ETSI EN 303 645 v3.1.3 (2024-09) ETSI EUROPEAN STANDARD CYBER; Cyber Security for Consumer Internet of Things: Baseline Requirements ETSI EN 303 645 V3.1.3 (2024-09) 2 Reference REN/CYBER-00127 Keywords cybersecurity, loT, privacy ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 929442 00 Fax: +33493 65 4716 Siret N°348623 562 00017-APE 7112B Associationabut non lucratif enregistree a la Sous-Prefecture de Grasse (06) N° w061004871 Important notice The present document can be downloaded from the ETSlSearch&BrowseStandardsapplication. Thepresentdocumentmaybemadeavailableinelectronicversionsand/orinprint.Thecontentofanyelectronicand/or print versions of the present document shall not be modified without the prior written authorization of ETSl. In case of any existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETsi deliverable is the one made publicly available in PDF format on ETSI deliver. Users should be aware that the present document may be revised or have its status changed, this information is available in the Milestones listing. If you find errors in the present document, please send your comments to the relevant service listed under Committee Support Staff. If you find a security vulnerability in the present document, please report it through our Coordinated Vulnerability Disclosure (CVD) program. Notice of disclaimer & limitation of liability experience to understand and interpret its content in accordance with generally accepted engineering or other professional standard and applicable regulations. No recommendation as to products and services or vendors is made or should be implied. Innoeventshall ETsibeheld liableforlossofprofitsoranyotherincidentalorconsequentialdamages. limited to, the warranties of merchantability, fitness for a particular purpose and non-infringement of intellectual property of or inability to use the software. Copyright Notification microfilm except as authorized by written permission of ETSl. The content of the PDF version shall not be modified without the written authorization of ETSl. @ETSI2024. All rights reserved. ETSI EN 303645 V3.1.3 (2024-09) 3 Contents Intellectual Property Rights.... Foreword.. Modal verbs terminology.. Introduction .... 1 Scope. 2 References.. 2.1 Normative references 2.2 Informativereferences... 3 Definition of terms, symbols and abbreviations... 3.1 Terms. 3.2 3.3 Abbreviations 11 4 Implementation of the standard. 12 5 Cyber security provisions for consumer IoT. 12 5.0 Reporting implementation.... 5.1 No universal default passwords... .13 5.2 Implement a means to manage reports of vulnerabilities 5.3 Keep software updated .... 5.4 Securely store sensitive security parameters 5.5 Communicate securely 21 5.6 Minimize exposed attack surfaces 5.7 Ensuresoftware integrity... 24 5.8 Ensure that personal data is secure. 5.9 Make systems resilient to outages 25 5.10 Examine system telemetry data.... 5.11 Make it easy for users to delete user data.. 25 5.12 Make installation and maintenance of devices easy 26 5.13 Validate input data............... .27 6 Data protection provisions for consumer IoT. 28 Annex A (informative): Basic concepts and models .. .30 A.1 Architecture. .30 A.2 Device states. 32 A.3 Interfaces . Annex B (informative): Implementation conformance statement pro forma.. Annex C (informative): Change history History. 41 ETSI EN303 645 V3.1.3 (2024-09) 4 Intellectual Property Rights Essential patents IPRs essential or potentially essential to normative deliverables may have been declared to ETSI. The declarations pertaining to these essential IPRs, if any, are publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web serv