ETSI EN 303 645 Support period for consumer IoT security updates

The support period is not a general warranty promise. ETSI EN 303 645 defines it specifically around security updates: the minimum length of time, expressed as a period or by an end date, for which the manufacturer will provide security updates.

For visitor-facing content, the useful answer should say what security-update support period applies to the product and where a user can find it before or around purchase. Avoid vague statements such as "supported for a reasonable period" if the product evidence does not define a duration or end date.

Provision 5.3-13 requires the manufacturer to publish the defined support period in an accessible, clear, and transparent way. The surrounding ETSI text explains why: when purchasing a product, the consumer expects the period of software-update support to be clear.

TS 103 701 makes this assessable through IXIT 2-UserInfo. The assessment checks whether a user with limited technical knowledge can understand and access the publication, whether access is unrestricted, and whether the published support period matches the support-period information documented for updateable software components.

If a constrained device cannot have its software updated, do not treat the support-period answer as complete by saying updates are not available. ETSI EN 303 645 provision 5.3-14 says the manufacturer should publish the rationale for the absence of software updates, the period and method of hardware replacement support, and a defined support period in an accessible, clear, and transparent way.

TS 103 701 separates this evidence from the normal support-period publication. It checks the published rationale for absence of updates and the published hardware replacement support information, including period and method. It also maps replacement-support evidence to IXIT 9-ReplSup for constrained-device isolation and hardware replacement.