IoT security standards and laws explained

IoT security standards are the published baselines that say what a connected device should do to be reasonably secure: no shared default passwords, a way to report vulnerabilities, security updates for a stated period, and a short list of other basics. Some are voluntary, such as ETSI EN 303 645 and NIST’s IoT publications. Others are law: California’s connected device statute, the UK’s PSTI regime and the EU’s Cyber Resilience Act. This guide maps which rule applies where, who it binds and from what date, then sets out what a buyer should look for and what a builder can do once to meet most of them. It sits with the IoT security guides, next to IoT device security basics and what a smart home is.

Which rule applies where

The rules split by market and by force. A standard is a document a maker can choose to follow. A law, or a regulation made under one, binds whoever it names, usually the maker and often the importer and the shop as well. Buyers carry no duty under any of the rules below, but the information the laws force makers to publish is written for buyers.

ETSI EN 303 645, the consumer IoT baseline

ETSI EN 303 645 is the European Standard for consumer IoT security, published by ETSI, the European Telecommunications Standards Institute. The current version on ETSI’s deliver page is V3.1.3, dated September 2024 and titled “Cyber Security for Consumer Internet of Things: Baseline Requirements”. Its scope lists devices such as connected toys and baby monitors, smoke detectors and door locks, smart cameras, speakers and TVs, wearable health trackers, home automation hubs and connected appliances.

Apart from a reporting provision (5.0), the security provisions sit in 13 groups:

1. No universal default passwords
2. Implement a means to manage reports of vulnerabilities
3. Keep software updated
4. Securely store sensitive security parameters
5. Communicate securely
6. Minimize exposed attack surfaces
7. Ensure software integrity
8. Ensure that personal data is secure
9. Make systems resilient to outages
10. Examine system telemetry data
11. Make it easy for users to delete user data
12. Make installation and maintenance of devices easy
13. Validate input data

The first three carry the provisions most often quoted. Provision 5.1-1 says passwords, outside the factory default state, “shall be unique per device or defined by the user”. Provision 5.2-1 says the maker shall publish a vulnerability disclosure policy that includes, at a minimum, contact information for reporting issues. Provision 5.3-13 says the maker shall publish the defined support period, the minimum length of time for which it will provide security updates. A separate clause adds data protection provisions. The standard itself is voluntary. A maker can follow it to show good practice, and the same three ideas reappear in the laws below.

NIST IR 8259, 8259A and 8425

NIST, the US National Institute of Standards and Technology, publishes the US baseline in three linked documents. None of them is a law.

• NIST IR 8259 describes cybersecurity activities a maker should consider before a product is sold. The May 2020 edition was withdrawn on April 20, 2026 and replaced by NIST IR 8259 Rev. 1, “Foundational Cybersecurity Activities for IoT Product Manufacturers”, published April 2026.
• NIST IR 8259A, the core baseline from May 2020, defines the device capabilities generally needed to support common security controls. Its Table 1 lists six: device identification, device configuration, data protection, logical access to interfaces, software update, and cybersecurity state awareness.
• NIST IR 8425, the consumer IoT profile from September 2022, applies the core baseline to consumer products. NIST wrote it in response to Executive Order 14028, phrases its capabilities as outcomes for the whole product, including its app and backend, and says it can also be a starting point for small businesses buying IoT products.

IR 8425 matters beyond its own pages because the FCC’s label program uses it. The FCC’s 2024 order tells the lead administrator to identify standards and testing procedures that can show a product meets the NISTIR 8425 criteria.

The US Cyber Trust Mark, and where it stands in 2026

The FCC adopted the U.S. Cyber Trust Mark program on March 14, 2024 in its IoT labeling Report and Order. The order says plainly that the program is voluntary. It covers consumer IoT products that are wireless intentional radiators, which means devices that emit radio frequency energy on purpose, such as Wi-Fi or Bluetooth devices. A product that qualifies would carry the FCC IoT Label: the Cyber Trust Mark plus a QR code that leads to a registry with information about the product. The registry entry is meant to show, among other things, how to change the default password, whether software updates are automatic and how to get them if not, and the date until which the maker promises to find critical vulnerabilities and issue fixes, or a statement that the product is unsupported. Products are tested by a recognized lab, and a Cybersecurity Label Administrator (CLA) then grants or denies use of the label.

What the FCC’s own documents show about its status in 2026:

• The first lead administrator left. The FCC’s January 26, 2026 notice records that UL Solutions, chosen in December 2024, withdrew as lead administrator effective December 19, 2025.
• A new one was named. On April 13, 2026 the FCC selected ioXt Alliance as lead administrator and said it looks forward to working with ioXt “to finalize implementation of the program”. The public notice adds that the previous lead administrator’s recommendations are under review by FCC staff and will be put out for public comment.
• No label approvals yet, as of August. The FCC’s August 11, 2026 notice conditionally approved two more label administrators and states that conditionally approved administrators “are not authorized by the Commission to approve the use of the FCC IoT Label”. Their full approval depends on steps tied to the Commission adopting labeling standards and testing procedures.

As of October 23, 2026, no later FCC notice adopting those standards or announcing a labeled product could be found, and the FCC’s program page could not be loaded to check. If you see the mark on a box, scan the QR code and check that the registry entry exists.

California’s connected device law (SB 327)

Civil Code section 1798.91.04, added by SB 327 and a companion bill, AB 1906, requires the maker of a connected device to equip it with reasonable security features suited to the device and the data it handles. The title became operative on January 1, 2020.

For a device that can be logged into from outside the local network, the law gives a safe harbor: the device meets the requirement if each unit ships with its own unique preset password, or if it makes the user create new login details before first access. Since an amendment effective January 1, 2023, a maker may also comply by meeting the baseline criteria of a NIST conforming labeling scheme, passing that scheme’s third-party assessment and carrying its label.

A few limits matter to sellers. The law binds the manufacturer, defined in SB 327 as whoever makes or contracts to make devices sold in California; a contract only to buy and brand a device does not count. It gives no private right of action. Enforcement belongs to the Attorney General, city attorneys, county counsel and district attorneys.

The UK PSTI regime

The UK’s Product Security and Telecommunications Infrastructure regime came into effect on April 29, 2024, under the PSTI Act 2022 and regulations that extend to England, Wales, Scotland and Northern Ireland, with some exceptions for products supplied in Northern Ireland. Schedule 1 sets three requirements for consumer connectable products:

1. Passwords must be unique per product or defined by the user, and unique passwords must not be built from incremental counters, public information or unprotected product identifiers.
2. Reporting security issues: the maker must publish at least one point of contact, and say when a reporter will get an acknowledgment and status updates.
3. Minimum security update periods: the defined support period must be published in a way that is accessible, clear and transparent, and shortening it after publication breaks the requirement.

The government’s guidance says manufacturers, importers and distributors, meaning retailers, all have duties, and that some products are outside the regulations, including electric vehicle charge points, medical devices and smart meter products. The Office for Product Safety and Standards enforces the regime.

The EU Cyber Resilience Act and the radio equipment rules

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, sets cybersecurity requirements for hardware and software “products with digital elements”. The Commission’s page gives the dates: the act entered into force on December 10, 2024, its reporting obligations apply from September 11, 2026, and its main obligations from December 11, 2027. The regulation adds that its provisions on notifying conformity assessment bodies, the outside bodies that assess some products, applied from June 11, 2026.

What it asks for, from the regulation text:

• At sale, products must have no known exploitable vulnerabilities and a secure default configuration, must be able to receive security updates (automatic by default where applicable, with an opt-out), and must be built to limit attack surfaces (Annex I).
• A support period of at least five years, unless the product is expected to be in use for less (Article 13). The end date, at least the month and year, must be shown clearly at the time of purchase.
• Reporting: a maker must notify any actively exploited vulnerability it learns of, with an early warning within 24 hours and a fuller notification within 72 hours, through a single EU reporting platform (Article 14). Severe incidents affecting a product’s security are reported too. This is the part that already applies.
• Importers and distributors, from December 11, 2027: importers may place only compliant products on the market (Article 19), and distributors must act with due care and check, among other things, that the product bears the CE marking (Article 20). For radio equipment, the Radio Equipment Directive already puts the same two duties on importers and distributors (Articles 12 and 13).

Radio products already have EU cybersecurity rules. Delegated Regulation (EU) 2022/30 switches on three essential requirements of the Radio Equipment Directive (RED) for listed categories of radio equipment: protecting the network, protecting personal data and privacy, and protecting against fraud. A later regulation moved its start to August 1, 2025. The matching standards are EN 18031-1, -2 and -3, whose references the Commission published with restrictions in Implementing Decision (EU) 2025/138. One restriction: clauses that let a user skip setting any password do not count toward conformity. Because the CRA covers the same ground, the Commission’s radio equipment page says it adopted a repeal of the RED cybersecurity regulation on February 16, 2026, effective December 11, 2027, the date the CRA takes full effect.

ISA/IEC 62443 for industrial systems

Factory and utility equipment has its own family. ISA/IEC 62443 is a series of standards and technical reports on the security of industrial automation and control systems across their lifecycle. ISA addresses it to asset owners, automation product suppliers, the integrators who build control systems, and the service suppliers who support them. The industrial IoT guides cover the systems it applies to, starting with what an industrial IoT system is made of.

What to look for when you buy a connected device

None of these rules puts a duty on the buyer, but they make makers publish information you can use. Before you buy a camera, a smart lock or a connected device for the office, check the product page and the box for:

• A support period with an end date. UK law already requires it to be published, and the CRA will require at least the month and year at the time of purchase. If support ends soon, plan to move the device to its own network or replace it when it does. The firmware updates guide explains what a good update mechanism looks like.
• A way to report vulnerabilities. A published security contact or disclosure policy shows the maker has a process for fixing reported problems.
• No shared default password. The device should ship with a unique password or make you set one. Change it anyway, as the security basics guide explains.
• A label, where one exists. In the US that would be the Cyber Trust Mark once products are approved to carry it; scan the QR code and read the registry entry. In the EU, look for the CE marking; distributors of radio products already have to check for it under the RED, and from December 11, 2027 the CRA will require it for most products with digital elements.

After purchase, the same habits apply whatever the label says: put the device on a separate network and keep its firmware current.

For builders: most rules ask for the same things

If you build or sell a connected product into the US, UK and EU, the overlap is large. Read side by side, the rules come back to a handful of items:

1. Unique or user-set passwords. ETSI provision 5.1-1, UK Schedule 1, California’s safe harbor and the EN 18031 restriction on skipping passwords all point the same way.
2. A published way to report vulnerabilities, and a process behind it. ETSI 5.2-1 and the UK rules require the contact; the CRA adds 24-hour and 72-hour reporting of actively exploited vulnerabilities.
3. Security updates for a stated period. ETSI 5.3-13 and the UK require a published support period, the CRA sets a five-year floor in most cases, and the FCC registry would show the support end date.
4. Secure defaults and a small attack surface. ETSI’s “minimize exposed attack surfaces” and the CRA’s Annex I both cover services left on by default, such as the router port requests described in the UPnP guide. The common weaknesses these rules target are covered in the guide to IoT vulnerabilities.

Building to ETSI EN 303 645 covers most of that list. The CRA then adds its own paperwork, its reporting duty and CE marking for the EU market, and the Cyber Trust Mark, once products can be approved to carry it, adds testing against the NIST IR 8425 criteria for makers who choose it.

For more on securing the devices themselves, start with IoT device security basics and the rest of the IoT security guides.