Artifact GuideUKSupport Periods

UK PSTI Product Security Support Periods

Support Periods decisions under UK PSTI Product Security should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.

Use this guide to turn official requirements into scope, evidence, owner, and review decisions. This guidance is practical, source-linked, and should be validated against current legal and policy requirements before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Questions

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

This page explains the PSTI support-period rule: manufacturers must publish information on minimum security update periods, including the minimum length of time security updates will be provided and an end date. Use it to determine which UK PSTI Product Security duties apply, who owns each action, required evidence, and the review path for escalation decisions.

Search this module

Find a question or answer quickly

3 of 3 questions

Question 1

What should teams do about Support Periods under UK PSTI Product Security?

Teams should treat Support Periods under the UK PSTI Act as a source-linked operating decision: confirm whether the product is a relevant connectable product, identify the manufacturer, importer or distributor duties that apply, and publish the minimum security update period information required by the regime, including the minimum length of time updates will be provided and an end date.

The safest first step is to classify the product and supply-chain role before deciding whether the duty belongs to the manufacturer, importer, distributor, or all of them.

Write the Support Periods decision in one sentence before drafting controls.
Attach the external source URL and a short source quote to the evidence record.
Route unclear cases to legal, privacy, security, or compliance review before launch.

Citations

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

GOV.UK overview confirming the PSTI regime includes publishing minimum security update period information.

Regulations: consumer connectable product security

GOV.UK guidance supporting support-period evidence, statement-of-compliance checks, and supply-chain role review.

Regulation of consumer connectable product cyber security

UK impact assessment background for the consumer-connectable-product security regime and update-transparency policy.

Question 2

What evidence should teams keep for Support Periods under UK PSTI Product Security?

Useful evidence is not just a product-security policy. Keep the source, product facts, password and vulnerability-disclosure proof, support-period statement, supply-chain role mapping, and statement-of-compliance approval together.

Source URL and quote used for the decision.
Scope notes, screenshots, data-flow or system references, and role mapping.
Implementation ticket, approval record, exception notes, and review date.

Citations

Regulations: consumer connectable product security

GOV.UK guidance supporting support-period evidence, statement-of-compliance checks, and supply-chain role review.

Regulation of consumer connectable product cyber security

UK impact assessment background for the consumer-connectable-product security regime and update-transparency policy.

Consumer connectable product security regulations

OPSS enforcement guidance cited for regulator response evidence when support-period records are questioned.

Question 3

Which mistakes create risk when handling Support Periods under UK PSTI Product Security?

The common failure pattern is using a generic IoT security claim without proving the PSTI product scope, exact responsible role, customer-facing support information, and statement-of-compliance record.

Using an old threshold, deadline, source page, or contract template without checking current source text.
Treating a source-linked exception as a general exemption for every product or data flow.
Publishing notices, controls, or answers that do not match the actual product behavior.

Citations

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

GOV.UK overview confirming the PSTI regime includes publishing minimum security update period information.

Regulations: consumer connectable product security

GOV.UK guidance supporting support-period evidence, statement-of-compliance checks, and supply-chain role review.

Regulation of consumer connectable product cyber security

UK impact assessment background for the consumer-connectable-product security regime and update-transparency policy.

Consumer connectable product security regulations

OPSS enforcement guidance cited for regulator response evidence when support-period records are questioned.

Recommended next step

Turn UK PSTI Product Security Support Periods into assigned work

Use this UK PSTI Product Security guide to turn Support Periods into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena.

Assessment workflow

Open Assessment Autopilot for UK PSTI Product Security

Turn Support Periods into scoped questions, evidence fields, and review tasks.

Explore next step

Research workflow

Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step

Talk to Sorena

Talk through UK PSTI Product Security implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step

Primary sources

References and citations

Consumer connectable product security regulations

gov.uk

Referenced sections

OPSS enforcement guidance cited for regulator response evidence when support-period records are questioned.

"OPSS is the enforcement authority responsible for ensuring compliance with the legislation."

Regulation of consumer connectable product cyber security

legislation.gov.uk

Referenced sections

UK impact assessment background for the consumer-connectable-product security regime and update-transparency policy.

"The government has been working with the tech industry to better secure consumer connectable products for several years"

Regulations: consumer connectable product security

gov.uk

Referenced sections

GOV.UK guidance supporting support-period evidence, statement-of-compliance checks, and supply-chain role review.

"Information on minimum security update periods must be published and made available to the consumer in a clear accessible and transparent manner. This must be the minimum length of time security updates will be provided along with an end date."

THE PRODUCT SECURITY AND TELECOMMUNICATIONS INFRASTRUCTURE (SECURITY REQUIREMENTS FOR RELEVANT CONNECTABLE PRODUCTS) REGULATIONS 2023

legislation.gov.uk

Referenced sections

UK statutory instrument cited for the relevant-connectable-product security requirements behind support-period evidence.

"security requirements for relevant connectable products"

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

gov.uk

Referenced sections

GOV.UK overview confirming the PSTI regime includes publishing minimum security update period information.

"The security requirements relate to: banning universal default and easily guessable passwords; publishing information on how to report security issues; publishing information on minimum security update periods."

Related guides