Key Facts
- Regulator
- ETSI (European Telecommunications Standards Institute), produced by ETSI Technical Committee Cyber Security (CYBER)
- Latest version
- ETSI EN 303 645 V3.1.3 (2024-09), Cyber Security for Consumer Internet of Things: Baseline Requirements
- Effective
- 24 September 2024
- Official text
- www.etsi.org ↗
What is ETSI EN 303 645?
ETSI EN 303 645 is the European Standard for baseline cyber security and data protection in consumer Internet of Things devices. ETSI publishes it through its Technical Committee Cyber Security (CYBER). It applies to manufacturers and others in the consumer IoT supply chain, covering devices such as smart cameras, speakers, door locks and connected appliances.
The current version is ETSI EN 303 645 V3.1.3 (2024-09), Cyber Security for Consumer Internet of Things: Baseline Requirements. The full text is on the ETSI site.
The standard grew out of the UK-backed ETSI Technical Specification 103 645 of February 2019. The UK government's own record describes the June 2020 European Standard as a security baseline and a basis for future IoT certification schemes.
Its provisions are outcome-focused rather than prescriptive. They say what a device must achieve, and leave the manufacturer to choose how.
Why it matters
The request usually arrives as one line in a tender or customer questionnaire: confirm conformance with ETSI EN 303 645. You hold a copy of the standard and no clear idea what evidence the question expects.
Three pressures put the standard in front of manufacturers:
- UK law. The UK's product security regime for consumer connectable products aligns with key provisions of ETSI EN 303 645 (see the UK position below).
- The EU market. The EU Cyber Resilience Act affects UK firms selling into the EU, and ETSI is producing the vertical standards for it.
- Personal data. The standard says it can help devices comply with the GDPR, and its clause 6 sets data protection provisions for consumer IoT.
Who it applies to
ETSI EN 303 645 applies to manufacturers and other parties in the consumer IoT supply chain. Its scope is network-connected consumer devices and their associated services: smart cameras, speakers and TVs, baby monitors, door locks and connected appliances.
Devices mainly meant for manufacturing, healthcare or other industrial use are outside its scope.
Is ETSI EN 303 645 mandatory? The standard itself is voluntary. In the UK, however, the Product Security and Telecommunications Infrastructure (PSTI) Act 2022 and its 2023 Regulations make a baseline of security requirements mandatory for consumer connectable products. Those requirements align with key provisions of the standard.
ISO 27001 certifies how an organisation manages information security. ETSI EN 303 645 sets requirements for the device that organisation ships. A manufacturer can hold one without the other, because they answer different questions. For the management-system side, see the ISO 27001 vault.
The UK position
Three regimes bring ETSI EN 303 645 to a UK firm. Two are UK law, and the third applies when the firm sells into the EU:
| Regime | Who it affects | What it asks |
|---|---|---|
| PSTI Act 2022 and 2023 Regulations | Manufacturers, importers and distributors of UK consumer connectable products, in force since 29 April 2024 | Ban universal default and easily guessable passwords, publish how to report security issues, publish minimum security update periods. The Office for Product Safety and Standards (OPSS) enforces |
| UK GDPR and Data Protection Act 2018 | Firms whose devices process personal data | Clause 6 of the standard supports personal data handling, but the standard cites the EU GDPR, not UK GDPR |
| EU Cyber Resilience Act | UK firms selling into the EU | ETSI is producing the vertical standards for the Act |
The PSTI requirements are based on the top three principles of the UK Code of Practice for Consumer IoT Security. For a UK manufacturer, the law is the PSTI regime and ETSI EN 303 645 is the wider baseline it aligns with.
Key requirements
ETSI EN 303 645 is organised as follows:
- Clause 5.0: reporting implementation. How the manufacturer records which provisions it has met.
- Clauses 5.1 to 5.13: cyber security provisions. Thirteen clauses, running from no universal default passwords (5.1) to validating input data (5.13). Between them sit managing vulnerability reports, keeping software updated, storing security parameters securely, communicating securely and making it easy for users to delete their data.
- Clause 6: data protection. Provisions for consumer IoT devices that handle personal data.
- Annex B: implementation conformance statement. A pro forma that marks each provision as mandatory (M), recommended (R), conditional (C) or feature-dependent (F).
The wording carries the weight. A provision that says "shall" is mandatory within the standard. A provision that says "should" is a recommendation, which gives manufacturers flexibility.
Flexibility has a record-keeping cost. Where a recommendation is judged not to apply or not met, provision 5.0-1 requires the reason to be recorded, and Table B.1 gives a format for it.
Conformance and test reports
The standard defines device security requirements. It does not define a testing or certification method to assess them against.
A way to assess conformance sits in the companion ETSI TS 103 701. A test report therefore applies that specification's method, or a certification scheme's, to the requirements of ETSI EN 303 645.
Ask any test report which method it used. ETSI EN 303 645 does not supply one.
Frequently asked questions
ETSI is the European Telecommunications Standards Institute, a European standards organisation based in Sophia Antipolis, France. Its Technical Committee Cyber Security (CYBER) produced ETSI EN 303 645. Like other European Standards, ETSI EN 303 645 is taken into national standards: for V3.1.3, any conflicting national standard had to be withdrawn by 30 June 2025.
The standard itself is voluntary. The UK's PSTI regime makes three baseline requirements mandatory for consumer connectable products, but it excludes some categories, including medical devices, smart meter products and electric vehicle charge points. ETSI also expects future revisions of ETSI EN 303 645 to turn some of today's recommendations into mandatory provisions.
ETSI EN 303 645 defines no test or certification method, and ETSI TS 103 701 sets out a way to assess conformance. The standard notes that third-party testing is likely to need documentation such as threat models, architecture designs and lifecycle policies. A manufacturer can also publish its completed Annex B table alongside the product description, so buyers see which provisions it meets.
The current edition is ETSI EN 303 645 V3.1.3, dated September 2024 and adopted on 11 September 2024. It replaced V2.1.1 of June 2020, the first edition published as a European Standard. When a questionnaire answer or test report names ETSI EN 303 645, check which version it was assessed against.
No. Devices mainly meant for manufacturing, healthcare or other industrial use are outside the scope of ETSI EN 303 645. The line follows intended use rather than data: wearable health trackers sold to consumers are listed as in scope, as are the gateways, base stations and hubs that consumer devices connect to.