PSTIA 2024: Enhancing UK Cybersecurity – What You Need to Know

Posted on by Bogdan Tiron
REGULATIONS PSTIA 2024 UK Product Security and Telecommunications Infrastructure Act 1 No Defaults Ban universal passwords 2 Vulnerability Disc. Public disclosure policy 3 Security Updates Defined support period 4 Compliance Statement of compliance IoT Devices Smart Home Wearables Connected Toys Routers & Hubs fortbridge.co.uk

The UK Product Security and Telecommunications Infrastructure Act (PSTIA) came into force on 29 April 2024. It sets security requirements for manufacturers, importers, and distributors of connectable products sold across the UK.

Table of contents

What PSTIA Is

PSTIA applies to “relevant connectable products” – devices that are internet-connectable or network-connectable. This includes IoT devices, smart home products, wearables, and routers. Schedule 3 exempts medical devices, smart meters, EV charge points, and desktop/laptop computers.

Security Requirements

Schedule 1 of the Act defines three mandatory security requirements for manufacturers:

  • No default passwords – Passwords must be unique per product or user-defined during setup. Universal defaults are banned.
  • Vulnerability disclosure policy – Manufacturers must publish a contact point for reporting security issues and provide updates until resolution. The process must be free and in English.
  • Minimum security update period – Manufacturers must publish a defined support period, displayed at the point of sale. It cannot be shortened after publication.

Manufacturers must also produce a statement of compliance (Schedule 4) and retain it for the longer of 10 years or the defined support period.

PSTIA 2024 – Product Scope Decision Tree Is your product covered by the Product Security and Telecommunications Infrastructure Act? Is your product connectable? YES NO Product is NOT connectable PSTIA does not apply What type of connectivity? Internet or Network connectable Internet-connectable Network-connectable Is it an excepted product? (per Schedule 3 of the Act) YES NO Product is Exempt from PSTIA requirements (See Schedule 3 list below) PSTIA Applies Must comply with Schedule 1 security requirements Schedule 3 – Excepted Products Medical devices (Regulated under medical device legislation) Smart meters (Under smart metering regulation) Electric vehicle charge points (Regulated separately) Computers – desktops, laptops, tablets (Without cellular connectivity) Northern Ireland products (Under Windsor Framework – EU regulations apply) Connectable means: Internet-connectable: Can connect to the internet Network-connectable: Can connect to other devices via network (not internet) Schedule 1 Requirements: No default passwords Security issue reporting Minimum security update period
PSTIA 2024 – Three Core Security Requirements Schedule 1 of the Product Security and Telecommunications Infrastructure Act Mandatory for all relevant connectable products in the UK 1 Passwords Condition 1 – Passwords & Credentials Unique per product Each device must have a unique default password, or require user-defined setup Not easily guessable Passwords must not be predictable or based on incremental counters No universal defaults Factory-set passwords like “admin” or “password” are banned User-defined option Users may define their own credentials during initial product setup 2 Security Issue Reporting Condition 2 – Vulnerability Disclosure Clear contact point Published information on how to report security issues to the manufacturer Acknowledgment & updates Reports must be acknowledged and status updates provided to reporters Free to report No charge for making a report; reporting must be accessible In English, no ID required Available in English; no personal details required to submit a report 3 Security Update Periods Condition 3 – Minimum Support Period Published support period Defined minimum period for which security updates will be provided Timely security updates Updates must be delivered without undue delay during support period Prominently displayed Support period must be visible at point of sale and on website Accessible & understandable Information must be clear to consumers without technical expertise

Penalties

The Secretary of State can issue penalty notices for non-compliance:

  • Maximum penalty: the greater of £10 million or 4% of annual worldwide revenue
  • Daily penalties of up to £20,000 for continuing breaches
  • Penalties apply to manufacturers, importers, and distributors
  • For group companies, penalties can be based on total worldwide group revenue
PSTIA 2024 – Penalty Framework Enforcement powers and financial penalties for non-compliance ! MAXIMUM PENALTY £10 Million or 4% of annual worldwide revenue whichever amount is greater Who can be penalised: Manufacturers – primary compliance obligation Importers – must verify manufacturer compliance Distributors – must not supply non-compliant products Daily Penalties For continuing breaches £20,000 per day Accumulates for each day the breach continues unresolved. Applied after initial penalty notice. Group Companies Revenue aggregation rules Total worldwide group revenue used to calculate 4% threshold Parent & subsidiary revenues combined Prevents penalty avoidance through corporate restructuring Consistent with GDPR approach Enforcement Process Penalty notice procedure 1 Compliance notice issued 2 Penalty notice by Secretary of State 3 Proportionality assessment Penalties must be proportionate to the severity of the breach Enforced by the Secretary of State for Science, Innovation and Technology Applies from 29 April 2024 onwards

Relationship with Other Frameworks

Organisations operating across borders should also consider the EU’s DORA regulation for financial sector resilience and the NIS 2 Directive for network and information security across the EU.

How FORTBRIDGE Can Help

FORTBRIDGE provides penetration testing for IoT and connected product manufacturers to validate PSTIA compliance. Our CREST-accredited team tests for default credential issues, vulnerability disclosure processes, and update mechanisms. Contact us to discuss your testing needs.

About Post Author

Bogdan Tiron

Cloud Application Security Consultant/ Pentester

OSCP/CRT/GCP Architecture/GCP Security/DevSecOps

See author's posts