ETSI EN 303 645 consumer IoT requirements map

Start with the product boundary. EN 303 645 applies to consumer IoT devices connected to network infrastructure, such as the Internet or a home network, and to the device interactions with associated services. The standard says associated services are digital services that, together with the device, are part of the overall consumer IoT product and are typically required for intended functionality.

The requirement map should therefore cover more than the device casing. Include firmware, user authentication, update delivery, vulnerability reporting, exposed interfaces, telemetry, personal-data handling, deletion functionality, installation guidance, and associated services that the manufacturer provides or requires. Keep user-chosen third-party services outside the EN 303 645 scope unless the cited sources support treating them as associated services.

EN 303 645 groups its cyber security provisions around specific consumer IoT outcomes. A usable requirements map should preserve those groups instead of replacing them with generic security program labels. The core groups include no universal default passwords, vulnerability reporting, software updates, sensitive security parameter storage, secure communications, attack-surface minimization, software integrity, personal-data security, outage resilience, telemetry examination, user-data deletion, installation and maintenance usability, and input validation.

The data protection section is also part of the map. It covers processing transparency; valid consent, withdrawal, and consent records where consent is the basis; telemetry minimization and transparency; purpose-based data minimization and deletion; early aggregation with limited retention; and anonymization. These are technical data-protection provisions, not a substitute for applying the relevant data protection law.

EN 303 645 Annex B provides the implementation conformance statement pro forma. Its status column uses M for a mandatory requirement, R for a recommendation, C for a conditional provision, and F for a provision tied to a feature, capability, or mechanism. The support column uses Y, N, or N/A.

Do not treat a blank or informal note as a requirements decision. For Y, explain the measures implemented. For N, explain why implementation is not possible or appropriate. N/A is available only when a C condition is not satisfied or the F feature, capability, or mechanism does not exist; record the rationale in the detail column.

Use TS 103 701 after the EN 303 645 provision map is clear. It provides the conformance assessment methodology for the baseline requirements without superseding them. In TS 103 701 terms, the supplier organization provides DUT identification, the ICS, and IXIT information, and the test laboratory uses those documents to derive a test plan.

A requirement map that says only "compliant" does not show an assessable basis. Link each EN 303 645 provision to the DUT, support status, IXIT detail, conceptual or functional test expectations, external evidence if used, and a verdict basis. TS 103 701 treats external evidence as a bounded assessment input, not a product-wide result.

Review this checklist before publishing a customer-facing claim, sending evidence to procurement, or preparing an internal or laboratory assessment. Each item should produce a named artifact, not a narrative assurance statement.

Keep the checklist versioned with the product and the ETSI source versions used. This page uses EN 303 645 V3.1.3 (2024-09) and TS 103 701 V2.1.1 (2025-05). ETSI's deliver directories listed those as the latest editions on 26 July 2026, but a procurement, certification, or regulatory context may prescribe a different edition and its own criteria.

Requirement maps fail when they collapse scope, requirements, and assessment into one unsupported claim. EN 303 645 is the outcome-focused consumer IoT baseline; TS 103 701 is the assessment methodology. Keep those layers separate and cite the source behind each decision.

Avoid copying generic workflow text into evidence fields. Name the product feature, process, user instruction, security mechanism, or associated service that supports the provision, and identify any unsupported or out-of-scope gap.