ETSI EN 303 645 Vulnerability disclosure for consumer IoT products

A security mailbox alone is not enough. Provision 5.2-1 says the manufacturer shall make the policy publicly available and include contact information for reporting issues, a timeline for initial acknowledgement of receipt, and timelines for status updates to the reporter until resolution.

For visitors, buyers, researchers, and assessors, the policy should make the reporting path visible without requiring private documentation. TS 103 701 turns that into both a conceptual and functional assessment: the test laboratory checks the publication route described in IXIT 2-UserInfo and verifies that the policy is publicly accessible.

Provision 5.2-2 recommends timely action. Its explanatory text says timing varies by incident and describes 90 days as a conventional completion point for a properly documented software vulnerability-management process, including patch availability and notification. It is not a mandatory universal remediation deadline, and hardware fixes or device rollouts can take longer.

Evidence should therefore define the action and time frame for each vulnerability type in IXIT 3-VulnTypes. TS 103 701 asks the laboratory to consider the public policy, severity and criticality, whether the issue affects firmware, hardware, or software, process steps and responsibilities, deployment route, and third-party involvement.

Provision 5.2-3 recommends that manufacturers continually monitor for, identify, and rectify vulnerabilities in consumer IoT products they sell, produce, or have produced and in associated services they operate during the defined support period. The recommendation is bounded by that period unless the manufacturer makes a longer commitment.

TS 103 701 maps this to IXIT 5-VulnMon. The assessment asks whether the described monitoring approach systematically gathers vulnerability information that could affect the device under test or its associated services, whether the identification approach determines applicability, and whether the rectification approach addresses or mitigates susceptibility.