A cited workflow for moving from EN 303 645 provision claims to TS 103 701 identification, , , test planning, verdicts, and review.
Use this sequence to prepare implementation and assessment records alongside the official ETSI standards. Completing it does not establish certification or conformance.
Prepare only after identifying the Device Under Test and completing the for the exact product and software version. ETSI EN 303 645 V3.1.3 supplies the baseline consumer IoT provisions and Annex B implementation record; ETSI TS 103 701 V2.1.1 supplies the assessment method, roles, test-plan inputs, conceptual and functional tests, verdicts, and rules for .
ETSI TS 103 701 defines the Device Under Test as the specific consumer IoT device that is assessed against ETSI EN 303 645 provisions. The evidence workflow should therefore begin with a precise record before anyone collects policies, test reports, screenshots, or external certificates.
The record should identify the product name and type, hardware configuration, runtime environment or operating system where applicable, factory firmware version, assessment software version, and associated services needed for assessment. TS 103 701 assumes the DUT is in live operation and that the does not control its associated services, so the record should explain how those dependencies are observed or documented.
Sources (2)
Source for DUT, SO, TL, live-operation assumptions, and the role of associated services in assessment.
Device Under Test
Source for the consumer IoT scope, including devices connected to network infrastructure and interactions with associated services.
consumer IoT devices
The is where the states which EN 303 645 provisions are claimed for the . Keep this separate from internal control language: the support decision should be tied to the EN 303 645 provision, while the detail field explains the implemented measure, non-support reason, or not-applicable rationale.
EN 303 645 Annex B provides the pro forma context for support values and detail. TS 103 701 then states that the SO shall complete the correctly and the shall validate it, including checking mandatory provisions, conditional provisions, feature-dependent provisions, and N/A claims against the available information.
Sources (2)
Source for support statuses, detail expectations, mandatory and recommended notation, and N/A rationale in the implementation conformance statement pro forma.
Implementation conformance statement pro forma
Source for completing and verifying the ICS during the assessment procedure.
The TL shall validate the ICS
The is not a new EN 303 645 obligation. Under TS 103 701, it is the extra implementation and assessment-environment information that enables the to perform appropriate test activities. It is the basis for grey-box testing and provides design details for the TL.
Complete entries for provisions claimed as Yes in the . TS 103 701 says the SO is not required to complete all IXIT entries, but the entries that are necessary for claimed provisions need to be exhaustive and correct. If the information is incomplete or insufficient for proper test execution, an verdict may result.
Sources (1)
Source for IXIT purpose, grey-box testing, completion expectations, references to existing documentation, and inconclusive verdict risk.
basis for grey-box testing methodology
TS 103 701 test cases typically distinguish conceptual and functional aspects. Conceptual assessment checks conformity of the against the requirements of the provision, while functional assessment checks functionality, associated-service relations, or development and management processes against the provision requirements.
A useful evidence workflow therefore has two lanes. The conceptual lane holds design explanations, process descriptions, public user information, entries, and documented rationale. The functional lane holds observations from the , interface behavior, test outputs, update behavior, publication checks, or process evidence that demonstrates the implementation behaves as claimed.
Sources (1)
Source for conceptual and functional test distinctions, test plans, test units, and documented indications for verdicts.
Conceptual: Assessing conformity of the IXIT
This workflow helps connect DUT scope, EN 303 645 ICS claims, TS 103 701 IXIT detail, test plans, verdict records, and external evidence checks.
Convert DUT scope, ICS rows, IXIT dependencies, evidence gaps, and verdict readiness into accountable assessment tasks.
Resolve applicability, ICS, IXIT, external-evidence, and verdict questions before implementation or assessor handoff.
Review DUT scope, provision claims, evidence owners, and TS 103 701 workflow gaps with Sorena.
TS 103 701 defines overall verdicts, test group verdicts, and test case verdicts. For workflow purposes, this means an evidence pack should not stop at gathered documents; it should show whether each claimed provision has enough material for the corresponding test group and whether the result is pass, fail, , or still open.
The overall verdict depends on a valid and the verdicts for provisions claimed as Yes. PASS requires a valid ICS and a PASS test-group verdict for every provision claimed as Yes. FAIL results from an invalid ICS or at least one FAIL test-group verdict for a claimed provision. applies when no FAIL criterion is met but at least one claimed provision has an INCONCLUSIVE test-group verdict.
Sources (1)
Source for overall, test group, and test case verdict rules, including PASS, FAIL, and INCONCLUSIVE handling.
Instructions for the assignment of the overall verdict
TS 103 701 allows existing security certifications or third-party evaluations of parts of the to be used partially as evidence to reduce assessment effort. That is not the same as a blanket EN 303 645 conformance claim. The SO has to announce the evidence in the addressed detail field and provide the certification, certification details, test reports, or other information needed for verification.
The still examines whether the is adequate for the corresponding test group. TS 103 701 states that the Test Laboratory shall examine scope against the test group objective, whether the test activities meet each test purpose in the group, and whether the test depth or evaluation assurance level is appropriate to the level addressed by the test group.
Sources (1)
Source for when existing certifications or third-party evaluations may be used and what the TL examines before accepting them for a test group.
Existing security certifications or third-party evaluations
Assign each check and resolve missing information before relying on an assessment result.
Sources (2)
Source for the assessment phases: DUT identification, ICS, IXIT, ICS verification, performing assessment, and overall verdict.
Phases of the assessment procedure
Source for EN 303 645 as the consumer IoT baseline provisions being claimed through the ICS.
Baseline Requirements
"Baseline Requirements"
"consumer IoT devices"
"The TL shall validate the ICS"
"Phases of the assessment procedure"
"The TL uses these documents to derive a test plan."
"Device Under Test"
"Implementation conformance statement pro forma"
"Existing security certifications or third-party evaluations"
"basis for grey-box testing methodology"
"Conceptual: Assessing conformity of the IXIT"
"Instructions for the assignment of the overall verdict"
Decide whether a connected product is in scope of ETSI EN 303 645, define the consumer IoT evidence boundary, and document N/A justifications for assessment.
Plan ETSI EN 303 645 compliance evidence for consumer IoT products with scope, ICS, IXIT, TS 103 701 assessment steps, verdict risks, and cited controls.
Track ETSI EN 303 645 version evidence, ETSI deliverable status checks, TS 103 701 assessment alignment, and change triggers for consumer IoT security work.
Cited workflow for ETSI EN 303 645 vulnerability disclosure: public policy contents, reporting contact, acknowledgement and status timelines, timely action, and TS 103 701 evidence.
Guide to ETSI EN 303 645 data protection provisions for consumer IoT, including security, consent, telemetry, deletion, minimization, aggregation, and anonymization.
Practical answers to common ETSI EN 303 645 questions on consumer IoT scope, associated services, passwords, updates, vulnerability disclosure, telemetry, deletion, and assessment evidence.
Build a cited ICS and IXIT evidence template for ETSI EN 303 645 consumer IoT assessments, with clear separation between EN provisions and TS 103 701 test information.
This ETSI EN 303 645 implementation checklist helps scope a consumer IoT product, record Annex B support statuses, map IXIT evidence, and avoid weak conformance claims.
Build ETSI EN 303 645 implementation evidence from Annex B support/detail records, TS 103 701 ICS and IXIT inputs, test verdicts, and scoped external evidence.
Decide whether ETSI EN 303 645 applies to a consumer IoT product, what associated services belong in scope, and how to record justified non-applicability.
Map ETSI EN 303 645 consumer IoT requirements to product scope, Annex B ICS entries, TS 103 701 evidence, and implementation owners.
Build secure-update evidence for ETSI EN 303 645 using provision 5.3, Annex B support/detail records, and TS 103 701 ICS, IXIT, and test-plan inputs.
Map ETSI EN 303 645 secure-update provisions into a practical workflow for consumer IoT update mechanisms, support-period disclosures, and TS 103 701 evidence.
Source-backed guide to ETSI EN 303 645 clauses 5.2 and 5.3 for consumer IoT vulnerability disclosure, security updates, support periods, and assessment evidence.
Compare ETSI EN 303 645 consumer IoT evidence with the EU Cyber Resilience Act's scope, manufacturer duties, application dates, and conformity requirements.
Compare ETSI EN 303 645 consumer IoT evidence with the RED cybersecurity requirements, EN 18031 standards, application date, and conformity routes.
Compare ETSI EN 303 645 evidence with UK PSTI scope, three mandatory security requirements, statements of compliance, duties, and enforcement.
Decide whether a device and its associated services are in scope of ETSI EN 303 645 V3.1.3 and document the DUT, ICS, IXIT, and assessment boundary.
ETSI EN 303 645 default password guidance for consumer IoT: unique or user-defined passwords, pre-installed password generation, change mechanisms, brute-force controls, and TS 103 701 evidence.
What ETSI EN 303 645 says about deleting user data and personal data from consumer IoT devices, associated services, apps, and evidence records.
ETSI EN 303 645 support-period guidance for consumer IoT: defined security-update support periods, user-accessible publication, non-updateable-device replacement support, model designation, and TS 103 701 evidence.
ETSI EN 303 645 telemetry guidance for consumer IoT teams: security anomaly examination, IXIT 24-TelData evidence, personal-data minimization, and consumer telemetry disclosures.
ETSI EN 303 645 test evidence guidance for consumer IoT teams: ICS support claims, IXIT detail, TS 103 701 test plans, verdicts, and external evidence checks.
What ETSI EN 303 645 requires for consumer IoT vulnerability disclosure policies, report handling, status updates, timely action, and TS 103 701 evidence.
How ETSI EN 303 645 V3.1.3 treats use-case resource constraints, non-updateable devices, N/A claims, authentication controls, and assessment evidence.