Artifact GuideUKSupport Period Evidence Workflow

UK PSTI Product Security Support Period Evidence Workflow

Support Period Evidence Workflow decisions under UK PSTI Product Security should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.

Use this guide to turn official requirements into scope, evidence, owner, and review decisions. This guidance is practical, source-linked, and should be validated against current legal and policy requirements before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

This page explains how to collect and record support-period evidence for UK PSTI Product Security. It shows what evidence to keep, when it is needed, and what a team should produce at the end so the statement of compliance and minimum security update period information are easy to check.

Section 1

How should a Support Period Evidence Workflow run under UK PSTI Product Security?

Run the workflow as a simple evidence trail: identify the product, confirm the support-period information that must be published, check the statement of compliance, and keep a clear record that shows who approved the decision and where the evidence is stored.

Capture the product, role, jurisdiction, deadline, and the support-period source quote.
Check that the published support period includes the minimum length of time security updates will be provided and the end date.
Record the action taken, owner, reviewer, evidence location, and next review date.
Keep a plain-language output that support, product, legal, security, and compliance teams can all understand.

Sources for this answer

Consumer connectable product security regulations

OPSS enforcement guidance cited for regulator response evidence when support-period records are questioned.

Regulation of consumer connectable product cyber security

UK impact assessment background for the consumer-connectable-product security regime and update-transparency policy.

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

GOV.UK overview confirming the PSTI regime includes publishing minimum security update period information.

Section 2

What fields should the Support Period Evidence Workflow template capture?

A useful template captures product identifiers, manufacturer, importer or distributor role, security requirement evidence, support-period wording, statement approver, importer/distributor checks, and review trigger.

Source URL and source quote.
Entity, product, service, system, data category, and user group.
Decision result, control action, owner, reviewer, due date, and escalation reason.
Evidence attachment, approval note, exception note, and review cadence.

Sources for this answer

Regulation of consumer connectable product cyber security

UK impact assessment background for the consumer-connectable-product security regime and update-transparency policy.

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

GOV.UK overview confirming the PSTI regime includes publishing minimum security update period information.

Regulations: consumer connectable product security

GOV.UK guidance supporting support-period evidence, statement-of-compliance checks, and supply-chain role review.

Section 3

How should teams review and improve the Support Period Evidence Workflow?

Review the workflow after firmware changes, supplier changes, product bundling changes, UK market placement changes, vulnerability reports, OPSS notices, or support-period updates.

Track recurring exception categories and update intake questions.
Remove fields that never affect the decision.
Add fields when reviews show missing source evidence or unclear ownership.
Confirm generated markdown and page content include the same visible source-linked guidance.

Sources for this answer

Consumer connectable product security regulations

OPSS enforcement guidance cited for regulator response evidence when support-period records are questioned.

Regulation of consumer connectable product cyber security

UK impact assessment background for the consumer-connectable-product security regime and update-transparency policy.

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

GOV.UK overview confirming the PSTI regime includes publishing minimum security update period information.

Regulations: consumer connectable product security

GOV.UK guidance supporting support-period evidence, statement-of-compliance checks, and supply-chain role review.

Recommended next step

Turn UK PSTI Product Security Support Period Evidence Workflow into assigned work

Use this UK PSTI Product Security guide to turn Support Period Evidence Workflow into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena.

Assessment workflow

Open Assessment Autopilot for UK PSTI Product Security

Turn Support Period Evidence Workflow into scoped questions, evidence fields, and review tasks.

Explore next step

Research workflow

Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step

Talk to Sorena

Talk through UK PSTI Product Security implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step

Primary sources

References and citations

Consumer connectable product security regulations

gov.uk

Referenced sections

OPSS enforcement guidance cited for regulator response evidence when support-period records are questioned.

"OPSS is the enforcement authority responsible for ensuring compliance with the legislation."

CYBER; Cyber Security for Consumer Internet of Things: Conformance Assessment of Baseline Requirements

ipr.etsi.org

Referenced sections

Supports Support Period Evidence Workflow under UK PSTI Product Security.

"- ETSI TR 103 621 (V0.0.6) (2021-06): "CYBER; Guide to Cyber Security for Consumer Internet of Things""

Regulation of consumer connectable product cyber security

legislation.gov.uk

Referenced sections

UK impact assessment background for the consumer-connectable-product security regime and update-transparency policy.

"The government has been working with the tech industry to better secure consumer connectable products for several years"

Regulations: consumer connectable product security

gov.uk

Referenced sections

GOV.UK guidance supporting support-period evidence, statement-of-compliance checks, and supply-chain role review.

"publishing information on minimum security update periods"

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

gov.uk

Referenced sections

GOV.UK overview confirming the PSTI regime includes publishing minimum security update period information.

"The security requirements relate to: banning universal default and easily guessable passwords; publishing information on how to report security issues; publishing information on minimum security update periods."

Related guides