ETSI EN 303 645 vs RED Cybersecurity Delegated Act
Use ETSI EN 303 645 to structure consumer Internet of Things (IoT) security controls and evidence, then keep a separate RED analysis for radio-equipment legal scope, CE documentation, and EU market-access decisions.
The RED cybersecurity requirements have applied since 1 August 2025. EN 18031-1, -2, and -3 are the cited harmonised standards, subject to published limitations; EN 303 645 is not their substitute.
ETSI EN 303 645 V3.1.3 and the can apply to the same connected consumer product, but they are not equivalent. EN 303 645 is a voluntary consumer IoT baseline. Delegated Regulation (EU) 2022/30 activates binding RED Article 3(3)(d), (e), and (f) cybersecurity requirements for specified radio-equipment categories from 1 August 2025. Reuse EN 303 645 and TS 103 701 evidence for matching controls, then complete a separate RED scope decision, EN 18031 mapping, technical documentation, conformity assessment, EU declaration of conformity, and CE-marking record.
Side-by-side comparison
ETSI EN 303 645 vs RED Cybersecurity Delegated Act: evidence boundary
A narrow comparison for connected-product teams deciding what ETSI EN 303 645 can prove, what RED must prove separately, and when evidence can be bridged without overclaiming.
A consumer IoT cybersecurity baseline for network-connected consumer devices and their interactions with associated services, with TS 103 701 providing an assessment method.
Second framework
RED Cybersecurity Delegated Act
Binding RED cybersecurity requirements for specified radio equipment, supported by the EN 18031 harmonised standards and the RED conformity-assessment framework.
ETSI EN 303 645 vs RED Cybersecurity Delegated Act: evidence boundary
ETSI EN 303 645 V3.1.3 covers consumer IoT devices connected to network infrastructure and their interactions with associated services, which it defines as part of the overall consumer IoT product.
Defines the consumer IoT device and associated-service scope for ETSI EN 303 645.
consumer IoT devices that are connected to network infrastructure
RED Article 3(3)(d) applies to internet-connected radio equipment. Point (e) applies to specified radio equipment capable of processing personal, traffic, or location data, including internet-connected equipment, childcare equipment, toys, and wearables. Point (f) applies to internet-connected radio equipment that enables transfers of money, monetary value, or virtual currency. The exclusions in Delegated Regulation (EU) 2022/30 must also be checked.
Article 1 establishes the categories subject to RED Article 3(3)(d), (e), and (f), while Article 2 identifies excluded categories.
Start with two scope records: an ETSI consumer IoT boundary for control evidence and a separate RED radio-equipment boundary for legal and CE-file decisions.
For an ETSI assessment, the supplier organization requests the DUT assessment, provides ICS and IXIT information, and coordinates across parties such as manufacturers, service providers, component suppliers, application developers, vendors, or distributors.
Defines the supplier organization and test laboratory roles in the assessment process.
Supplier Organization
The RED manufacturer must design and manufacture compliant radio equipment, prepare technical documentation, perform the applicable conformity assessment, issue the EU declaration of conformity, and affix CE marking. Importers and distributors have separate verification and corrective-action duties.
Articles 10, 12 and 13 allocate manufacturer, importer, and distributor duties.
Assign ETSI evidence owners for ICS, IXIT, and testing, then record the RED manufacturer, importer, and distributor roles for scope, conformity assessment, technical documentation, declaration, and CE marking.
ETSI EN 303 645 applies when the team is assessing a consumer IoT device and its relevant interactions with associated services against the baseline provisions. Conditional ETSI provisions then depend on product facts such as whether passwords, update mechanisms, telemetry, consent-based personal-data processing, or hard-coded device identities exist.
Annex B distinguishes conditional (C) and feature-dependent (F) provisions; see 5.1-1 for passwords, 5.4-2 for device identity, 5.10-1 for telemetry, and 6-2 and 6-3A for consent.
The trigger depends on radio-equipment status and the Article 1 category tests, including internet connectivity, specified data processing, childcare, toy or wearable status, or transfer of money or monetary value. The requirements have applied since 1 August 2025.
Article 1 establishes the category triggers for RED Article 3(3)(d), (e), and (f).
Use an ETSI condition matrix for provisions and a separate RED trigger matrix for legal applicability. Do not infer RED applicability from the presence of an ETSI control.
Clauses 5.1-5.13 list the consumer IoT cybersecurity provision areas; clause 6 adds technical data-protection provisions.
RED Article 3(3)(d) requires covered radio equipment not to harm the network or misuse network resources. Point (e) requires safeguards for personal data and privacy. Point (f) requires features that protect against fraud. EN 18031-1, -2, and -3 provide the cited harmonised-standard routes, subject to OJEU limitations.
Activates the three RED Article 3(3) cybersecurity outcomes for the specified radio-equipment categories.
Build the ETSI action list from clauses 5 and 6, then add RED duties in a separate cited column instead of renaming ETSI provisions as RED obligations.
ETSI evidence should include the DUT identification, ICS support claims and details, IXIT entries, user documentation, conceptual and functional test results, verdict rationale, and any external evidence accepted for a provision.
Annex B defines implementation conformance statement support values and the information expected in the detail column.
RED technical documentation must support the applicable essential requirements and selected conformity route. The file should include the scope decision, risk and design evidence, applied EN 18031 clauses and limitations, test results, conformity-assessment output, EU declaration of conformity, and CE-marking basis.
Articles 10 and 21 and Annex V establish manufacturer technical-documentation duties and required content.
Create a traceability matrix with source, product version, claim, ETSI artifact, RED artifact, owner, and gap status. Shared evidence should be tagged as supporting evidence, not proof that both regimes are complete.
ETSI timing is product-security timing: defined support period, timely vulnerability action, timely security updates, update checks after initialization, reassessment after product or service changes, and assessment use of the most up-to-date DUT software.
Assessment source recommending use of the most up-to-date DUT software version.
most up-to-date software version
The delegated RED cybersecurity requirements have applied since 1 August 2025. Product changes still need review under the manufacturer's continuing-conformity duties; the legislation does not set a fixed periodic recertification interval.
ETSI EN 303 645 is a baseline standard. TS 103 701 can support first-party, second-party, third-party, certification, and conformance-declaration schemes, but defining a certification or conformance-declaration scheme is outside TS 103 701.
Explains assessment users and states that defining a certification or conformance declaration scheme is out of scope.
Defining a certification or conformance declaration scheme is out of scope
For Article 3(3) requirements, internal production control is available when the manufacturer correctly applies applicable harmonised standards whose references are published in the OJEU. If those standards are absent, not applied, or only partly applied, the RED requires EU-type examination plus internal production control or full quality assurance. Authorities can require corrective action or restrict, withdraw, or recall non-compliant equipment.
Articles 17 and 40-43 establish conformity-assessment choices and market-surveillance action.
Use ETSI results as supporting assurance evidence only. Select the RED route from Article 17 and document how any EN 18031 limitation affects the claimed presumption of conformity.
ETSI overlap exists at the control and evidence level: a well-scoped ETSI assessment can show implemented cybersecurity measures for the consumer IoT product.
Grounds the use of assessment results and external evidence for ETSI conformance assessment.
external evidences
RED overlap exists when an ETSI artifact supports the same product facts or security outcome required by the applicable EN 18031 part. EN 303 645 does not itself confer RED presumption of conformity, and the published EN 18031 limitations can leave additional work.
Lists the EN 18031 standards that can support presumption of conformity and the limitations on that presumption.
Reuse evidence by reference, not by renaming. Keep the ETSI result, RED requirement, common product facts, and remaining RED gaps visible in the same row.
Use ETSI EN 303 645 as the controlling source when the decision is about consumer IoT baseline controls, ICS/IXIT content, assessment evidence, or support for a product-security claim.
Assessment source for ICS, IXIT, test plan, and verdict evidence.
ICS and IXIT
Use Delegated Regulation (EU) 2022/30 for the applicable radio-equipment categories, Implementing Decision (EU) 2025/138 for EN 18031 citation limits, and the RED for conformity assessment, technical documentation, declaration, CE marking, and market surveillance.
Grounds only the need for a RED-side source check.
radio equipment
Scope and covered activity
ETSI EN 303 645
ETSI EN 303 645 V3.1.3 covers consumer IoT devices connected to network infrastructure and their interactions with associated services, which it defines as part of the overall consumer IoT product.
Defines the consumer IoT device and associated-service scope for ETSI EN 303 645.
consumer IoT devices that are connected to network infrastructure
RED Cybersecurity Delegated Act
RED Article 3(3)(d) applies to internet-connected radio equipment. Point (e) applies to specified radio equipment capable of processing personal, traffic, or location data, including internet-connected equipment, childcare equipment, toys, and wearables. Point (f) applies to internet-connected radio equipment that enables transfers of money, monetary value, or virtual currency. The exclusions in Delegated Regulation (EU) 2022/30 must also be checked.
Article 1 establishes the categories subject to RED Article 3(3)(d), (e), and (f), while Article 2 identifies excluded categories.
Operational implication
Start with two scope records: an ETSI consumer IoT boundary for control evidence and a separate RED radio-equipment boundary for legal and CE-file decisions.
Grounds only the existence of the RED comparator source, not a completed RED analysis.
radio equipment
Who must act
ETSI EN 303 645
For an ETSI assessment, the supplier organization requests the DUT assessment, provides ICS and IXIT information, and coordinates across parties such as manufacturers, service providers, component suppliers, application developers, vendors, or distributors.
Defines the supplier organization and test laboratory roles in the assessment process.
Supplier Organization
RED Cybersecurity Delegated Act
The RED manufacturer must design and manufacture compliant radio equipment, prepare technical documentation, perform the applicable conformity assessment, issue the EU declaration of conformity, and affix CE marking. Importers and distributors have separate verification and corrective-action duties.
Articles 10, 12 and 13 allocate manufacturer, importer, and distributor duties.
Operational implication
Assign ETSI evidence owners for ICS, IXIT, and testing, then record the RED manufacturer, importer, and distributor roles for scope, conformity assessment, technical documentation, declaration, and CE marking.
Grounds ETSI assessment roles and the SO/TL relationship.
SO provides reliable ICS and IXIT
Trigger or threshold
ETSI EN 303 645
ETSI EN 303 645 applies when the team is assessing a consumer IoT device and its relevant interactions with associated services against the baseline provisions. Conditional ETSI provisions then depend on product facts such as whether passwords, update mechanisms, telemetry, consent-based personal-data processing, or hard-coded device identities exist.
Annex B distinguishes conditional (C) and feature-dependent (F) provisions; see 5.1-1 for passwords, 5.4-2 for device identity, 5.10-1 for telemetry, and 6-2 and 6-3A for consent.
RED Cybersecurity Delegated Act
The trigger depends on radio-equipment status and the Article 1 category tests, including internet connectivity, specified data processing, childcare, toy or wearable status, or transfer of money or monetary value. The requirements have applied since 1 August 2025.
Article 1 establishes the category triggers for RED Article 3(3)(d), (e), and (f).
Operational implication
Use an ETSI condition matrix for provisions and a separate RED trigger matrix for legal applicability. Do not infer RED applicability from the presence of an ETSI control.
Clauses 5.1-5.13 list the consumer IoT cybersecurity provision areas; clause 6 adds technical data-protection provisions.
RED Cybersecurity Delegated Act
RED Article 3(3)(d) requires covered radio equipment not to harm the network or misuse network resources. Point (e) requires safeguards for personal data and privacy. Point (f) requires features that protect against fraud. EN 18031-1, -2, and -3 provide the cited harmonised-standard routes, subject to OJEU limitations.
Activates the three RED Article 3(3) cybersecurity outcomes for the specified radio-equipment categories.
Operational implication
Build the ETSI action list from clauses 5 and 6, then add RED duties in a separate cited column instead of renaming ETSI provisions as RED obligations.
Clauses 5 and 6 are the normative consumer IoT cybersecurity and data-protection provisions from which to construct the ETSI action list.
Evidence and records
ETSI EN 303 645
ETSI evidence should include the DUT identification, ICS support claims and details, IXIT entries, user documentation, conceptual and functional test results, verdict rationale, and any external evidence accepted for a provision.
Annex B defines implementation conformance statement support values and the information expected in the detail column.
RED Cybersecurity Delegated Act
RED technical documentation must support the applicable essential requirements and selected conformity route. The file should include the scope decision, risk and design evidence, applied EN 18031 clauses and limitations, test results, conformity-assessment output, EU declaration of conformity, and CE-marking basis.
Articles 10 and 21 and Annex V establish manufacturer technical-documentation duties and required content.
Operational implication
Create a traceability matrix with source, product version, claim, ETSI artifact, RED artifact, owner, and gap status. Shared evidence should be tagged as supporting evidence, not proof that both regimes are complete.
Grounds traceability through ICS, IXIT, test-plan, verdict, and external-evidence handling.
document the used indications
Timing and cadence
ETSI EN 303 645
ETSI timing is product-security timing: defined support period, timely vulnerability action, timely security updates, update checks after initialization, reassessment after product or service changes, and assessment use of the most up-to-date DUT software.
Assessment source recommending use of the most up-to-date DUT software version.
most up-to-date software version
RED Cybersecurity Delegated Act
The delegated RED cybersecurity requirements have applied since 1 August 2025. Product changes still need review under the manufacturer's continuing-conformity duties; the legislation does not set a fixed periodic recertification interval.
Provisions 5.3-8 and 5.3-13 establish timely security updates and publication of the defined support period.
Enforcement or assurance route
ETSI EN 303 645
ETSI EN 303 645 is a baseline standard. TS 103 701 can support first-party, second-party, third-party, certification, and conformance-declaration schemes, but defining a certification or conformance-declaration scheme is outside TS 103 701.
Explains assessment users and states that defining a certification or conformance declaration scheme is out of scope.
Defining a certification or conformance declaration scheme is out of scope
RED Cybersecurity Delegated Act
For Article 3(3) requirements, internal production control is available when the manufacturer correctly applies applicable harmonised standards whose references are published in the OJEU. If those standards are absent, not applied, or only partly applied, the RED requires EU-type examination plus internal production control or full quality assurance. Authorities can require corrective action or restrict, withdraw, or recall non-compliant equipment.
Articles 17 and 40-43 establish conformity-assessment choices and market-surveillance action.
Operational implication
Use ETSI results as supporting assurance evidence only. Select the RED route from Article 17 and document how any EN 18031 limitation affects the claimed presumption of conformity.
Grounds limits on assessment scheme and certification claims.
assessment scheme
Overlap and reuse
ETSI EN 303 645
ETSI overlap exists at the control and evidence level: a well-scoped ETSI assessment can show implemented cybersecurity measures for the consumer IoT product.
Grounds the use of assessment results and external evidence for ETSI conformance assessment.
external evidences
RED Cybersecurity Delegated Act
RED overlap exists when an ETSI artifact supports the same product facts or security outcome required by the applicable EN 18031 part. EN 303 645 does not itself confer RED presumption of conformity, and the published EN 18031 limitations can leave additional work.
Lists the EN 18031 standards that can support presumption of conformity and the limitations on that presumption.
Operational implication
Reuse evidence by reference, not by renaming. Keep the ETSI result, RED requirement, common product facts, and remaining RED gaps visible in the same row.
Grounds careful external-evidence verification rather than automatic reuse.
adequate to fulfil the corresponding test group
Practical decision rule
ETSI EN 303 645
Use ETSI EN 303 645 as the controlling source when the decision is about consumer IoT baseline controls, ICS/IXIT content, assessment evidence, or support for a product-security claim.
Assessment source for ICS, IXIT, test plan, and verdict evidence.
ICS and IXIT
RED Cybersecurity Delegated Act
Use Delegated Regulation (EU) 2022/30 for the applicable radio-equipment categories, Implementing Decision (EU) 2025/138 for EN 18031 citation limits, and the RED for conformity assessment, technical documentation, declaration, CE marking, and market surveillance.
Grounds only the need for a RED-side source check.
radio equipment
Practical decision rule
How to choose the controlling source
Choose ETSI EN 303 645 when the question is whether a consumer IoT control is implemented, documented, tested, or supported in the ICS/IXIT evidence.
Choose RED and Delegated Regulation (EU) 2022/30 when the question is whether radio equipment meets EU cybersecurity, conformity-assessment, technical-documentation, CE-marking, or market-access requirements.
Use both only through a bridge table that keeps ETSI control evidence and RED legal conclusions separate.
Primary source for the categories subject to RED Article 3(3)(d), (e), and (f).
1
Section 1
Which technical controls and RED decisions must be mapped?
ETSI EN 303 645 V3.1.3 is a consumer IoT cybersecurity baseline. It is written for network-connected consumer IoT devices and their interactions with associated services, which it defines as part of the overall consumer IoT product.
That makes it useful for product-security evidence: passwords, vulnerability reporting, secure updates, secure storage of sensitive security parameters, secure communication, attack-surface minimization, software integrity, personal-data security, resilience, telemetry review, user-data deletion, installation and maintenance usability, input validation, and data-protection transparency. It does not decide whether a product is radio equipment, which RED Article 3(3) requirements apply, whether a cited EN 18031 limitation affects the product, or which conformity-assessment route is available.
Use ETSI EN 303 645 when the question is about consumer IoT security controls and implementation evidence.
Use RED and Delegated Regulation (EU) 2022/30 for radio-equipment scope and legal obligations, and the current Official Journal of the European Union (OJEU) harmonised-standards decision for the EN 18031 presumption-of-conformity conditions.
Treat ETSI-to-RED reuse as supporting evidence. The RED file must still identify the applicable Article 3(3) point, conformity route, technical documentation, EU declaration of conformity, and CE-marking record.
Publishes EN 18031-1:2024, EN 18031-2:2024, and EN 18031-3:2024 with limitations on their presumption of conformity.
2
Section 2
Evidence boundary for a comparison
Start the ETSI side with the consumer IoT product boundary: the device, firmware, network interfaces, user interfaces, update mechanism, telemetry, personal-data processing, user-data deletion functions, user instructions, and the interactions with associated services that are necessary to provide the product's intended functionality.
TS 103 701 assesses a specific Device Under Test (DUT). The supplier organization provides the Implementation Conformance Statement (ICS) and Implementation eXtra Information for Testing (IXIT), and the test laboratory uses those documents to derive a test plan. That evidence model is more precise than a general policy checklist and is the right unit for any later RED bridge.
Identify the DUT and its most up-to-date software version before mapping controls.
Separate on-device functionality from associated-service interactions so the comparison does not overclaim the ETSI scope.
Keep ICS support claims, IXIT details, user documentation, and test results linked to the same product configuration.
Explains the DUT, SO, TL, ICS, IXIT, and test-plan relationship used for conformance assessment.
The TL uses these documents to derive a test plan
Recommended next step
Build an ETSI-to-RED evidence bridge
Map ETSI EN 303 645 controls, ICS/IXIT records, test evidence, and RED-specific gaps before relying on the same cybersecurity evidence in a CE file or customer response.
Which evidence can be reused, and which RED records remain?
Evidence reuse is strongest where the RED workstream needs proof of actual cybersecurity controls in a connected consumer product and the ETSI evidence is tied to the same shipped configuration. Examples include removal of universal default passwords, vulnerability disclosure handling, secure software updates, secure communication, secure handling of sensitive security parameters, telemetry anomaly review, user-data deletion, and input validation.
Reuse should be documented as a bridge, not a substitution. The RED harmonised standards are EN 18031-1:2024 for internet-connected radio equipment, EN 18031-2:2024 for radio equipment processing specified data, and EN 18031-3:2024 for internet-connected radio equipment that enables transfers of money or monetary value. Their OJEU citations carry limitations, so the manufacturer must check the applicable notice as well as the standard.
Check the actual notices in Decision (EU) 2025/138. The rationale and guidance sections of each EN 18031 part confer no presumption of conformity. The password notice excludes presumption where clauses 6.2.5.1 and 6.2.5.2 allow the user not to set and use any password. For the EN 18031-2 categories covered by clauses 6.1.3 to 6.1.6, the further notice excludes presumption where applying clauses 6.1.3.4.2, 6.1.4.4.2, 6.1.5.4.2 and 6.1.6.4.2 does not ensure parental or guardian access control. EN 18031-3 also excludes presumption for the secure-update assessment criteria in clause 6.3.2.4. Record which notice applies to the product and its effect on the claimed essential requirement.
Reuse ETSI records only when the product version, software, interfaces, associated services, and user-facing information match the RED evidence boundary.
Carry over the actual ETSI artifacts: ICS rows, IXIT entries, conceptual-test conclusions, functional-test results, and external-evidence references.
Add a RED bridge note that names Article 3(3)(d), (e), or (f), the applicable EN 18031 clauses and OJEU limitations, the evidence reused, and what remains outside the ETSI assessment.
Clauses 5.1-5.5 and 5.10-5.13 provide the password, disclosure, update, storage, communication, telemetry, deletion and input-validation provisions used in these evidence examples.
Lists the three EN 18031 standards and the limitations attached to their presumption of conformity.
4
Section 4
How to document unsupported or non-applicable items
ETSI EN 303 645 includes an Implementation Conformance Statement pro forma. The support column can mark provisions as supported, not supported, or not applicable. The detail column is where the team records implemented measures, reasons a provision is not supported, or the rationale for a not-applicable decision.
TS 103 701 makes those entries assessable. It requires the supplier organization to complete the ICS correctly, provide IXIT information for provisions claimed as supported, and justify N/A or not-supported positions so the test laboratory can verify the claim and assign reproducible verdicts.
Do not write a bare N/A for an ETSI provision; include the condition or feature reason that makes it not applicable.
Do not mark a mandatory provision unsupported and still describe the product as conforming without explaining the failed claim.
Mark the RED row unresolved when the product category, applicable Article 3(3) point, EN 18031 coverage, or conformity route has not been established.
Assessment procedure source for ICS verification, IXIT completeness, test execution, verdicts, and documentation of indications.
For every "N/A" a justification shall be given
5
Section 5
Implementation checklist for the ETSI-to-RED bridge
Use this checklist to carry ETSI EN 303 645 work into a RED cybersecurity file. Produce a traceable bridge rather than merging the two instruments into one checklist.
Confirm the product is a consumer IoT device for the ETSI side and record any associated services needed for intended functionality.
Identify the DUT, software version, user documentation, network interfaces, user interfaces, update paths, telemetry, data deletion functions, and personal-data processing.
Complete or reference the ICS and IXIT entries for each claimed ETSI provision.
Attach conceptual and functional test evidence, including the test plan basis and verdicts where TS 103 701 assessment has been performed.
Create a separate RED column stating the applicable Article 3(3) point, EN 18031 part and limitation, conformity route, reused ETSI evidence, and remaining RED evidence.
Assessment source for completing identification of the DUT, ICS, IXIT, test plan, assessment, and overall verdict.
Phases of the assessment procedure
6
Section 6
Common mistakes to avoid
EN 303 645 is not one of the RED cybersecurity harmonised standards cited by Implementing Decision (EU) 2025/138. A team may have useful ETSI evidence but still lack the RED scope decision, applicable EN 18031 coverage, conformity assessment, technical documentation, declaration, or CE-marking analysis.
Keep every ETSI artifact tied to the product version, support-period information, associated-service dependencies, ICS status, IXIT detail, test method, verdict, and external evidence.
Do not present ETSI EN 303 645 as a RED legal requirement or as the harmonised-standard route for Article 3(3)(d), (e), or (f).
Do not reuse ETSI evidence for a product variant, firmware version, app, cloud service, or data-processing flow that was not inside the assessed boundary.
Do not hide conditional or unsupported provisions in narrative text; put the rationale in the ICS detail or bridge record.
Reference the official standards and legal instruments for criteria, then give the assessor access to the product-specific records supporting each reused claim.
Clause 4 distinguishes the baseline from a testing or certification method; provision 5.0-1 and Annex B require or explain provision-level justifications.
Clauses 1 and 3.1 establish product and associated-service scope; clauses 5 and 6 provide the security and data-protection baseline; Annex B provides the implementation conformance statement.
Primary ETSI source for consumer IoT scope, baseline provisions, associated-service framing, and implementation conformance statement guidance.
Clauses 1 and 3.1 define the consumer IoT device, product and associated-service boundary; Annex B records implementation support and detail.
Show 15 more
Clauses 5.1-5.5 and 5.10-5.13 provide the password, disclosure, update, storage, communication, telemetry, deletion and input-validation provisions used in these evidence examples.
Annex B distinguishes mandatory, recommended, conditional and feature-dependent provisions, and defines Y, N and N/A support entries and their detail.
Clause 1 and Annex B Table B.1 support the product-scope and provision-by-provision implementation record.
Clause 4 distinguishes the baseline from a testing or certification method; provision 5.0-1 and Annex B require or explain provision-level justifications.
Defines the consumer IoT device and associated-service scope for ETSI EN 303 645.
Clauses 1 and 3.1 define consumer IoT scope and the associated services belonging to the product.
Annex B distinguishes conditional (C) and feature-dependent (F) provisions; see 5.1-1 for passwords, 5.4-2 for device identity, 5.10-1 for telemetry, and 6-2 and 6-3A for consent.
Annex B defines the status, support and detail columns, including the conditions for N/A.
Clauses 5.1-5.13 list the consumer IoT cybersecurity provision areas; clause 6 adds technical data-protection provisions.
Clauses 5 and 6 are the normative consumer IoT cybersecurity and data-protection provisions from which to construct the ETSI action list.
Annex B defines implementation conformance statement support values and the information expected in the detail column.
Provisions 5.2-2 and 5.2-3 address timely vulnerability handling and monitoring; 5.3-5 addresses checks after initialization; 5.3-8 requires timely security updates; 5.3-13 requires support-period publication.
Provisions 5.3-8 and 5.3-13 establish timely security updates and publication of the defined support period.
Clauses 4-6 establish the baseline and provision-level implementation approach; Annex B supplies the implementation conformance statement.
Clauses 4-6 establish the baseline and its implementation approach; Annex B records support, non-support and non-applicability.
"their interactions with associated services"
More quoted passages
"consumer IoT devices that are connected to network infrastructure"
Articles 3, 10, 16, 17, 18 and 19 establish the essential requirements, manufacturer duties, presumption of conformity, conformity procedures, EU declaration, and CE marking.
Articles 10, 12 and 13 allocate manufacturer, importer, and distributor duties.
Articles 10 and 21 and Annex V establish manufacturer technical-documentation duties and required content.
Show 1 more
Articles 17 and 40-43 establish conformity-assessment choices and market-surveillance action.