ETSI EN 303 645 ICS and IXIT evidence template

Start by separating three layers: the ETSI EN 303 645 provision, the ICS support decision for that provision, and the TS 103 701 IXIT information that explains the implemented mechanism or process. Do not turn IXIT fields into new EN 303 645 obligations; TS 103 701 uses IXIT information to support assessment against the EN provisions.

ETSI EN 303 645 V3.1.3 Annex B provides an implementation conformance statement pro forma. It records whether a provision is supported, not supported, or not applicable and provides a detail field for the implemented measure, non-support reason, or N/A rationale. TS 103 701 V2.1.1 identifies V3.1.3 as its normative EN reference and explains how the Supplier Organization provides ICS and IXIT to the Test Laboratory for test-plan derivation.

An evidence template should let a reviewer move from a public provision claim to the information the assessor will need. A compact register can do this without copying the standards into a spreadsheet.

Use the first columns to identify the provision and support decision, the middle columns to identify IXIT dependencies, and the final columns to record evidence, owner, version, and assessment result. This keeps public EN 303 645 claims separate from the TS 103 701 assessment mechanics that test laboratories use.

Treat ETSI EN 303 645 as the source for the consumer IoT security and data protection provisions. V3.1.3 is outcome-focused and covers devices connected to network infrastructure and their interactions with associated services. TS 103 701 assesses the DUT's relation to associated services and relevant processes.

The template should make applicability visible before it asks for evidence. EN 303 645 recognizes that provision applicability depends on the device, and Provision 5.0-1 requires a justification for each recommendation considered not applicable or not fulfilled by the consumer IoT device.

Use ETSI TS 103 701 for the assessment side of the template. It defines the Device Under Test, Supplier Organization, Test Laboratory, assessment phases, conceptual and functional test concepts, IXIT pro forma, verdict handling, and external-evidence handling.

The template needs enough IXIT detail for grey-box testing. TS 103 701 says the IXIT provides design details to the Test Laboratory and is the basis for that methodology. Incomplete or insufficient IXIT information can produce an INCONCLUSIVE verdict when it prevents proper test execution.

Before using the template in a release review, procurement response, self-assessment, or test-lab handoff, run a consistency check across the ICS and IXIT rows. Most evidence problems appear when the support claim says one thing and the IXIT, user documentation, or functional behavior says another.

This review is also where teams should remove overclaims. TS 103 701 is explicit that defining a certification or conformance declaration scheme is out of scope, and that assessment schemes typically define additional requirements such as tester expertise, cryptographic requirements, and accepted third-party evidence.

Public guidance should not blur the standards. EN 303 645 gives the baseline consumer IoT provisions and ICS pro forma context; TS 103 701 gives the assessment methodology and IXIT pro forma context. Mixing them makes the page less useful to implementers and easier to challenge in procurement or assessment review.

Remove claims that the template itself proves conformance. A template can organize evidence and make assessment preparation more consistent, but the assessment result depends on the completed ICS, sufficient IXIT information, applied test groups, verdict rules, and any assessment-scheme requirements.