Password and Update Policy Requirements

The password duty is simple in wording but easy to fail in practice. If a product uses passwords, each password must either be unique per product or defined by the user of the product. That is tighter than a generic policy against weak defaults.

If you use pre-installed unique passwords, do not derive them from an incremental counter, publicly available information, or a serial number unless the derivation method is protected so that a person who knows the serial number cannot practically work out the password. ETSI material remains useful for designing and testing that control.

The duty is not satisfied by an internal mailbox or an unpublished security page. The information must be publicly available, clear, transparent, in English, free of charge, and available without prior request or the collection of personal information before the person can read it.

The published information must explain how to report issues and when the reporter should expect an acknowledgement of receipt and status updates. ETSI guidance is useful here because it helps teams operationalize those public commitments, even though the UK law does not impose a single fixed remediation deadline.

The manufacturer must publish the defined support period in a way that is accessible, clear, transparent, in English, free of charge, and available without prior request or the collection of personal information. The published period is the minimum length of time, expressed as a period with an end date, for which security updates will be provided.

Where the manufacturer publishes an invitation to purchase on its own website or another non-paid-for online sales channel it controls, the support-period information must appear there alongside the purchase information or with equivalent prominence. If the statement route is used, the defined support period also controls statement retention.