Artifact GuideUKVulnerability Disclosure

UK PSTI Product Security Vulnerability Disclosure

Vulnerability Disclosure decisions under UK PSTI Product Security should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.

Use this guide to turn official requirements into scope, evidence, owner, and review decisions. This guidance is practical, source-linked, and should be validated against current legal and policy requirements before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Questions

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

This page helps you determine which UK PSTI Product Security duties apply, who owns each action, required evidence, and the review path for escalation decisions. The disclosure rule requires manufacturers to publish information on how to report security issues.

Search this module

Find a question or answer quickly

3 of 3 questions

Question 1

How should teams handle vulnerability disclosure under UK PSTI Product Security?

Teams should treat vulnerability disclosure under the UK PSTI Act as a source-linked operating decision: confirm whether the product is a relevant connectable product and which manufacturer, importer, distributor, statement-of-compliance, vulnerability-disclosure, password, support-period, or OPSS enforcement duty is relevant, assign the team that can change the process, and keep evidence showing the action and review trigger.

The safest first step is to classify the product and supply-chain role before deciding whether the duty belongs to the manufacturer, importer, distributor, or all of them.

Write the vulnerability-disclosure decision in one sentence before drafting controls.
Attach the external source URL and a short source quote to the evidence record.
Route unclear cases to legal, privacy, security, or compliance review before launch.

Citations

Consumer connectable product security regulations

OPSS enforcement guidance confirms the PSTI Act and Security Requirements Regulations are the legislation OPSS enforces for product-security duties.

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

GOV.UK regime guidance confirms the relevant persons and duties that sit around vulnerability-disclosure compliance.

Regulations: consumer connectable product security

Direct support for the FAQ answer on vulnerability disclosure.

Question 2

What evidence should teams keep for vulnerability disclosure under UK PSTI Product Security?

Useful evidence is not just a product-security policy. Keep the source, product facts, password and vulnerability-disclosure proof, support-period statement, supply-chain role mapping, and statement-of-compliance approval together.

Source URL and quote used for the decision.
Scope notes, screenshots, data-flow or system references, and role mapping.
Implementation ticket, approval record, exception notes, and review date.

Citations

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

Evidence support for the FAQ answer.

Regulations: consumer connectable product security

Evidence support for the FAQ answer.

Regulation of consumer connectable product cyber security

Evidence support for the FAQ answer.

Question 3

Which mistakes create risk when handling vulnerability disclosure under UK PSTI Product Security?

The common failure pattern is using a generic IoT security claim without proving the PSTI product scope, exact responsible role, customer-facing support information, and statement-of-compliance record.

Using an old threshold, deadline, source page, or contract template without checking current source text.
Treating a source-linked exception as a general exemption for every product or data flow.
Publishing notices, controls, or answers that do not match the actual product behavior.

Citations

Consumer connectable product security regulations

Risk and boundary support for the FAQ answer.

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

Risk and boundary support for the FAQ answer.

Regulations: consumer connectable product security

Risk and boundary support for the FAQ answer.

Regulation of consumer connectable product cyber security

Risk and boundary support for the FAQ answer.

Recommended next step

Turn UK PSTI Product Security Vulnerability Disclosure into assigned work

Use this UK PSTI Product Security guide to turn Vulnerability Disclosure into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena.

Assessment workflow

Open Assessment Autopilot for UK PSTI Product Security

Turn Vulnerability Disclosure into scoped questions, evidence fields, and review tasks.

Explore next step

Research workflow

Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step

Talk to Sorena

Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step