ETSI EN 303 645 Test evidence for consumer IoT assessments

Start with the distinction between the two ETSI documents. EN 303 645 is the baseline requirements standard for consumer IoT devices and associated services. Its Annex B ICS pro forma lets the user of the standard record whether each provision is supported, not supported, or not applicable, and the detail column explains the implemented measure or rationale.

TS 103 701 is the assessment methodology. It defines the Device Under Test, Supplier Organization, Test Laboratory, ICS, IXIT, test plans, conceptual tests, functional tests, external evidence, and verdict handling. A useful evidence pack therefore should not say only "tested to EN 303 645"; it should show the assessed DUT, the ICS claim, the IXIT detail, the test group or external evidence used, and the verdict basis.

Under TS 103 701, the supplier organization completes identification of the DUT, the ICS, and the necessary IXIT information. The ICS states which EN 303 645 provisions are objects of the assessment. The IXIT contains additional information about the DUT and assessment environment so the test laboratory can choose suitable test methods, equipment, conditions, and instructions.

This means evidence should be specific enough for a test plan. For a provision claimed as "Yes", the IXIT should contain or reference the implemented security measures needed for the corresponding test group. If the IXIT is incomplete or insufficient, TS 103 701 allows an inconclusive verdict because the test case cannot be properly executed.

Sometimes, but only within the TS 103 701 external-evidence rules. Existing security certifications or third-party evaluations of parts of the DUT may be used partially as evidence to reduce assessment effort. The supplier organization has to announce the evidence in the addressed ICS detail field and provide the certification, certification details, test reports, or other information needed for verification.

The test laboratory still has to decide whether the evidence is adequate for the corresponding test group. TS 103 701 says the laboratory examines whether the scope matches the test group objective, whether the evidence's test activities meet each test purpose in the test group, and whether the test depth or evaluation assurance level is appropriate to the level addressed by the test group.