Internet-connected smart devices must now meet minimum security standards by law, but what does this mean for manufacturers?
Internet-connected smart devices must now meet minimum security standards by law, but what does this mean for manufacturers?
As of April, ‘World-first’ laws have been brought into force to protect UK consumers and businesses from hacking and cyber-attacks. Manufacturers of all internet-connected ‘smart’ devices are now required to implement minimum security standards against cyber threats, marking a significant step towards boosting the UK’s resilience to cyber crime.
“As everyday life becomes increasingly dependent on connected devices, the threats generated by the internet multiply and become even greater,” says the UK Minister for Cyber, Viscount Camrose. “Consumers will have greater peace of mind that their smart devices are protected from cyber criminals, as we introduce world-first laws that will make sure their personal privacy, data and finances are safe. We are committed to making the UK the safest place in the world to be online and these new regulations mark a significant leap towards a more secure digital world.”
IMPROVING RESILIENCE
The laws have come into force as part of the Product Security and Telecommunications Infrastructure (PSTI) regime, which has been designed to improve the UK’s resilience from cyber-attacks and ensure malign interference does not impact the wider UK and global economy.
The new measures will introduce a series of improved security protections to tackle the threat of cyber crime. Manufacturers will have to publish contact details so bugs and issues can be reported and dealt with, and they will also be required to be open with consumers on the minimum time they can expect to receive important security updates.
Cade Wells, Business Developpment Director at CENSIS – Scotland’s innovation centre for sensing, imaging, and IoT technologies – says of the legislation: “The new Product Security and Telecommunications Infrastructure Act underscores the UK’s Government’s commitment to strengthening the security of consumer-connectable devices […]. Manufacturers, importers and distributors of most Internet of Things (IoT) devices being sold in the UK are affected, and there are potential penalties for those who fail to comply. In the most severe cases, a penalty of either £10 million or 4% of the company’s global revenue – whichever is greater – may be imposed.”
To introduce this raft of protections, the UK government has worked closely with industry leaders. Going forwards, manufacturers will have to publish information on how to report security issues to increase the speed at which they can address these problems. The government is also beginning the legislative process for certain automotive vehicles to be exempt from the product security regulatory regime, as they will be covered by alternative legislation.
“This move highlights the emergence of cyber security as a fundamental aspect of product design and business strategy, marking a significant step towards creating a safer and more reliable IoT ecosystem,” Wells adds. “We will likely see further regulatory change in the future, so businesses must remain vigilant to ensure they maintain compliance and protect consumers.”
