We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

By Sorena AIPublished Updated

ETSI EN 303 645

ETSI EN 303 645

Plain-language guide to the voluntary ETSI EN 303 645 security baseline, including scope, provisions, evidence, assessment, and claim limits.

Topics
18
FAQs
8
Comparisons
3
Updated
2026

Understand ETSI EN 303 645

ETSI EN 303 645 is a voluntary, outcome-focused security and data-protection baseline for network-connected devices and their interactions with . It is not itself a law, certification scheme, or guarantee that a product is secure.

Start with the product boundary and applicable provisions, then build implementation evidence. The guides keep the EN baseline separate from ETSI TS 103 701 assessment mechanics and from any law or assurance scheme that may use related evidence.

The provision guides use EN 303 645 V3.1.3 (2024-09), the latest edition listed in ETSI's EN 303 645 deliver directory when checked on 25 July 2026. TS 103 701 V2.1.1 (2025-05) names that edition as a normative reference. Neither document is legislation or a product certificate; a buyer, law, laboratory, or assurance scheme may specify another edition or add binding criteria.

Quick scan

Requirements map

Trace the baseline provision areas and their legal force: passwords, vulnerability reports, updates, secure storage, communications, attack surface, software integrity, personal data, outages, telemetry, data deletion, setup, and input validation. Annex B marks provisions as mandatory or recommended and may also make them conditional or feature-dependent.

Implementation checklist

Turn each provision into product, firmware, cloud-service, mobile-app, support, and documentation work that can be reviewed before assessment.

TS 103 701 evidence workflow

Plan DUT scope, supplier organization records, test laboratory inputs, applicability statements, details, conceptual checks, functional checks, and verdict handling.

Product and assessment decisions

  1. 1

    Which provisions apply

    Confirm that the network-connected product is typically used by consumers in the home or as an electronic wearable, identify the device and its interactions with required , then document mandatory, recommended, conditional, and feature-dependent decisions. A business deployment of a consumer product can remain in scope; a product primarily intended for manufacturing, healthcare, or another industrial use is outside the standard's stated scope.

  2. 2

    What evidence to collect

    Prepare an Annex B implementation conformance statement for every provision, with Y, N, or permitted N/A status and concrete detail. For assessment, add TS 103 701 records that identify mechanisms, interfaces, documents, processes, and test inputs for the exact device model, software release, and associated-service boundary.

  3. 3

    How assessment should run

    The supplier organization identifies the and supplies the and ; the test laboratory verifies the claims, derives a product-specific test plan, performs conceptual and functional checks, and assigns test-case, test-group, and overall verdicts. The TS supplies a method, not a certification scheme.

Choose the next consumer IoT security decision

New to the standard? Start with product scope. If the boundary is already documented, jump to the provision, implementation workflow, evidence pack, version check, or comparison you need.

Start here: product scope and applicability

Decide whether the product is , distinguish the physical device from its , identify constrained-device facts, and record the assessment boundary.

Understand the provisions

Read the outcome-focused baseline before converting it into controls, including the password, update, vulnerability, data-protection, telemetry, and deletion provisions.

Implement product and process changes

Turn the applicable provisions into owned engineering, product-support, secure-update, and coordinated-vulnerability-disclosure work.

Prepare assessment evidence

Connect the exact to implementation statements, detail, conceptual and functional checks, verdicts, and appropriately scoped external evidence.

Check versions, comparisons, and focused questions

Verify the edition being used, understand what evidence can transfer to legal regimes, and answer a specific product or assessment question without treating the standard as law or certification.

Sources

ETSI EN 303 645 deliver directory
etsi.org
Referenced sections
  • Official directory used on 25 July 2026 to confirm that 03.01.03_60 was the latest listed EN 303 645 edition.
ETSI intellectual property rights database
ipr.etsi.org
Referenced sections
  • Supports ETSI's notice that essential or potentially essential IPR information for normative deliverables is published through the ETSI IPR service.
ETSI milestones listing
etsi.org
Referenced sections
  • Official status source identified in the EN 303 645 notice for checking whether an ETSI deliverable has been revised or had its status changed.
ETSI standards search
etsi.org
Referenced sections
  • Primary ETSI discovery source for EN 303 645 and related consumer IoT cybersecurity deliverables.

Next steps

Prepare the consumer IoT product assessment

Define the scope, map applicable provisions, collect implementation evidence, and prepare for assessment under ETSI TS 103 701.

  • Identify the , , supplier responsibilities, interfaces, data flows, and software update mechanisms.
  • Assign owners for each baseline provision area and collect the product records needed for and -style assessment inputs.
  • Use Annex B status rules and product facts when deciding whether a provision is mandatory, recommended, conditional, feature-dependent, supported, unsupported, or eligible for N/A; Provision 5.0-1 still requires a recorded justification for every recommendation considered not applicable or not fulfilled.
  • Keep conceptual design evidence, functional test evidence, external evidence decisions, and verdict rationale connected to the same product record.
  • Open Assessment Autopilot

    Turn ETSI EN 303 645 provision mapping into owned tasks, evidence requests, review checkpoints, and assessment records.

  • Open Research Copilot

    Answer device scope, applicability, version, and interpretation questions with cited outputs from the same artifact.

  • Talk through implementation

    Review your product scope, evidence model, assessment path, and next implementation steps.