gsma-coordinated-vulnerability-disclosure-programme/.

[i.22] IoT Security Foundation: "Vulnerability Disclosure - Best Practice Guidelines".

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2017/12/Vulnerability-

NOTE: Available at https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=IoT_Top_10.

NOTE: Available at https://standards.ieee.org/content/ieee-standards/en/standard/802_15_4-2015.html.

[i.25] ETSI TS 102 221: "Smart Cards; UICC-Terminal interface; Physical and logical characteristics".

[i.27] ISO/IEC 27005:2018: "Information technology - Security techniques - Information security risk

NOTE: Available at https://msdn.microsoft.com/en-us/library/ee823878(v=cs.20).aspx.

[i.29] ETSI TR 121 905: "Digital cellular telecommunications system (Phase 2+) (GSM); Universal

Mobile Telecommunications System (UMTS); LTE; Vocabulary for 3GPP Specifications (3GPP

administrator: user who has the highest-privilege level possible for a user of the device, which can mean they are able

associated services: digital services that, together with the device, are part of the overall consumer IoT product and that

EXAMPLE 1: Associated services can include mobile applications, cloud computing/storage and third party

EXAMPLE 2: A device transmits telemetry data to a third-party service chosen by the device manufacturer. This

EXAMPLE: An authentication mechanism can be the requesting of a password, scanning a QR code, or use of a

authentication value: individual value of an attribute used by an authentication mechanism

EXAMPLE: When the authentication mechanism is to request a password, the authentication value can be a

character string. When the authentication mechanism is a biometric fingerprint recognition, the

best practice cryptography: cryptography that is suitable for the corresponding use case and has no indications of a

NOTE 1: This does not refer only to the cryptographic primitives used, but also implementation, key generation and

NOTE 2: Multiple organizations, such as SDOs and public authorities, maintain guides and catalogues of

EXAMPLE: The device manufacturer uses a communication protocol and cryptographic library provided with

the IoT platform and where that library and protocol have been assessed against feasible attacks,

constrained device: device which has physical limitations in either the ability to process data, the ability to

communicate data, the ability to store data or the ability to interact with the user, due to restrictions that arise from its

NOTE 1: Physical limitations can be due to power supply, battery life, processing power, physical access, limited

functionality, limited memory or limited network bandwidth. These limitations can require a constrained

device to be supported by another device, such as a base station or companion device.

EXAMPLE 1: A window sensor's battery cannot be charged or changed by the user; this is a constrained device.

EXAMPLE 2: The device cannot have its software updated due to storage limitations, resulting in hardware

replacement or network isolation being the only options to manage a security vulnerability.

EXAMPLE 3: A low-powered device uses a battery to enable it to be deployed in a range of locations.

Performing high power cryptographic operations would quickly reduce the battery life, so it relies

EXAMPLE 4: The device has no display screen to validate binding codes for Bluetooth pairing.

EXAMPLE 5: The device has no ability to input, such as via a keyboard, authentication information.

NOTE 2: A device that has a wired power supply and can support IP-based protocols and the cryptographic

EXAMPLE 6: A device is mains powered and communicates primarily using TLS (Transport Layer Security).

consumer: natural person who is acting for purposes that are outside her/his trade, business, craft or profession

NOTE: Organizations, including businesses of any size, use consumer IoT. For example, Smart TVs are

frequently deployed in meeting rooms, and home security kits can protect the premises of small

consumer IoT device: network-connected (and network-connectable) device that has relationships to associated

services and are used by the consumer typically in the home or as electronic wearables

NOTE 1: Consumer IoT devices are commonly also used in business contexts. These devices remain classified as

NOTE 2: Consumer IoT devices are often available for the consumer to purchase in retail environments. Consumer

critical security parameter: security-related secret information whose disclosure or modification can compromise the

EXAMPLE: Secret cryptographic keys, authentication values such as passwords, PINs, private components of

debug interface: physical interface used by the manufacturer to communicate with the device during development or to

perform triage of issues with the device and that is not used as part of the consumer-facing functionality

defined support period: minimum length of time, expressed as a period or by an end-date, for which a manufacturer

NOTE: This definition focuses on security aspects and not other aspects related to product support such as

device manufacturer: entity that creates an assembled final consumer IoT product, which is likely to contain the

factory default: state of the device after factory reset or after final production/assembly

NOTE: This includes the physical device and software (including firmware) that is present on it after assembly.

initialization: process that activates the network connectivity of the device for operation and optionally sets

isolable: able to be removed from the network it is connected to, where any functionality loss caused is related only to

that connectivity and not to its main function; alternatively, able to be placed in a self-contained environment with other

devices if and only if the integrity of devices within that environment can be ensured

EXAMPLE: A Smart Fridge has a touchscreen-based interface that is network-connected. This interface can be

logical interface: software implementation that utilizes a network interface to communicate over the network via

manufacturer: relevant economic operator in the supply chain (including the device manufacturer)

NOTE: This definition acknowledges the variety of actors involved in the consumer IoT ecosystem and the

complex ways by which they can share responsibilities. Beyond the device manufacturer, such entities

can also be, for example and depending on a specific case at hand: importers, distributors, integrators,

component and platform providers, software providers, IT and telecommunications service providers,

network interface: physical interface that can be used to access the functionality of consumer IoT via a network

personal data: any information relating to an identified or identifiable natural person

NOTE: This term is used to align with well-known terminology but has no legal meaning within the present

physical interface: physical port or air interface (such as radio, audio or optical) used to communicate with the device

Final draft ETSI EN 303 645 V2.1.0 (2020-04)
EUROPEAN STANDARD
CYBER;
Cyber Security for Consumer Internet of Things:
Baseline Requirements
---------------------- Page: 1 ----------------------
2 Final draft ETSI EN 303 645 V2.1.0 (2020-04)
Reference
REN/CYBER-0048
Keywords
cybersecurity, IoT, privacy
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88
Important notice
The present document can be downloaded from:
http://www.etsi.org/standards-search

The present document may be made available in electronic versions and/or in print. The content of any electronic and/or

print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any

existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI

deliverable is the one made publicly available in PDF format at www.etsi.org/deliver.

Users of the present document should be aware that the document may be subject to revision or change of status.

Information on the current status of this and other ETSI documents is available at

If you find errors in the present document, please send your comment to one of the following services:

No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying

The content of the PDF version shall not be modified without the written authorization of ETSI.

DECT™, PLUGTESTS™, UMTS™ and the ETSI logo are trademarks of ETSI registered for the benefit of its Members.

3GPP™ and LTE™ are trademarks of ETSI registered for the benefit of its Members and

oneM2M™ logo is a trademark of ETSI registered for the benefit of its Members and

Intellectual Property Rights ................................................................................................................................ 4

Foreword ............................................................................................................................................................. 4

Modal verbs terminology .................................................................................................................................... 4

Introduction ........................................................................................................................................................ 4

1 Scope ........................................................................................................................................................ 6

2 References ................................................................................................................................................ 6

2.1 Normative references ......................................................................................................................................... 6

2.2 Informative references ........................................................................................................................................ 7

3 Definition of terms, symbols and abbreviations ....................................................................................... 9

3.1 Terms .................................................................................................................................................................. 9

3.2 Symbols ............................................................................................................................................................ 11

3.3 Abbreviations ................................................................................................................................................... 12

4 Reporting implementation ...................................................................................................................... 12

5 Cyber security provisions for consumer IoT .......................................................................................... 13

5.1 No universal default passwords ........................................................................................................................ 13

5.2 Implement a means to manage reports of vulnerabilities ................................................................................. 14

5.3 Keep software updated ..................................................................................................................................... 15

5.4 Securely store sensitive security parameters .................................................................................................... 18

5.5 Communicate securely ..................................................................................................................................... 19

5.6 Minimize exposed attack surfaces .................................................................................................................... 20

5.7 Ensure software integrity .................................................................................................................................. 21

5.8 Ensure that personal data is secure ................................................................................................................... 21

5.9 Make systems resilient to outages .................................................................................................................... 22

5.10 Examine system telemetry data ........................................................................................................................ 22

5.11 Make it easy for users to delete user data ......................................................................................................... 23

5.12 Make installation and maintenance of devices easy ......................................................................................... 23

5.13 Validate input data............................................................................................................................................ 24

6 Data protection provisions for consumer IoT ......................................................................................... 24

Annex A (informative): Basic concepts and models ............................................................................ 25

A.1 Architecture ............................................................................................................................................ 25

A.2 Device states ........................................................................................................................................... 27

Annex B (informative): Implementation conformance statement pro forma ................................... 29

History .............................................................................................................................................................. 32

IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The information

pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found

in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in

respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web

Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee

can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web

The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners.

ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no

right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does

not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks.

This final draft European Standard (EN) has been produced by ETSI Technical Committee Cyber Security (CYBER),

and is now submitted for the Vote phase of the ETSI standards EN Approval Procedure.

Date of withdrawal of any conflicting National Standard (dow): 6 months after doa

In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and

"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of

"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.

As more devices in the home connect to the Internet, the cyber security of the Internet of Things (IoT) becomes a

growing concern. People entrust their personal data to an increasing number of online devices and services. Products

and appliances that have traditionally been offline are now connected and need to be designed to withstand cyber

The present document brings together widely considered good practice in security for Internet-connected consumer

devices in a set of high-level outcome-focused provisions. The objective of the present document is to support all

parties involved in the development and manufacturing of consumer IoT with guidance on securing their products.

The provisions are primarily outcome-focused, rather than prescriptive, giving organizations the flexibility to innovate

The present document is not intended to solve all security challenges associated with consumer IoT. It also does not

focus on protecting against attacks that are prolonged/sophisticated or that require sustained physical access to the

device. Rather, the focus is on the technical controls and organizational policies that matter most in addressing the most

significant and widespread security shortcomings. Overall, a baseline level of security is considered; this is intended to

protect against elementary attacks on fundamental design weaknesses (such as the use of easily guessable passwords).

The present document provides a set of baseline provisions applicable to all consumer IoT devices. It is intended to be

complemented by other standards defining more specific provisions and fully testable and/or verifiable requirements for

specific devices which, together with the present document, will facilitate the development of assurance schemes.

Many consumer IoT devices and their associated services process and store personal data, the present document can

help in ensuring that these are compliant with the General Data Protection Regulation (GDPR) [i.7]. Security by design

ETSI TS 103 701 [i.19] provides guidance on how to assess and assure IoT products against provisions within the

The provisions in the present document have been developed following review of published standards,

recommendations and guidance on IoT security and privacy, including: ETSI TR 103 305-3 [i.1], ETSI

TR 103 309 [i.2], ENISA Baseline Security Recommendations [i.8], UK Department for Digital, Culture, Media and

Sport (DCMS) Secure by Design Report [i.9], IoT Security Foundation Compliance Framework [i.10], GSMA IoT

Security Guidelines and Assessment [i.11], ETSI TR 103 533 [i.12], DIN SPEC 27072 [i.20] and OWASP Internet of

NOTE: Mappings of the landscape of IoT security standards, recommendations and guidance are available in

ENISA Baseline Security Recommendations for IoT - Interactive Tool [i.15] and in Copper Horse

As consumer IoT products become increasingly secure, it is envisioned that future revisions of the present document

will mandate provisions that are currently recommendations in the present document.

The present document specifies high-level security and data protection provisions for consumer IoT devices that are

connected to network infrastructure (such as the Internet or home network) and their interactions with associated

services. The associated services are out of scope. A non-exhaustive list of examples of consumer IoT devices includes:

• connected home automation and alarm systems, especially their gateways and hubs;

Moreover, the present document addresses security considerations specific to constrained devices.

EXAMPLE: Window contact sensors, flood sensors and energy switches are typically constrained devices.

The present document provides basic guidance through examples and explanatory text for organizations involved in the

development and manufacturing of consumer IoT on how to implement those provisions. Table B.1 provides a schema

Devices that are not consumer IoT devices, for example those that are primarily intended to be used in manufacturing,

healthcare or other industrial applications, are not in scope of the present document.

The present document has been developed primarily to help protect consumers, however, other users of consumer IoT

Annex A (informative) of the present document has been included to provide context to clauses 4, 5 and 6 (normative).

Annex A contains examples of device and reference architectures and an example model of device states including data

References are either specific (identified by date of publication and/or edition number or version number) or

non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the

Referenced documents which are not found to be publicly available in the expected location might be found at

NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee

The following referenced documents are necessary for the application of the present document.

References are either specific (identified by date of publication and/or edition number or version number) or

non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the

NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee

The following referenced documents are not necessary for the application of the present document but they assist the

[i.1] ETSI TR 103 305-3: "CYBER; Critical Security Controls for Effective Cyber Defence; Part 3:

[i.2] ETSI TR 103 309: "CYBER; Secure by Default - platform security technology".

[i.3] NIST Special Publication 800-63B: "Digital Identity Guidelines - Authentication and Lifecycle

NOTE: Available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf.

[i.4] ISO/IEC 29147: "Information technology - Security techniques - Vulnerability Disclosure".

NOTE: Available at http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.

[i.7] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and on the free

movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

[i.8] ENISA: "Baseline Security Recommendations for IoT in the context of Critical Information

[i.9] UK Department for Digital, Culture, Media and Sport: "Secure by Design: Improving the cyber

[i.10] IoT Security Foundation: "IoT Security Compliance Framework", Release 2 December 2018.

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2018/12/IoTSF-IoT-Security-

NOTE: Available at https://www.gsma.com/iot/iot-security/iot-security-guidelines/.

[i.12] ETSI TR 103 533: "SmartM2M; Security; Standards Landscape and best practices".

[i.13] Commission Notice: The "Blue Guide" on the implementation of EU products rules 2016 (Text

NOTE: Available in the Official Journal of the European Union, https://eur-lex.europa.eu/legal-

NOTE: Available at https://www.enisa.europa.eu/topics/iot-and-smart-infrastructures/iot/baseline-security-

[i.16] IoT Security Foundation: "Understanding the Contemporary Use of Vulnerability Disclosure in

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2018/11/Vulnerability-

[i.17] F-Secure: "IoT threats: Explosion of 'smart' devices filling up homes leads to increasing risks".

[i.19] ETSI TS 103 701: "CYBER; Cybersecurity assessment for consumer IoT products".

[i.20] DIN SPEC 27072: "Information Technology - IoT capable devices - Minimum requirements for

NOTE: Available at https://www.gsma.com/security/gsma-coordinated-vulnerability-disclosure-programme/.

[i.22] IoT Security Foundation: "Vulnerability Disclosure - Best Practice Guidelines".

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2017/12/Vulnerability-

NOTE: Available at https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=IoT_Top_10.

NOTE: Available at https://standards.ieee.org/content/ieee-standards/en/standard/802_15_4-2015.html.

[i.25] ETSI TS 102 221: "Smart Cards; UICC-Terminal interface; Physical and logical characteristics".

[i.27] ISO/IEC 27005:2018: "Information technology - Security techniques - Information security risk

NOTE: Available at https://msdn.microsoft.com/en-us/library/ee823878(v=cs.20).aspx.

[i.29] ETSI TR 121 905: "Digital cellular telecommunications system (Phase 2+) (GSM); Universal

Mobile Telecommunications System (UMTS); LTE; Vocabulary for 3GPP Specifications (3GPP

administrator: user who has the highest-privilege level possible for a user of the device, which can mean they are able

associated services: digital services that, together with the device, are part of the overall consumer IoT product and that

EXAMPLE 1: Associated services can include mobile applications, cloud computing/storage and third party

EXAMPLE 2: A device transmits telemetry data to a third-party service chosen by the device manufacturer. This

EXAMPLE: An authentication mechanism can be the requesting of a password, scanning a QR code, or use of a

authentication value: individual value of an attribute used by an authentication mechanism

EXAMPLE: When the authentication mechanism is to request a password, the authentication value can be a

character string. When the authentication mechanism is a biometric fingerprint recognition, the

best practice cryptography: cryptography that is suitable for the corresponding use case and has no indications of a

NOTE 1: This does not refer only to the cryptographic primitives used, but also implementation, key generation and

NOTE 2: Multiple organizations, such as SDOs and public authorities, maintain guides and catalogues of

EXAMPLE: The device manufacturer uses a communication protocol and cryptographic library provided with

the IoT platform and where that library and protocol have been assessed against feasible attacks,

constrained device: device which has physical limitations in either the ability to process data, the ability to

communicate data, the ability to store data or the ability to interact with the user, due to restrictions that arise from its

NOTE 1: Physical limitations can be due to power supply, battery life, processing power, physical access, limited

functionality, limited memory or limited network bandwidth. These limitations can require a constrained

device to be supported by another device, such as a base station or companion device.

EXAMPLE 1: A window sensor's battery cannot be charged or changed by the user; this is a constrained device.

EXAMPLE 2: The device cannot have its software updated due to storage limitations, resulting in hardware

replacement or network isolation being the only options to manage a security vulnerability.

EXAMPLE 3: A low-powered device uses a battery to enable it to be deployed in a range of locations.

Performing high power cryptographic operations would quickly reduce the battery life, so it relies

EXAMPLE 4: The device has no display screen to validate binding codes for Bluetooth pairing.

EXAMPLE 5: The device has no ability to input, such as via a keyboard, authentication information.

NOTE 2: A device that has a wired power supply and can support IP-based protocols and the cryptographic

EXAMPLE 6: A device is mains powered and communicates primarily using TLS (Transport Layer Security).

consumer: natural person who is acting for purposes that are outside her/his trade, business, craft or profession

NOTE: Organizations, including businesses of any size, use consumer IoT. For example, Smart TVs are

frequently deployed in meeting rooms, and home security kits can protect the premises of small

consumer IoT device: network-connected (and network-connectable) device that has relationships to associated

services and are used by the consumer typically in the home or as electronic wearables

NOTE 1: Consumer IoT devices are commonly also used in business contexts. These devices remain classified as

NOTE 2: Consumer IoT devices are often available for the consumer to purchase in retail environments. Consumer

critical security parameter: security-related secret information whose disclosure or modification can compromise the

EXAMPLE: Secret cryptographic keys, authentication values such as passwords, PINs, private components of

debug interface: physical interface used by the manufacturer to communicate with the device during development or to

perform triage of issues with the device and that is not used as part of the consumer-facing functionality

defined support period: minimum length of time, expressed as a period or by an end-date, for which a manufacturer

NOTE: This definition focuses on security aspects and not other aspects related to product support such as

device manufacturer: entity that creates an assembled final consumer IoT product, which is likely to contain the

factory default: state of the device after factory reset or after final production/assembly

NOTE: This includes the physical device and software (including firmware) that is present on it after assembly.

initialization: process that activates the network connectivity of the device for operation and optionally sets

isolable: able to be removed from the network it is connected to, where any functionality loss caused is related only to

that connectivity and not to its main function; alternatively, able to be placed in a self-contained environment with other

devices if and only if the integrity of devices within that environment can be ensured

EXAMPLE: A Smart Fridge has a touchscreen-based interface that is network-connected. This interface can be

logical interface: software implementation that utilizes a network interface to communicate over the network via

manufacturer: relevant economic operator in the supply chain (including the device manufacturer)

NOTE: This definition acknowledges the variety of actors involved in the consumer IoT ecosystem and the

complex ways by which they can share responsibilities. Beyond the device manufacturer, such entities

can also be, for example and depending on a specific case at hand: importers, distributors, integrators,

component and platform providers, software providers, IT and telecommunications service providers,

network interface: physical interface that can be used to access the functionality of consumer IoT via a network

personal data: any information relating to an identified or identifiable natural person

NOTE: This term is used to align with well-known terminology but has no legal meaning within the present

physical interface: physical port or air interface (such as radio, audio or optical) used to communicate with the device

SLOVENSKI STANDARD
oSIST prEN 303 645 V2.0.0:2020
01-februar-2020
CYBER - Kibernetska varnost za uporabnike interneta stvari
CYBER - Cyber Security for Consumer Internet of Things
Ta slovenski standard je istoveten z: ETSI EN 303 645 V2.0.0 (2019-11)
ICS:
35.030 Informacijska varnost IT Security
oSIST prEN 303 645 V2.0.0:2020 en

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

The present document may be made available in electronic versions and/or in print. The content of any electronic and/or

print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any

existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI

deliverable is the one made publicly available in PDF format at www.etsi.org/deliver.

Users of the present document should be aware that the document may be subject to revision or change of status.

Information on the current status of this and other ETSI documents is available at

If you find errors in the present document, please send your comment to one of the following services:

No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying

The content of the PDF version shall not be modified without the written authorization of ETSI.

DECT™, PLUGTESTS™, UMTS™ and the ETSI logo are trademarks of ETSI registered for the benefit of its Members.

3GPP™ and LTE™ are trademarks of ETSI registered for the benefit of its Members and

oneM2M™ logo is a trademark of ETSI registered for the benefit of its Members and

Intellectual Property Rights ................................................................................................................................ 4

Foreword ............................................................................................................................................................. 4

Modal verbs terminology .................................................................................................................................... 4

Introduction ........................................................................................................................................................ 4

1 Scope ........................................................................................................................................................ 6

2 References ................................................................................................................................................ 6

2.1 Normative references ......................................................................................................................................... 6

2.2 Informative references ........................................................................................................................................ 7

3 Definition of terms, symbols and abbreviations ....................................................................................... 8

3.1 Terms .................................................................................................................................................................. 8

3.2 Symbols ............................................................................................................................................................ 11

3.3 Abbreviations ................................................................................................................................................... 11

4 Security and data protection provisions for consumer IoT..................................................................... 11

4.0 Reporting implementation ................................................................................................................................ 11

4.1 No universal default passwords ........................................................................................................................ 12

4.2 Implement a means to manage reports of vulnerabilities ................................................................................. 13

4.3 Keep software updated ..................................................................................................................................... 14

4.4 Securely store sensitive security parameters .................................................................................................... 16

4.5 Communicate securely ..................................................................................................................................... 16

4.6 Minimize exposed attack surfaces .................................................................................................................... 17

4.7 Ensure software integrity .................................................................................................................................. 18

4.8 Ensure that personal data is protected .............................................................................................................. 18

4.9 Make systems resilient to outages .................................................................................................................... 19

4.10 Examine system telemetry data ........................................................................................................................ 19

4.11 Make it easy for consumers to delete personal data ......................................................................................... 20

4.12 Make installation and maintenance of devices easy ......................................................................................... 20

4.13 Validate input data............................................................................................................................................ 21

Annex A (informative): Basic concepts and models ............................................................................ 22

A.1 Architecture ............................................................................................................................................ 22

A.2 Device states ........................................................................................................................................... 24

Annex B (informative): Implementation pro forma ............................................................................ 27

History .............................................................................................................................................................. 30

IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The information

pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found

in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in

respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web

Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee

can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web

The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners.

ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no

right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does

not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks.

This draft European Standard (EN) has been produced by ETSI Technical Committee Cyber Security (CYBER) in co-

operation with CEN/CENELEC JTC 13 (Cybersecurity and Data Protection) and is now submitted for the combined

Date of withdrawal of any conflicting National Standard (dow): 6 months after doa

In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and

"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of

"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.

As more devices in the home connect to the Internet, the cyber security of the Internet of Things (IoT) becomes a

growing concern. People entrust their personal data to an increasing number of online devices and services. Products

and appliances that have traditionally been offline are now connected and need to be designed to withstand cyber

The present document brings together widely considered good practice in security for Internet-connected consumer

devices in a set of high-level outcome-focused provisions. The objective of the present document is to support all

parties involved in the development and manufacturing of consumer IoT with guidance on securing their products.

The provisions are primarily outcome-focused, rather than prescriptive, giving organizations the flexibility to innovate

The present document is not intended to solve all security challenges associated with consumer IoT. Rather, the focus is

on the technical controls and organizational policies that matter most in addressing the most significant and widespread

security shortcomings. Overall, a baseline level of security is considered; this is intended to protect against elementary

attacks on fundamental design weaknesses (such as the use of easily guessable passwords).

As much of consumer IoT and the associated services process and store personal data, the present document can help in

ensuring that these are compliant with the General Data Protection Regulation (GDPR) [i.7]. Security by design is an

ETSI TS 103 701 [i.20] provides guidance on how to assess and assure IoT products against provisions within the

The provisions in the present document have been developed following review of published standards,

recommendations and guidance on IoT security and privacy [i.1], [i.2], [i.8], [i.9], [i.10], [i.11], [i.12], [i.20] and [i.23].

NOTE: Mappings of the landscape of IoT security standards, recommendations and guidance are available [i.14]

The present document specifies high-level provisions for the security of consumer IoT devices, that are connected to

network infrastructure (such as the Internet or home network) and their relationships to associated services. These

relationships encompass both network communications and handling of personal data. A non-exhaustive list of

• connected home automation and alarm systems, especially their gateways and hubs;

Moreover, the present document addresses constrained devices, such as sensors and actuators. Such devices typically

have limited ability to process, communicate or store data, or limited user interfaces, which affects security

EXAMPLE: Window contact sensors, flood sensors and energy switches are typically constrained devices.

The present document provides basic guidance through examples and explanatory text for organizations involved in the

development and manufacturing of consumer IoT on how to implement those provisions. Table B.1 provides a schema

Applicability of these provisions depends on risk analysis; this is performed by the device manufacturer and/or other

relevant entities and is out of scope of the present document. For certain use cases and following risk assessment, it can

be appropriate to apply additional provisions than those contained within the present document. The present document

provides a foundation level of security for such higher assurance level use cases.

IoT products primarily intended to be used in manufacturing, healthcare or for other industrial applications are not in

The present document has been developed primarily to help protect consumers, however, other users of consumer IoT

Annex A (informative) of the present document has been included to provide context to main clause 4 (normative).

Annex A contains examples of device and reference architectures, an example model of device states including data

References are either specific (identified by date of publication and/or edition number or version number) or

non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the

Referenced documents which are not found to be publicly available in the expected location might be found at

NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee

The following referenced documents are necessary for the application of the present document.

References are either specific (identified by date of publication and/or edition number or version number) or

non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the

NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee

The following referenced documents are not necessary for the application of the present document but they assist the

[i.1] ETSI TR 103 305-3: "CYBER; Critical Security Controls for Effective Cyber Defence; Part 3:

[i.2] ETSI TR 103 309: "CYBER; Secure by Default - platform security technology".

[i.3] NIST Special Publication 800-63B: "Digital Identity Guidelines - Authentication and Lifecycle

NOTE: Available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf.

[i.4] ISO/IEC 29147: "Information technology --Security techniques -- Vulnerability Disclosure".

NOTE: Available at http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.

[i.7] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and on the free

movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

[i.8] ENISA: "Baseline Security Recommendations for IoT in the context of Critical Information

[i.9] UK Department for Digital, Culture, Media and Sport: "Secure by Design: Improving the cyber

[i.10] IoT Security Foundation: "IoT Security Compliance Framework", Release 2 December 2018.

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2018/12/IoTSF-IoT-Security-

NOTE: Available at https://www.gsma.com/iot/iot-security/iot-security-guidelines/.

[i.12] ETSI TR 103 533: "SmartM2M; Security; Standards Landscape and best practices".

[i.13] Commission Notice: The "Blue Guide" on the implementation of EU products rules 2016 (Text

NOTE: Available in the Official Journal of the European Union, https://eur-lex.europa.eu/legal-

NOTE: Available at https://www.enisa.europa.eu/topics/iot-and-smart-infrastructures/iot/baseline-security-

[i.16] IoT Security Foundation: "Understanding the Contemporary Use of Vulnerability Disclosure in

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2018/11/Vulnerability-

[i.17] F-Secure: "IoT threats: Explosion of 'smart' devices filling up homes leads to increasing risks".

[i.19] ETSI TS 103 701: "CYBER; Cybersecurity assessment for consumer IoT products".

[i.20] DIN SPEC 27072: "Information Technology - IoT capable devices - Minimum requirements for

NOTE: Available at https://www.gsma.com/security/gsma-coordinated-vulnerability-disclosure-programme/.

[i.22] IoT Security Foundation: "Vulnerability Disclosure - Best Practice Guidelines".

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2017/12/Vulnerability-

NOTE: Available at https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=IoT_Top_10.

NOTE: Available at https://standards.ieee.org/content/ieee-standards/en/standard/802_15_4-2015.html.

[i.25] ETSI TS 102 221: "Smart Cards; UICC-Terminal interface; Physical and logical characteristics".

administrator: consumer who is at least intermittently a user and has the highest-privilege level in relation to the

device and is able to change any configuration related to the intended functionality

associated services: digital services that, together with the device, are part of the overall consumer IoT product and that

EXAMPLE: Associated services can include mobile applications, cloud computing/storage and third party

EXAMPLE: An authentication mechanism can be the requesting of a password, scanning a QR code, or use of a

authentication value: individual value of an attribute used by an authentication mechanism

EXAMPLE: When the authentication mechanism is to request a password, the authentication value can be a

character string. When the authentication mechanism is a biometric fingerprint recognition, the

best practice cryptography: cryptography that is suitable for the corresponding use case and has no indications of a

NOTE: This does not refer only to the cryptographic primitives used, but also implementation, key generation and

EXAMPLE: The device manufacturer uses a communication protocol and cryptographic library provided with

the IoT platform and where that library and protocol have been assessed against feasible attacks,

constrained device: device which has physical limitations in either the ability to process data, the ability to

communicate data, the ability to store data or the ability to interact with the user

NOTE: Physical limitations can be due to power supply, battery life, processing power, physical access, limited

functionality, limited memory or limited network bandwidth. These limitations can require a constrained

device to be supported by another device, such as a base station or companion device.

EXAMPLE 1: A window sensor's battery cannot be charged or changed by the user; this is a constrained device.

EXAMPLE 2: The device cannot have its software updated due to storage limitations, resulting in hardware

replacement or network isolation being the only options to manage a security vulnerability.

EXAMPLE 3: A low-powered device uses a battery to enable it to be deployed in a range of locations.

Performing high power cryptographic operations would quickly reduce the battery life, so it relies

EXAMPLE 4: The device has no display screen to validate binding codes for Bluetooth pairing.

EXAMPLE 5: The device has no ability to input, such as via a keyboard, authentication information.

consumer: natural person who is acting for purposes that are outside her/his trade, business, craft or profession

NOTE: Organizations, including businesses of any size, use consumer IoT. For example, smart TVs are

frequently deployed in meeting rooms, and home security kits can protect the premises of small

consumer IoT devices: network-connected (and network-connectable) devices that have relationships to associated

services and are used by the consumer typically in the home or as electronic wearables

NOTE: Consumer IoT devices are often available for the consumer to purchase in retail environments. Consumer

critical security parameter: security-related secret information whose disclosure or modification can compromise the

EXAMPLE: Secret cryptographic keys, authentication values such as passwords, PINs, certificates or other

defined support period: minimum length of time, expressed as a period or by an end-date, for which a device will

device manufacturer: entity that creates an assembled final consumer IoT product, which is likely to contain the

factory default: state of the device after reset or following final production/assembly

initialization: process that activates the network connectivity of the device for operation and optionally sets

isolable: able to be removed from the network it is connected to, without causing functionality loss, so that any

compromise affects only itself; alternatively, able to be placed in a self-contained environment with other devices if and

logical interface: software that utilizes a network interface to communicate over the network via channels or ports

manufacturer: relevant economic operator in the supply chain (including the device manufacturer)

NOTE: This definition acknowledges the variety of actors involved in the consumer IoT ecosystem and the

complex ways by which they can share responsibilities. Beyond the device manufacturer, such entities

can also be, for example and depending on a specific case at hand: importers, distributors, integrators,

component and platform providers, software providers, IT and telecommunications service providers,

network interface: physical interface that can be used to access the functionality of consumer IoT via a network

personal data: any information relating to an identified or identifiable natural person

physical interface: physical port or radio used to communicate with the device at the physical layer

EXAMPLE: Radios, ethernet ports, serial interfaces such as USB, and those used for debugging purposes

public security parameter: security related public information whose modification can compromise the security of a

remotely accessible: intended to be accessible via wide area networks such as the Internet

security module: set of hardware, software, and/or firmware that implements security functions

EXAMPLE: A device contains a hardware root of trust, a cryptographic software library that operates within a

trusted execution environment, and software within the operating system that enforces security

such as user separation and the update mechanism. These all make up the security module.

security update: software update that addresses security vulnerabilities either discovered by or reported to the

NOTE: Software updates can be purely security updates if the severity of the vulnerability requires a higher

sensitive security parameters: critical security parameters and public security parameters

software service: software component of a device that is used to support functionality

EXAMPLE: A runtime for the programming language used within the device software or a daemon that

telemetry: data from a device that can provide information to help the manufacturer identify issues or information

EXAMPLE: A consumer IoT device reports software malfunctions to the manufacturer enabling them to

unique per device: unique for each individual device of a given product class or type

Draft ETSI EN 303 645 V2.0.0 (2019-11)
EUROPEAN STANDARD
CYBER;
Cyber Security for Consumer Internet of Things
---------------------- Page: 1 ----------------------
2 Draft ETSI EN 303 645 V2.0.0 (2019-11)
Reference
REN/CYBER-0048
Keywords
cybersecurity, IoT, privacy
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88
Important notice
The present document can be downloaded from:
http://www.etsi.org/standards-search

The present document may be made available in electronic versions and/or in print. The content of any electronic and/or

print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any

existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI

deliverable is the one made publicly available in PDF format at www.etsi.org/deliver.

Users of the present document should be aware that the document may be subject to revision or change of status.

Information on the current status of this and other ETSI documents is available at

If you find errors in the present document, please send your comment to one of the following services:

No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying

The content of the PDF version shall not be modified without the written authorization of ETSI.

DECT™, PLUGTESTS™, UMTS™ and the ETSI logo are trademarks of ETSI registered for the benefit of its Members.

3GPP™ and LTE™ are trademarks of ETSI registered for the benefit of its Members and

oneM2M™ logo is a trademark of ETSI registered for the benefit of its Members and

Intellectual Property Rights ................................................................................................................................ 4

Foreword ............................................................................................................................................................. 4

Modal verbs terminology .................................................................................................................................... 4

Introduction ........................................................................................................................................................ 4

1 Scope ........................................................................................................................................................ 6

2 References ................................................................................................................................................ 6

2.1 Normative references ......................................................................................................................................... 6

2.2 Informative references ........................................................................................................................................ 7

3 Definition of terms, symbols and abbreviations ....................................................................................... 8

3.1 Terms .................................................................................................................................................................. 8

3.2 Symbols ............................................................................................................................................................ 11

3.3 Abbreviations ................................................................................................................................................... 11

4 Security and data protection provisions for consumer IoT..................................................................... 11

4.0 Reporting implementation ................................................................................................................................ 11

4.1 No universal default passwords ........................................................................................................................ 12

4.2 Implement a means to manage reports of vulnerabilities ................................................................................. 13

4.3 Keep software updated ..................................................................................................................................... 14

4.4 Securely store sensitive security parameters .................................................................................................... 16

4.5 Communicate securely ..................................................................................................................................... 16

4.6 Minimize exposed attack surfaces .................................................................................................................... 17

4.7 Ensure software integrity .................................................................................................................................. 18

4.8 Ensure that personal data is protected .............................................................................................................. 18

4.9 Make systems resilient to outages .................................................................................................................... 19

4.10 Examine system telemetry data ........................................................................................................................ 19

4.11 Make it easy for consumers to delete personal data ......................................................................................... 20

4.12 Make installation and maintenance of devices easy ......................................................................................... 20

4.13 Validate input data............................................................................................................................................ 21

Annex A (informative): Basic concepts and models ............................................................................ 22

A.1 Architecture ............................................................................................................................................ 22

A.2 Device states ........................................................................................................................................... 24

Annex B (informative): Implementation pro forma ............................................................................ 27

History .............................................................................................................................................................. 30

IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The information

pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found

in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in

respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web

Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee

can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web

The present document may include trademarks and/or tradenames which are asserted and/or registered by their owners.

ETSI claims no ownership of these except for any which are indicated as being the property of ETSI, and conveys no

right to use or reproduce any trademark and/or tradename. Mention of those trademarks in the present document does

not constitute an endorsement by ETSI of products, services or organizations associated with those trademarks.

This draft European Standard (EN) has been produced by ETSI Technical Committee Cyber Security (CYBER) in co-

operation with CEN/CENELEC JTC 13 (Cybersecurity and Data Protection) and is now submitted for the combined

Date of withdrawal of any conflicting National Standard (dow): 6 months after doa

In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and

"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of

"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.

As more devices in the home connect to the Internet, the cyber security of the Internet of Things (IoT) becomes a

growing concern. People entrust their personal data to an increasing number of online devices and services. Products

and appliances that have traditionally been offline are now connected and need to be designed to withstand cyber

The present document brings together widely considered good practice in security for Internet-connected consumer

devices in a set of high-level outcome-focused provisions. The objective of the present document is to support all

parties involved in the development and manufacturing of consumer IoT with guidance on securing their products.

The provisions are primarily outcome-focused, rather than prescriptive, giving organizations the flexibility to innovate

The present document is not intended to solve all security challenges associated with consumer IoT. Rather, the focus is

on the technical controls and organizational policies that matter most in addressing the most significant and widespread

security shortcomings. Overall, a baseline level of security is considered; this is intended to protect against elementary

attacks on fundamental design weaknesses (such as the use of easily guessable passwords).

As much of consumer IoT and the associated services process and store personal data, the present document can help in

ensuring that these are compliant with the General Data Protection Regulation (GDPR) [i.7]. Security by design is an

ETSI TS 103 701 [i.20] provides guidance on how to assess and assure IoT products against provisions within the

The provisions in the present document have been developed following review of published standards,

recommendations and guidance on IoT security and privacy [i.1], [i.2], [i.8], [i.9], [i.10], [i.11], [i.12], [i.20] and [i.23].

NOTE: Mappings of the landscape of IoT security standards, recommendations and guidance are available [i.14]

The present document specifies high-level provisions for the security of consumer IoT devices, that are connected to

network infrastructure (such as the Internet or home network) and their relationships to associated services. These

relationships encompass both network communications and handling of personal data. A non-exhaustive list of

• connected home automation and alarm systems, especially their gateways and hubs;

Moreover, the present document addresses constrained devices, such as sensors and actuators. Such devices typically

have limited ability to process, communicate or store data, or limited user interfaces, which affects security

EXAMPLE: Window contact sensors, flood sensors and energy switches are typically constrained devices.

The present document provides basic guidance through examples and explanatory text for organizations involved in the

development and manufacturing of consumer IoT on how to implement those provisions. Table B.1 provides a schema

Applicability of these provisions depends on risk analysis; this is performed by the device manufacturer and/or other

relevant entities and is out of scope of the present document. For certain use cases and following risk assessment, it can

be appropriate to apply additional provisions than those contained within the present document. The present document

provides a foundation level of security for such higher assurance level use cases.

IoT products primarily intended to be used in manufacturing, healthcare or for other industrial applications are not in

The present document has been developed primarily to help protect consumers, however, other users of consumer IoT

Annex A (informative) of the present document has been included to provide context to main clause 4 (normative).

Annex A contains examples of device and reference architectures, an example model of device states including data

References are either specific (identified by date of publication and/or edition number or version number) or

non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the

Referenced documents which are not found to be publicly available in the expected location might be found at

NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee

The following referenced documents are necessary for the application of the present document.

References are either specific (identified by date of publication and/or edition number or version number) or

non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the

NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee

The following referenced documents are not necessary for the application of the present document but they assist the

[i.1] ETSI TR 103 305-3: "CYBER; Critical Security Controls for Effective Cyber Defence; Part 3:

[i.2] ETSI TR 103 309: "CYBER; Secure by Default - platform security technology".

[i.3] NIST Special Publication 800-63B: "Digital Identity Guidelines - Authentication and Lifecycle

NOTE: Available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf.

[i.4] ISO/IEC 29147: "Information technology --Security techniques -- Vulnerability Disclosure".

NOTE: Available at http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.

[i.7] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal data and on the free

movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

[i.8] ENISA: "Baseline Security Recommendations for IoT in the context of Critical Information

[i.9] UK Department for Digital, Culture, Media and Sport: "Secure by Design: Improving the cyber

[i.10] IoT Security Foundation: "IoT Security Compliance Framework", Release 2 December 2018.

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2018/12/IoTSF-IoT-Security-

NOTE: Available at https://www.gsma.com/iot/iot-security/iot-security-guidelines/.

[i.12] ETSI TR 103 533: "SmartM2M; Security; Standards Landscape and best practices".

[i.13] Commission Notice: The "Blue Guide" on the implementation of EU products rules 2016 (Text

NOTE: Available in the Official Journal of the European Union, https://eur-lex.europa.eu/legal-

NOTE: Available at https://www.enisa.europa.eu/topics/iot-and-smart-infrastructures/iot/baseline-security-

[i.16] IoT Security Foundation: "Understanding the Contemporary Use of Vulnerability Disclosure in

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2018/11/Vulnerability-

[i.17] F-Secure: "IoT threats: Explosion of 'smart' devices filling up homes leads to increasing risks".

[i.19] ETSI TS 103 701: "CYBER; Cybersecurity assessment for consumer IoT products".

[i.20] DIN SPEC 27072: "Information Technology - IoT capable devices - Minimum requirements for

NOTE: Available at https://www.gsma.com/security/gsma-coordinated-vulnerability-disclosure-programme/.

[i.22] IoT Security Foundation: "Vulnerability Disclosure - Best Practice Guidelines".

NOTE: Available at https://www.iotsecurityfoundation.org/wp-content/uploads/2017/12/Vulnerability-

NOTE: Available at https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=IoT_Top_10.

NOTE: Available at https://standards.ieee.org/content/ieee-standards/en/standard/802_15_4-2015.html.

[i.25] ETSI TS 102 221: "Smart Cards; UICC-Terminal interface; Physical and logical characteristics".

administrator: consumer who is at least intermittently a user and has the highest-privilege level in relation to the

device and is able to change any configuration related to the intended functionality

associated services: digital services that, together with the device, are part of the overall consumer IoT product and that

EXAMPLE: Associated services can include mobile applications, cloud computing/storage and third party

EXAMPLE: An authentication mechanism can be the requesting of a password, scanning a QR code, or use of a

authentication value: individual value of an attribute used by an authentication mechanism

EXAMPLE: When the authentication mechanism is to request a password, the authentication value can be a

character string. When the authentication mechanism is a biometric fingerprint recognition, the

best practice cryptography: cryptography that is suitable for the corresponding use case and has no indications of a

NOTE: This does not refer only to the cryptographic primitives used, but also implementation, key generation and

EXAMPLE: The device manufacturer uses a communication protocol and cryptographic library provided with

the IoT platform and where that library and protocol have been assessed against feasible attacks,

constrained device: device which has physical limitations in either the ability to process data, the ability to

communicate data, the ability to store data or the ability to interact with the user

NOTE: Physical limitations can be due to power supply, battery life, processing power, physical access, limited

functionality, limited memory or limited network bandwidth. These limitations can require a constrained

device to be supported by another device, such as a base station or companion device.

EXAMPLE 1: A window sensor's battery cannot be charged or changed by the user; this is a constrained device.

EXAMPLE 2: The device cannot have its software updated due to storage limitations, resulting in hardware

replacement or network isolation being the only options to manage a security vulnerability.

EXAMPLE 3: A low-powered device uses a battery to enable it to be deployed in a range of locations.

Performing high power cryptographic operations would quickly reduce the battery life, so it relies

EXAMPLE 4: The device has no display screen to validate binding codes for Bluetooth pairing.

EXAMPLE 5: The device has no ability to input, such as via a keyboard, authentication information.

consumer: natural person who is acting for purposes that are outside her/his trade, business, craft or profession

NOTE: Organizations, including businesses of any size, use consumer IoT. For example, smart TVs are

frequently deployed in meeting rooms, and home security kits can protect the premises of small

consumer IoT devices: network-connected (and network-connectable) devices that have relationships to associated

services and are used by the consumer typically in the home or as electronic wearables

NOTE: Consumer IoT devices are often available for the consumer to purchase in retail environments. Consumer

critical security parameter: security-related secret information whose disclosure or modification can compromise the

EXAMPLE: Secret cryptographic keys, authentication values such as passwords, PINs, certificates or other

defined support period: minimum length of time, expressed as a period or by an end-date, for which a device will

device manufacturer: entity that creates an assembled final consumer IoT product, which is likely to contain the

factory default: state of the device after reset or following final production/assembly

initialization: process that activates the network connectivity of the device for operation and optionally sets

isolable: able to be removed from the network it is connected to, without causing functionality loss, so that any

compromise affects only itself; alternatively, able to be placed in a self-contained environment with other devices if and

logical interface: software that utilizes a network interface to communicate over the network via channels or ports

manufacturer: relevant economic operator in the supply chain (including the device manufacturer)

NOTE: This definition acknowledges the variety of actors involved in the consumer IoT ecosystem and the

complex ways by which they can share responsibilities. Beyond the device manufacturer, such entities

can also be, for example and depending on a specific case at hand: importers, distributors, integrators,

component and platform providers, software providers, IT and telecommunications service providers,

network interface: physical interface that can be used to access the functionality of consumer IoT via a network

personal data: any information relating to an identified or identifiable natural person

physical interface: physical port or radio used to communicate with the device at the physical layer

EXAMPLE: Radios, ethernet ports, serial interfaces such as USB, and those used for debugging purposes

public security parameter: security related public information whose modification can compromise the security of a

remotely accessible: intended to be accessible via wide area networks such as the Internet

security module: set of hardware, software, and/or firmware that implements security functions

EXAMPLE: A device contains a hardware root of trust, a cryptographic software library that operates within a

trusted execution environment, and software within the operating system that enforces security

such as user separation and the update mechanism. These all make up the security module.

security update: software update that addresses security vulnerabilities either discovered by or reported to the

NOTE: Software updates can be purely security updates if the severity of the vulnerability requires a higher

sensitive security parameters: critical security parameters and public security parameters

software service: software component of a device that is used to support functionality

EXAMPLE: A runtime for the programming language used within the device software or a daemon that

telemetry: data from a device that can provide information to help the manufacturer identify issues or information

EXAMPLE: A consumer IoT device reports software malfunctions to the manufacturer enabling them to

unique per device: unique for each individual device of a given product class or type