ETSI EN 303 645 Consumer IoT product scope

ETSI EN 303 645 defines a consumer IoT device as a network-connected or network-connectable device that has relationships to associated services and is typically used by consumers in the home or as an electronic wearable. The standard also defines an IoT product as the consumer IoT device plus its associated services.

The scope is broad but not unlimited. ETSI lists examples such as connected children's toys and baby monitors, smoke detectors, door locks, window sensors, IoT gateways, base stations, hubs, wearable health trackers, home automation and alarm systems, connected appliances, and smart home assistants. Devices primarily intended for manufacturing, healthcare, or other industrial applications are outside the document's scope.

For assessment work, ETSI TS 103 701 uses the Device Under Test, or DUT, as the specific consumer IoT device assessed against ETSI EN 303 645. TS 103 701 says test scenarios address DUT functionality, its relation to associated services, and development or management processes.

The supplier organization provides ICS and IXIT information to the test laboratory. The ICS declares capabilities implemented in or supported by the DUT, while the IXIT contains or references the additional information about the DUT and assessment environment that enables appropriate test activities. The test laboratory uses those documents to derive a test plan.

A weak scope claim treats ETSI EN 303 645 as a generic product-security label. The standard is product-specific and provision-specific: applicability can depend on the device, whether it is constrained, whether the functionality exists, and which associated services are part of the product.

Constrained devices need explicit handling. ETSI describes constrained devices as devices with physical limitations in processing, communication, storage, or user interaction, and gives examples such as window sensors and low-powered devices that rely on a base station or hub. If a recommendation is considered not applicable or not fulfilled, provision 4-1 requires a recorded justification.