# Security baselines and the law

Several countries now have security rules for connected products. The basic requirements are short and specific.

Page: https://dharanova.com/learn/iot-security-rules · Track: Secure · Level: Deep dive · Facts last checked 7 October 2026

Read first: [Secure boot and the root of trust](https://dharanova.com/learn/secure-boot.md), [Over-the-air updates](https://dharanova.com/learn/ota-updates.md)

Diagram: A timeline from 2024 to 2027: the UK PSTI regime in force on 29 April 2024; the EU Cyber Resilience Act enters into force on 10 December 2024; EU Radio Equipment Directive security rules from 1 August 2025; CRA reporting duties for vulnerabilities and incidents apply from 11 September 2026, already the case in October 2026; the CRA's main requirements from 11 December 2027, replacing the RED rules. Below, ETSI EN 303 645's first provisions: no universal default passwords, a way to report vulnerabilities, keep software updated. India's NCCS publishes ITSARs for testing and certification.

## Key points

1. ETSI EN 303 645 is a European baseline for consumer IoT security. Its first provisions are no universal default passwords, a way to report vulnerabilities, and keeping software updated. [1]
2. The UK Product Security and Telecommunications Infrastructure regime, in force since 29 April 2024, bans universal default passwords on consumer connectable products and requires a vulnerability-reporting contact and a stated minimum security-update period. (as of 6 October 2026) [2][3]
3. The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers' vulnerability- and incident-reporting obligations have applied since 11 September 2026, and its main requirements apply from 11 December 2027. (as of 6 October 2026) [4][5]
4. Since 1 August 2025, EU radio equipment that connects to the internet, plus radio toys, childcare products and wearables handling personal data, must meet Radio Equipment Directive security rules. EN 18031 standards are one way to comply, with restrictions. The Cyber Resilience Act takes over on 11 December 2027. (as of 6 October 2026) [6][7][8]
5. In India, the National Centre for Communication Security (NCCS) under the Department of Telecommunications publishes Indian Telecom Security Assurance Requirements (ITSARs), used for security testing and certification. Notified ITSARs cover IoT devices such as smart cameras and smart meters. (as of 6 October 2026) [9]

## Where to go next

- [Device-to-app sync for VAHA: architecture, and the integrity and security of the current build](https://dharanova.com/whitepapers/vaha-device-to-app-sync-integrity-security.md): a whitepaper from our lab
- [BLE application-layer authentication with ECDSA certificate chains on ESP32-C3](https://dharanova.com/whitepapers/ble-certificate-authentication.md): a whitepaper from our lab

## Sources

1. [ETSI EN 303 645 V3.1.3 (2024-09): Cyber Security for Consumer Internet of Things: Baseline Requirements](https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf), ETSI
2. [The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023](https://www.legislation.gov.uk/uksi/2023/1007/contents/made), UK Government (legislation.gov.uk)
3. [The UK Product Security and Telecommunications Infrastructure (Product Security) regime](https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime), UK Department for Science, Innovation and Technology (GOV.UK)
4. [Cyber Resilience Act](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act), European Commission
5. [Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 71](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng), EUR-Lex (Official Journal of the EU)
6. [Radio Equipment Directive (RED)](https://single-market-economy.ec.europa.eu/sectors/electrical-and-electronic-engineering-industries-eei/radio-equipment-directive-red_en), European Commission
7. [Commission Implementing Decision (EU) 2025/138 (EN 18031-1/2/3 cited with restrictions)](https://eur-lex.europa.eu/eli/dec_impl/2025/138/oj), EUR-Lex (Official Journal of the EU)
8. [Commission Delegated Regulation (EU) 2026/339 repealing Delegated Regulation (EU) 2022/30](https://eur-lex.europa.eu/eli/reg_del/2026/339/oj/eng), EUR-Lex (Official Journal of the EU)
9. [Notified ITSARs (Indian Telecom Security Assurance Requirements)](https://nccs.gov.in/home/itsars), National Centre for Communication Security (NCCS), Department of Telecommunications, India