Subject: [Iot-directorate] Consumer IoT Security standard "released"

From: Michael Richardson <[email-masked]>
Date: Wed, 01 Jul 2020 11:22:56 -0400

The document is at:
   https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02.01.00_30/en_303645v020100v.pdf

This largely parallels various legislation (California, Oregon, Australia)
which has made similar requests.  Unfortunately in my view, none of the
legislation has any clear consequences at the regulatory side.
That is, it appears that California has to wait for an incident to occur, and
then they can sue for damages, which are not limited in anyway.
Whether that will be sufficient deterent to get revisions made to product
development priorities, I don't know.

"The ETSI Technical Committee on Cybersecurity (TC CYBER) today unveils ETSI
EN 303 645, a standard for cybersecurity in the Internet of Things that
establishes a security baseline for internet-connected consumer products and
provides a basis for future IoT certification schemes. Based on the ETSI
specification TS 103 645, EN 303 645 went through National Standards
Organization comments and voting, engaging even more stakeholders in its
development and ultimately strengthening the resulting standard. The EN is a
result of collaboration and expertise from industry, academics and
government. "

https://www.etsi.org/newsroom/press-releases/1789-2020-06-etsi-releases-world-leading-consumer-iot-security-standard?jjj=1593504605963

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-