Search every question across sub-FAQs

EN 303 645 expects manufacturers to continually monitor for, identify, and rectify security vulnerabilities within products and services they sell, produce, have produced, and operate during the defined support period. It also notes that maintaining a list of software components and sub-components is a prerequisite for monitoring product vulnerabilities when products use open-source or third-party software.

TS 103 701 maps this to IXIT 5-VulnMon. The assessment asks whether the described monitoring approach systematically gathers vulnerability information that could affect the device under test or its associated services, whether the identification approach determines applicability, and whether the rectification approach addresses or mitigates susceptibility.

Start with the ETSI definition. EN 303 645 describes a constrained device as one with physical limitations in processing, communication, storage, or user interaction because of its intended use. The standard gives power supply, battery life, processing power, physical access, limited functionality, limited memory, and limited network bandwidth as examples of limits.

That status does not remove the product from the standard. EN 303 645 says its baseline provisions apply across consumer IoT, while recognizing that applicability is device-dependent. A constrained-device decision therefore belongs in the implementation record for the specific provision, product, and feature.

Constrained-device status can support a narrower answer where EN 303 645 itself ties the provision to constrained-device limits or where implementation is not possible or not appropriate to the identified security or privacy risk. It is not a blanket exemption from authentication, updates, secure communication, or other baseline topics.

The standard gives concrete update-related examples. A non-constrained device shall have a secure update mechanism, while constrained devices that cannot have software updated should have a public rationale, a defined support period, a hardware replacement support period and method, and a product design that is isolable and hardware replaceable.

Keep the evidence close to the ICS and IXIT process used by ETSI TS 103 701. The supplier organization identifies the Device Under Test, completes the ICS, provides necessary IXIT information for provisions claimed as supported, and gives enough information for the test laboratory to check consistency and soundness.

For each constrained-device decision, the evidence should answer four questions: what is physically constrained, which provision is affected, whether the product supports the provision or has a justified N/A or non-support entry, and what user-facing disclosure exists when software cannot be updated.