The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023

Interpretation

2.—(1) In these Regulations—

“defined support period” means the minimum length of time, expressed as a period of time with an end date, for which security updates will be provided;

“ETSI EN 303 645” means the European Standard on Cyber Security for Consumer Internet of Things: Baseline Requirements (ETSI EN 303 645 V2.1.1 (19th June 2020))(1);

“hardware” means a physical electronic information system, or parts thereof, capable of processing, storing or transmitting digital data;

“ISO/IEC 29147” means the ISO/IEC 29147:2018 Information technology - Security techniques - Vulnerability disclosure standard (2nd edition, 2018)(2);

“manufacturer’s intended purpose” means the use for which the product is intended according to the data provided by the manufacturer, including on the label, in the instructions for use, or in promotional or sales materials or statements;

“security update” means a software update that protects or enhances the security of a product, including a software update that addresses security issues which have been discovered by or reported to the manufacturer.

(2) References in these Regulations to sections, except where otherwise specified, are to sections of the Product Security and Telecommunications Infrastructure Act 2022.

(1)

The European Standard on Cyber Security for Consumer Internet of Things: Baseline Requirements (ETSI EN 303 645 V2.1.1 (19th June 2020)) is the standard set by the European Telecommunications Standards Institute for standardisation of Cyber Security for Consumer Internet of Things Products. The standard is available free of charge at https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02.01.01_60/en_303645v020101p.pdf. A copy can also be inspected free of charge by appointment by contacting the Office for Product Safety and Standards at Stanton Avenue, Teddington, Middlesex, TW11 0JZ or by email at [e-mail].

(2)

The ISO/IEC 29147:2018 Information technology - Security techniques - Vulnerability disclosure standard (2nd edition, 2018) is the standard set by the International Organization for standardisation, among other things, for vulnerability disclosure. A copy can be inspected free of charge by appointment by contacting the Office for Product Safety and Standards at Stanton Avenue, Teddington, Middlesex, TW11 0JZ or by email at [e-mail].