We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUK PSTIDefault Passwords

UK PSTI default password requirements

Apply the UK PSTI password rule to each relevant password, test unique-per-product generation, and keep reset and release evidence for the shipped model.

Apply the exact Schedule 1 wording to the released product. Standards and test methods can support evidence, but only the statutory conditions determine compliance with the UK requirement.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
4

Structured answer sets in this page tree.

Primary sources
7

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

For an in-scope product, Schedule 1 paragraph 1 requires each password within its scope to be or defined by the product user. If the manufacturer supplies a unique password, its generation method must not make the password easily guessable. The rule is narrower and more precise than a general claim that every credential in a company's systems is regulated.

Section 1

Which passwords does the rule cover?

The paragraph applies to the product's hardware and pre-installed software when the product is not in the factory default state. It also covers software that is not pre-installed but must be installed on the product for every manufacturer-intended purpose that uses the product's hardware, pre-installed software, or installable software. It expressly excludes cryptographic keys, API keys, and pairing PINs for protocols outside the Internet Protocol suite.

Inventory every password-protected interface in the released configuration, including setup, recovery, maintenance, and factory-reset behavior. A credential outside paragraph 1 may still create a security risk or engage another duty, but do not present a wider security recommendation as the statutory password rule.

  • List each interface, account, user, credential origin, privilege, and reset path.
  • Record whether each credential is a password or an excluded cryptographic key, API key, or qualifying non-IP pairing PIN.
  • Map software installed or required to be installed on the product to the manufacturer's intended purpose.
  • Re-run the inventory after firmware, support-tool, or recovery changes, and after an app or cloud change that alters an in-scope product password path.
Sources for this answer
PSTI Security Requirements for Relevant Connectable Products Regulations 2023 (current text)
The current consolidated Regulations contain the detailed password, vulnerability-reporting, update-period, statement, deemed-compliance, and exception rules.
The UK Product Security and Telecommunications Infrastructure (Product Security) regime
The government policy paper explains the legislative framework, economic-operator duties, statements, and the relationship to ETSI provisions.
Section 2

Unique per product or user-defined

Each covered password must be or defined by the user. A shared password across a model line does not satisfy the first option. A setup flow can support the user-defined option when the user defines the covered password before the protected function is available.

For a manufacturer-supplied unique password, Schedule 1 prohibits generation based on incremental counters, public information, an unprotected unique product identifier, or another method that makes the password easily guessable. Printing a serial-derived credential on a label does not fix a predictable generation method.

  • Test two or more production units to confirm that manufacturer-supplied passwords differ.
  • Review the generation design for counters, serial numbers, MAC addresses, public device data, short spaces, and predictable transformations.
  • Verify the protected function cannot be used with a universal credential before user definition.
  • Check factory reset, replacement, refurbishment, and service flows for reintroduction of a shared or predictable password.
Sources for this answer
PSTI Security Requirements for Relevant Connectable Products Regulations 2023 (current text)
The current consolidated Regulations contain the detailed password, vulnerability-reporting, update-period, statement, deemed-compliance, and exception rules.
Regulations: consumer connectable product security
OPSS and DSIT guidance explains the regime, covered actors and products, the three requirements, statement accompaniment, and enforcement authority.
Section 3

Evidence for the released product

Evidence should connect the requirement to the actual build and manufacturing process. Keep the credential inventory, design decision, generation review, setup and reset tests, production-unit samples, failure criteria, and release approval. Protect the evidence itself; do not place live credentials or reusable secrets in the compliance file.

ETSI EN 303 645 V2.1.1 is named in Schedule 2 for a deemed-compliance route when all applicable conditions are met. A general certification statement or a test against another edition does not automatically prove the statutory route.

  • Record the exact hardware, firmware, app, and cloud versions tested.
  • Keep test results for first boot, setup interruption, password change, failed login, recovery, and factory reset.
  • Document how production detects duplicate or malformed generated passwords.
  • Where relying on deemed compliance, record the named standard edition, applicable provision, assessment evidence, and every Schedule 2 condition.
Sources for this answer
PSTI Security Requirements for Relevant Connectable Products Regulations 2023 (current text)
The current consolidated Regulations contain the detailed password, vulnerability-reporting, update-period, statement, deemed-compliance, and exception rules.
ETSI EN 303 645 V2.1.1: Cyber Security for Consumer Internet of Things
ETSI EN 303 645 V2.1.1 is the edition named in the Regulations for specified deemed-compliance conditions; its wider provisions are not all UK statutory requirements.
ETSI TS 103 701 V1.1.1: Conformance Assessment of Baseline Requirements
ETSI TS 103 701 provides a conformance-assessment method that can inform test design, but it does not replace the conditions in the UK legislation.
Section 4

What to do when a password failure is found

A failed test before supply should block release until the affected path is corrected and retested. After supply, determine whether the facts amount to a failure of a relevant security requirement and apply the manufacturer, importer, distributor, or authorised-representative duties that fit the actor and facts.

Do not wait for OPSS contact to identify affected versions and stock. Preserve the discovery date, product population, credential path, exploitability evidence, containment, remedy, validation, customer and supply-chain actions, and statement impact.

  • Stop affected supply where the Act requires it or where the release gate has not passed.
  • Open a documented investigation and distinguish a vulnerability from a confirmed statutory compliance failure.
  • Rotate or remove exposed credentials and test factory-reset and recovery paths after the fix.
  • Notify OPSS and other persons when the applicable Act section requires notification.
Sources for this answer
Product Security and Telecommunications Infrastructure Act 2022, Part 1
Part 1 defines product and actor scope, statements, investigations, remediation, notifications, records, and enforcement.
Consumer connectable product security regulations: enforcement actions
OPSS guidance explains compliance failures, investigations, notifications, notices, penalties, representations, and appeals.
Recommended next step

Apply this guide to a product assessment

Use the page for one product model, UK route, and legal entity, with named owners, evidence requests, and review points.

Assessment workflow
Open Assessment Autopilot for UK PSTI

Create scoped questions, evidence fields, and review tasks from this guide.

Explore next step
Research workflow
Review PSTI source evidence

Use Research Copilot to answer follow-up questions with cited official and standards material.

Explore next step
Talk to Sorena
Talk through default-password remediation

Review product scope, credential flows, statement-of-compliance evidence, and next actions with Sorena.

Explore next step
Primary sources

References and citations

Related guides

Explore more topics

UK PSTI Act statement of compliance: what must the SoC contain?
Understand when a UK PSTI statement is required, the Schedule 4 fields, supply-chain checks, retention, digital accompaniment, and the December 2025 label route.
UK PSTI Act: vulnerability disclosure policy requirements and template
Publish a free, clear, accessible English reporting route plus expected acknowledgement and status-update times, and retain evidence that the information remained available.
UK PSTI applicability test: product, market, and actor scope
Apply the UK PSTI tests in order: connectivity, current exceptions, UK consumer availability, supply facts, and the manufacturer, importer, or distributor trigger.
UK PSTI compliance checklist for product release
Use a release checklist with scope, role, security-control, statement, records, and compliance-failure evidence for UK consumer connectable products.
UK PSTI compliance: duties, evidence, and response
Build a UK PSTI compliance process covering product scope, supply-chain roles, the three security requirements, statements, records, and post-market failures.
UK PSTI Default Password Rules
PSTI requires each covered password to be user-defined or unique per product. Unique credentials must not use prohibited predictable generation methods.
UK PSTI ETSI Evidence and Deemed Compliance
ETSI EN 303 645 and TS 103 701 can structure technical evidence, but the standards-based PSTI route depends on the exact mapped provisions and additional Schedule 2 conditions.
UK PSTI Excepted Products and Boundaries
An internet- or network-connectable product is outside the relevant-product definition only when a current Schedule 3 exception applies; record the exact category and facts rather than relying on a broad sector label.
UK PSTI Importer and Distributor Duties
Importers and distributors have their own statement, stop-supply, remediation, and notification duties; importers also have statutory investigation and 10-year investigation-record duties.
UK PSTI Manufacturer, Importer and Distributor Roles
Distinguish manufacturer, importer, distributor, and authorised-representative duties per product and supply route, including rebranding, imports, statement checks, stop-supply decisions, and compliance failures.
UK PSTI OPSS Notices: Compliance, Stop, Recall, and Penalties
OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.
UK PSTI password and security update policy requirements
Implement the UK PSTI password rule and publish a defined security support period with the required end date, access conditions, and change controls.
UK PSTI Product Security Deadlines and Compliance Calendar Guide
Track the UK PSTI regime's commencement and amendment dates, product-specific support periods, record retention, and OPSS response and appeal windows.
UK PSTI Product Security FAQ
Get direct, sourced answers on product scope, exceptions, roles, passwords, vulnerability reporting, update-period information, statements, records, and OPSS enforcement.
UK PSTI Product Security Importer and Distributor Duties Guide
Identify the pre-supply checks, statement or deemed-compliance evidence, stop-supply decisions, notification and remediation duties required of UK importers and distributors, plus importer-specific investigation and record duties.
UK PSTI Product Security Minimum Support Period and Update Transparency Guide
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in clear language, without implying that PSTI sets one duration for every product.
UK PSTI Product Security OPSS Enforcement and Penalties Guide
Understand OPSS investigations, compliance, stop and recall notices, monetary penalties, forfeiture, court orders, representations, appeals, and evidence needed to respond.
UK PSTI Product Security OPSS Notices Guide
Prepare for compliance, stop, and recall notices by understanding their effects, representation and appeal routes, product records, and corrective-action evidence.
UK PSTI Product Security Penalties and Fines Guide
Understand the maximum fixed and daily PSTI penalties, how OPSS sets an amount, representation and appeal rights, and separate court-ordered sanctions.
UK PSTI product security requirements
Read the three Schedule 1 security requirements and the surrounding manufacturer, importer, distributor, statement, record, and failure-response duties.
UK PSTI Relevant Connectable Product Scope
A product is relevant when it is internet-connectable or network-connectable and not excepted, then the UK consumer-use and supply facts determine whether the Part 1 duties engage.
UK PSTI relevant connectable product scope test
Decide whether one product meets the UK PSTI connectivity definition, falls within a current exception, and reaches the separate UK-consumer duty tests.
UK PSTI relevant connectable products: categories and exceptions
Understand which connected product categories can enter UK PSTI scope, how the statutory tests work, and why examples never replace the current exception schedule.
UK PSTI Scope Classifier Workflow
Decide whether a product falls within the UK PSTI product-security regime by checking connectivity, consumer supply, exceptions, actor roles, and product-specific evidence.
UK PSTI security requirements in practice
Implement the three UK PSTI security requirements through product specifications, release tests, public information, approvals, and post-release evidence.
UK PSTI Security Update Support Periods
PSTI does not prescribe a universal minimum number of support years. The manufacturer sets and publishes a product-specific minimum period and end date; preserve the published commitment and assess any later change against the current Regulations.
UK PSTI Security Update Transparency
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in language understandable without technical knowledge.
UK PSTI Statement of Compliance Evidence Pack
Join the prescribed statement fields to product identifiers, control evidence, publication records, supply-chain checks, accompaniment evidence, retention, and change management.
UK PSTI Statement of Compliance Template
Build a statement record with the prescribed Schedule 4 information and evidence that it accompanied the product, while checking whether a current Schedule 2A deemed-compliance route applies.
UK PSTI Statement of Compliance Workflow
Prepare, approve, provide, verify, retain, and update statement evidence before a relevant connectable product is made available in the UK.
UK PSTI Statement of Compliance: Contents, Delivery, and Records
A statement must contain the prescribed information and accompany the product unless a current deemed-compliance route applies; a digital method is possible, but each business must ensure that it meets the Act.
UK PSTI Support Period Evidence Workflow
Set, publish, approve, and preserve the product-specific minimum security-update period and end date, then control changes and customer information against the shipped product.
UK PSTI to ETSI Evidence Mapping
Map ETSI EN 303 645 and TS 103 701 evidence to the three UK legal requirements without treating the wider voluntary ETSI baseline as if every provision were mandatory under PSTI.
UK PSTI vs Australia Smart Device Rules
Compare UK PSTI with Australia's Cyber Security Act smart-device rules by scope, duties, statements, security controls, retention, dates, and enforcement.
UK PSTI vs ETSI EN 303 645
See how binding UK PSTI duties relate to ETSI EN 303 645, which edition the UK Regulations name, what the standard adds, and what evidence to retain.
UK PSTI vs EU Cyber Resilience Act
Decide whether UK PSTI, the EU Cyber Resilience Act, or both apply, then compare actors, exclusions, security work, documents, reporting, and dates.
UK PSTI vs EU Cyber Resilience Act (CRA)
Compare UK PSTI and the EU Cyber Resilience Act by scope, security duties, support periods, conformity assessment, reporting, evidence, and application dates.
UK PSTI Vulnerability Disclosure Requirements
Publish a clear reporting route plus expected acknowledgement and status-update times. PSTI requires the information and timescales to be available; it does not prescribe one universal response deadline for every report.
UK PSTI Vulnerability Disclosure Workflow
Operate intake, acknowledgement, status updates, investigation, remediation, disclosure, and evidence while keeping the legal publication duty distinct from broader good-practice response targets.