Cybersecurity testing and regulatory compliance for connected products

Starting from whether your product falls under Annex III/IV and which conformity assessment procedure applies, we build the risk assessment, technical documentation (Annex VII) and vulnerability handling process.

• Product classification and assessment route
• Annex I essential requirements gap analysis
• Technical documentation and EU DoC
• Support period and SBOM policy

Testing against the Annex I essential cybersecurity requirements, plus a process audit covering the Part II vulnerability handling requirements.

• Secure configuration, authentication and access control
• Cryptography and data protection
• Attack surface, logging and monitoring
• Penetration testing and fuzzing

The harmonised standards for the cybersecurity articles of the Radio Equipment Directive, covering network protection, personal data protection and fraud prevention.

• IXIT preparation and review
• Conceptual assessment and functional testing
• Decision-tree verdicts and justified non-applicability
• Mapping to EN 303 645

The most widely adopted baseline for consumer IoT security and the technical basis for several national labelling schemes.

• 13 provisions and 67 requirements
• TS 103 701 test specification
• Mapping to CNS 16190

Secure development process and component security requirements for industrial automation and control systems.

• 4-1 secure development lifecycle
• 4-2 component security levels SL 1–4
• Gap analysis and implementation

Japan's IoT security conformity labelling scheme led by IPA. Level ★1 is a self-declaration; higher levels bring in third-party assessment, and the scheme is progressively referenced in government procurement.

• ★1 self-declaration documentation
• Conformity confirmation and filing
• Mapping to EN 303 645 requirements

The US wireless industry association's certification for cellular-connected IoT devices, in three levels, tested by authorised laboratories against the CTIA test plan.

• Level 1 / 2 / 3 testing
• CTIA test plan gap analysis
• Alignment with carrier acceptance requirements

The FCC's voluntary cybersecurity label for consumer IoT, with criteria based on NIST IR 8425; testing by a CyberLAB and the label issued by a CLA.

• NIST IR 8425 gap analysis
• Pre-test documentation
• Guidance through the label application

Data access and portability obligations for connected products, covering access by design, user data sharing and cloud switching.

• Scope determination for your product
• Art. 3 access-by-design verification
• User information disclosure checklist
• Technical verification and documentation

Australia's Code of Practice for consumer IoT security — 13 principles aligned with EN 303 645. Voluntary today, and the practical baseline for entering the Australian market.

• Gap analysis against the 13 principles
• Shared test evidence with EN 303 645
• Voluntary statement of compliance

Three mandatory security requirements for UK consumer connectable products — non-compliant products may not be made available on the UK market.

• No universal default passwords
• Vulnerability disclosure contact point
• Published minimum security update period
• Statement of compliance (SoC)