Operate intake, acknowledgement, status updates, investigation, remediation, disclosure, and evidence while keeping the legal publication duty distinct from broader good-practice response targets.
PSTI mandates the public reporting information and promised timing information. It does not set one universal acknowledgement, status-update, remediation, or disclosure deadline.
Publish the reporting route before supply, then operate the process you promised. Schedule 1 requires the manufacturer to publish at least one point of contact and information about when a reporter can expect acknowledgement and status updates until resolution. The information must be in English, free, accessible, clear, transparent, and available without prior request and without asking for personal information. Broader triage, remediation, coordination, and disclosure steps are operational controls and ETSI guidance unless another legal duty is triggered.
Before release, publish a monitored point of contact and the expected acknowledgement and status-update timings. Test the route from outside the company and make sure it accepts enough information to identify the product and issue without forcing a reporter to buy, register, or request access.
When a report arrives, preserve the original submission, assign a case identifier, acknowledge it within the published timing, and tell the reporter how status updates will work. Continue status updates through resolution as promised. Do not promise a fixed remediation date unless the manufacturer can support it; Schedule 1 requires publication of the expected communication timings, not one government-set fix deadline.
Apply the public route to reports about all products identified by the policy, including reports about an older or out-of-support release. Support status can change the remediation decision, but it does not justify ignoring a report or missing the published acknowledgement and status-update process.
Sources (1)
Binding publication, contact, acknowledgement-timing, status-update-timing, language, cost, access, clarity, and transparency requirements.
The case record should prove both sides of the control: what the manufacturer publicly promised and what happened for the individual report. Keep operational targets clearly labelled so they are not mistaken for statutory deadlines. Record calendar dates and time zones for acknowledgement and update promises; labels such as "promptly" or "regularly" are hard to test and defend.
Sources (2)
Official explanation of the public vulnerability-reporting information required from manufacturers.
Provision 5.2-1 supports the public policy; provisions 5.2-2 and 5.2-3 are recommendations for timely action and ongoing monitoring, not additional PSTI deadlines.
A vulnerability report is not automatically a PSTI or an OPSS notification. A compliance failure concerns failure to meet a relevant security requirement or an applicable Chapter 2 duty, depending on the actor and provision. Assess that question separately from technical severity and coordinated disclosure, then apply the role-specific investigation, action, contact, notification, and record duties. Preserve the point at which each actor knew or ought to have known the relevant facts.
For a manufacturer, section 10 requires all reasonable steps to investigate when it is informed of a possible failure after UK availability and is aware, or ought to be aware, that the product is or will be a UK consumer connectable product. If the section 11 failure and awareness conditions hold, take all reasonable steps to prevent further availability and remedy the failure as soon as practicable. Notify OPSS, other known manufacturers and the importers or distributors supplied as soon as possible, subject to the exception for a relevant person whose statutory contact revealed the failure. Customer notification depends on the further specified conditions. Include the failure, known risks, remedial steps and whether they succeeded; tell notified manufacturers, importers and distributors whether OPSS was notified. Importers and distributors must apply their own sections rather than this manufacturer recipient list.
Close the case only after recording the technical outcome and the communication outcome. A duplicate, invalid, accepted-risk, fixed, mitigated, or unsupported report needs a reason, approver, reporter message, next review trigger, and any separate compliance-failure decision.
Sources (2)
Binding role-specific investigation and compliance-failure duties.
Official enforcement context for compliance-failure notifications and regulator response.
Track receipt, acknowledgement, triage, status updates, technical resolution, reporter communication, and the separate statutory failure decision.
Create case fields and review tasks from intake through technical and legal closure.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Understand when a UK PSTI statement is required, the Schedule 4 fields, supply-chain checks, retention, digital accompaniment, and the December 2025 label route.
Publish a free, clear, accessible English reporting route plus expected acknowledgement and status-update times, and retain evidence that the information remained available.
Apply the UK PSTI tests in order: connectivity, current exceptions, UK consumer availability, supply facts, and the manufacturer, importer, or distributor trigger.
Use a release checklist with scope, role, security-control, statement, records, and compliance-failure evidence for UK consumer connectable products.
Build a UK PSTI compliance process covering product scope, supply-chain roles, the three security requirements, statements, records, and post-market failures.
Apply the UK PSTI password rule to each relevant password, test unique-per-product generation, and keep reset and release evidence for the shipped model.
Distinguish manufacturer, importer, distributor, and authorised-representative duties per product and supply route, including rebranding, imports, statement checks, stop-supply decisions, and compliance failures.
Implement the UK PSTI password rule and publish a defined security support period with the required end date, access conditions, and change controls.
Track the UK PSTI regime's commencement and amendment dates, product-specific support periods, record retention, and OPSS response and appeal windows.
Get direct, sourced answers on product scope, exceptions, roles, passwords, vulnerability reporting, update-period information, statements, records, and OPSS enforcement.
Identify the pre-supply checks, statement or deemed-compliance evidence, stop-supply decisions, notification and remediation duties required of UK importers and distributors, plus importer-specific investigation and record duties.
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in clear language, without implying that PSTI sets one duration for every product.
Understand OPSS investigations, compliance, stop and recall notices, monetary penalties, forfeiture, court orders, representations, appeals, and evidence needed to respond.
Prepare for compliance, stop, and recall notices by understanding their effects, representation and appeal routes, product records, and corrective-action evidence.
Understand the maximum fixed and daily PSTI penalties, how OPSS sets an amount, representation and appeal rights, and separate court-ordered sanctions.
Read the three Schedule 1 security requirements and the surrounding manufacturer, importer, distributor, statement, record, and failure-response duties.
Decide whether one product meets the UK PSTI connectivity definition, falls within a current exception, and reaches the separate UK-consumer duty tests.
Understand which connected product categories can enter UK PSTI scope, how the statutory tests work, and why examples never replace the current exception schedule.
Decide whether a product falls within the UK PSTI product-security regime by checking connectivity, consumer supply, exceptions, actor roles, and product-specific evidence.
Implement the three UK PSTI security requirements through product specifications, release tests, public information, approvals, and post-release evidence.
Join the prescribed statement fields to product identifiers, control evidence, publication records, supply-chain checks, accompaniment evidence, retention, and change management.
Build a statement record with the prescribed Schedule 4 information and evidence that it accompanied the product, while checking whether a current Schedule 2A deemed-compliance route applies.
Prepare, approve, provide, verify, retain, and update statement evidence before a relevant connectable product is made available in the UK.
Set, publish, approve, and preserve the product-specific minimum security-update period and end date, then control changes and customer information against the shipped product.
Map ETSI EN 303 645 and TS 103 701 evidence to the three UK legal requirements without treating the wider voluntary ETSI baseline as if every provision were mandatory under PSTI.
Compare UK PSTI with Australia's Cyber Security Act smart-device rules by scope, duties, statements, security controls, retention, dates, and enforcement.
See how binding UK PSTI duties relate to ETSI EN 303 645, which edition the UK Regulations name, what the standard adds, and what evidence to retain.
Decide whether UK PSTI, the EU Cyber Resilience Act, or both apply, then compare actors, exclusions, security work, documents, reporting, and dates.
Compare UK PSTI and the EU Cyber Resilience Act by scope, security duties, support periods, conformity assessment, reporting, evidence, and application dates.
PSTI requires each covered password to be user-defined or unique per product. Unique credentials must not use prohibited predictable generation methods.
ETSI EN 303 645 and TS 103 701 can structure technical evidence, but the standards-based PSTI route depends on the exact mapped provisions and additional Schedule 2 conditions.
An internet- or network-connectable product is outside the relevant-product definition only when a current Schedule 3 exception applies; record the exact category and facts rather than relying on a broad sector label.
Importers and distributors have their own statement, stop-supply, remediation, and notification duties; importers also have statutory investigation and 10-year investigation-record duties.
OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.
A product is relevant when it is internet-connectable or network-connectable and not excepted, then the UK consumer-use and supply facts determine whether the Part 1 duties engage.
PSTI does not prescribe a universal minimum number of support years. The manufacturer sets and publishes a product-specific minimum period and end date; preserve the published commitment and assess any later change against the current Regulations.
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in language understandable without technical knowledge.
A statement must contain the prescribed information and accompany the product unless a current deemed-compliance route applies; a digital method is possible, but each business must ensure that it meets the Act.
Publish a clear reporting route plus expected acknowledgement and status-update times. PSTI requires the information and timescales to be available; it does not prescribe one universal response deadline for every report.