ETSI EN 303 645 Vulnerability disclosure for consumer IoT products

The public policy is not just a security mailbox. EN 303 645 provision 5.2-1 says the manufacturer shall make a vulnerability disclosure policy publicly available and that the policy includes contact information for reporting issues plus a timetable for initial acknowledgement and status updates until reported issues are resolved.

For visitors, buyers, researchers, and assessors, the policy should make the reporting path visible without requiring private documentation. TS 103 701 turns that into both a conceptual and functional assessment: the test laboratory checks the publication route described in IXIT 2-UserInfo and verifies that the policy is publicly accessible.

EN 303 645 provision 5.2-2 says disclosed vulnerabilities should be acted on in a timely manner. The standard explains that timing is incident-specific: software fixes are conventionally completed within 90 days, including patch availability and notification, while hardware fixes can take considerably longer.

That means the evidence should describe the decision path for different vulnerability types rather than using a single generic promise. TS 103 701 expects the test laboratory to assess the action and time frame for each disclosed vulnerability type in IXIT 3-VulnTypes, considering the public disclosure policy, severity, criticality, firmware, hardware or software type, process steps, responsibilities, and third-party involvement.

EN 303 645 expects manufacturers to continually monitor for, identify, and rectify security vulnerabilities within products and services they sell, produce, have produced, and operate during the defined support period. It also notes that maintaining a list of software components and sub-components is a prerequisite for monitoring product vulnerabilities when products use open-source or third-party software.

TS 103 701 maps this to IXIT 5-VulnMon. The assessment asks whether the described monitoring approach systematically gathers vulnerability information that could affect the device under test or its associated services, whether the identification approach determines applicability, and whether the rectification approach addresses or mitigates susceptibility.