We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

ETSI EN 303 645Free Resource

ETSI EN 303 645 Consumer IoT Security Guide

ETSI EN 303 645 is a voluntary, outcome-focused security and data-protection baseline for network-connected devices and their interactions with . It is not itself a law, certification scheme, or guarantee that a product is secure.

Open the requirements map
Based on ETSI source materialConsumer IoT baselineNo signup required
Quick scan
Artifact
Requirements map
Trace the baseline provision areas and their legal force: passwords, vulnerability reports, updates, secure storage, communications, attack surface, software integrity, personal data, outages, telemetry, data deletion, setup, and input validation. Annex B marks provisions as mandatory or recommended and may also make them conditional or feature-dependent.
Implementation checklist
Turn each provision into product, firmware, cloud-service, mobile-app, support, and documentation work that can be reviewed before assessment.
TS 103 701 evidence workflow
Plan DUT scope, supplier organization records, test laboratory inputs, applicability statements, details, conceptual checks, functional checks, and verdict handling.

The provision guides use EN 303 645 V3.1.3 (2024-09), the latest edition listed in ETSI's EN 303 645 deliver directory when checked on 25 July 2026. TS 103 701 V2.1.1 (2025-05) names that edition as a normative reference. Neither document is legislation or a product certificate; a buyer, law, laboratory, or assurance scheme may specify another edition or add binding criteria.

Key dates
18
Topics
8
FAQs
3
Comparisons
2026
Updated
What this artifact helps decide
Which provisions apply
Confirm that the network-connected product is typically used by consumers in the home or as an electronic wearable, identify the device and its interactions with required , then document mandatory, recommended, conditional, and feature-dependent decisions. A business deployment of a consumer product can remain in scope; a product primarily intended for manufacturing, healthcare, or another industrial use is outside the standard's stated scope.
What evidence to collect
Prepare an Annex B implementation conformance statement for every provision, with Y, N, or permitted N/A status and concrete detail. For assessment, add TS 103 701 records that identify mechanisms, interfaces, documents, processes, and test inputs for the exact device model, software release, and associated-service boundary.
How assessment should run
The supplier organization identifies the and supplies the and ; the test laboratory verifies the claims, derives a product-specific test plan, performs conceptual and functional checks, and assigns test-case, test-group, and overall verdicts. The TS supplies a method, not a certification scheme.
Scope first
Plan controls
Track evidence
Publication details
Editorial metadata for this artifact
Author
Sorena AI
Published
Mar 4, 2026
Updated
Jul 16, 2026

Start with the product boundary and applicable provisions, then build implementation evidence. The guides keep the EN baseline separate from ETSI TS 103 701 assessment mechanics and from any law or assurance scheme that may use related evidence.

Recommended reading path

Choose the next consumer IoT security decision

New to the standard? Start with product scope. If the boundary is already documented, jump to the provision, implementation workflow, evidence pack, version check, or comparison you need.

2

Understand the provisions

Read the outcome-focused baseline before converting it into controls, including the password, update, vulnerability, data-protection, telemetry, and deletion provisions.

ETSI EN 303 645 requirements: consumer IoT provision map
Map ETSI EN 303 645 consumer IoT requirements to product scope, Annex B ICS entries, TS 103 701 evidence, and implementation owners.
Read guide
ETSI EN 303 645 Secure Updates and Vulnerability Disclosure
Source-backed guide to ETSI EN 303 645 clauses 5.2 and 5.3 for consumer IoT vulnerability disclosure, security updates, support periods, and assessment evidence.
Read guide
ETSI EN 303 645 Data Protection Provisions
Guide to ETSI EN 303 645 data protection provisions for consumer IoT, including security, consent, telemetry, deletion, minimization, aggregation, and anonymization.
Read guide
3

Implement product and process changes

Turn the applicable provisions into owned engineering, product-support, secure-update, and coordinated-vulnerability-disclosure work.

ETSI EN 303 645 implementation checklist
This ETSI EN 303 645 implementation checklist helps scope a consumer IoT product, record Annex B support statuses, map IXIT evidence, and avoid weak conformance claims.
Read guide
ETSI EN 303 645 Secure Update Workflow
Map ETSI EN 303 645 secure-update provisions into a practical workflow for consumer IoT update mechanisms, support-period disclosures, and TS 103 701 evidence.
Read guide
ETSI EN 303 645 CVD Workflow for IoT Vulnerability Reports
Cited workflow for ETSI EN 303 645 vulnerability disclosure: public policy contents, reporting contact, acknowledgement and status timelines, timely action, and TS 103 701 evidence.
Read guide
4

Prepare assessment evidence

Connect the exact device under test to implementation statements, IXIT detail, conceptual and functional checks, verdicts, and appropriately scoped external evidence.

ETSI EN 303 645 compliance: ICS, IXIT, evidence
Plan ETSI EN 303 645 compliance evidence for consumer IoT products with scope, ICS, IXIT, TS 103 701 assessment steps, verdict risks, and cited controls.
Read guide
ETSI EN 303 645 ICS and IXIT Evidence Template
Build a cited ICS and IXIT evidence template for ETSI EN 303 645 consumer IoT assessments, with clear separation between EN provisions and TS 103 701 test information.
Read guide
ETSI EN 303 645 Implementation Evidence Guide
Build ETSI EN 303 645 implementation evidence from Annex B support/detail records, TS 103 701 ICS and IXIT inputs, test verdicts, and scoped external evidence.
Read guide
ETSI EN 303 645 Secure Update Evidence Workflow
Build secure-update evidence for ETSI EN 303 645 using provision 5.3, Annex B support/detail records, and TS 103 701 ICS, IXIT, and test-plan inputs.
Read guide
ETSI TS 103 701 Test Evidence Workflow for EN 303 645
Build an ETSI TS 103 701 test evidence workflow for EN 303 645 consumer IoT assessments: DUT identification, ICS, IXIT, test plans, verdicts, and external evidence.
Read guide
5

Check versions, comparisons, and focused questions

Verify the edition being used, understand what evidence can transfer to legal regimes, and answer a specific product or assessment question without treating the standard as law or certification.

ETSI EN 303 645 Current Version Tracker
Track ETSI EN 303 645 version evidence, ETSI deliverable status checks, TS 103 701 assessment alignment, and change triggers for consumer IoT security work.
Read guide
ETSI EN 303 645 vs EU CRA for Consumer IoT
Compare ETSI EN 303 645 consumer IoT evidence with the EU Cyber Resilience Act's scope, manufacturer duties, application dates, and conformity requirements.
Read guide
ETSI EN 303 645 vs RED Cybersecurity Delegated Act
Compare ETSI EN 303 645 consumer IoT evidence with the RED cybersecurity requirements, EN 18031 standards, application date, and conformity routes.
Read guide
ETSI EN 303 645 vs UK PSTI: Evidence Crosswalk
Compare ETSI EN 303 645 evidence with UK PSTI scope, three mandatory security requirements, statements of compliance, duties, and enforcement.
Read guide
ETSI EN 303 645 FAQ: Consumer IoT Security Questions
Practical answers to common ETSI EN 303 645 questions on consumer IoT scope, associated services, passwords, updates, vulnerability disclosure, telemetry, deletion, and assessment evidence.
Read guide
Next step

Turn ETSI EN 303 645 into an assessment-ready product workflow

This artifact is the shared starting point for scope, provision mapping, implementation evidence, and ETSI TS 103 701 assessment preparation.

What this unlocks
  • Identify the , , supplier responsibilities, interfaces, data flows, and software update mechanisms.
  • Assign owners for each baseline provision area and collect the product records needed for and -style assessment inputs.
  • Use Annex B status rules and product facts when deciding whether a provision is mandatory, recommended, conditional, feature-dependent, supported, unsupported, or eligible for N/A; Provision 5.0-1 still requires a recorded justification for every recommendation considered not applicable or not fulfilled.
  • Keep conceptual design evidence, functional test evidence, external evidence decisions, and verdict rationale connected to the same product record.
Recommended route
Open Assessment Autopilot
Turn ETSI EN 303 645 provision mapping into owned tasks, evidence requests, review checkpoints, and assessment records.
Supporting route
Open Research Copilot
Answer device scope, applicability, version, and interpretation questions with cited outputs from the same artifact.
Talk to Sorena
Talk through implementation
Review your consumer IoT product scope, evidence model, assessment path, and next implementation steps.
Discuss your setup