UK government publishes new IoT security legislation proposals

The UK Department for Digital, Culture, Media & Sport and the National Cyber Security Centre (NCSC) published a call for views on the government proposal to regulate the security of Internet of things (IoT) devices for consumers. 

According to the proposal IoT products should follow three requirements: (a) device passwords must be unique and not resettable to any universal factory setting; (b) manufacturers must provide a public point of contact so anyone can report a vulnerability; (c) information about the minimum length of time for which the device will receive security updates must be provided to customers. The proposal details the products which would not be included within this legislative framework because they are covered or will be covered by alternative regulation. These are products such as smart metering devices that require commercial product assurance (CPA), electric vehicles, and medical devices (includes in vitro diagnostic devices and active implantables). 

These security requirements relate mostly to IoT device manufacturers within the UK and importers of such products. However, according to the proposal, distributors would also be required not to sell, supply, or make available products if they are not compliant with the defined security requirements. The proposal also deals with designating a regulator and defining measures and sanctions to be taken against those who supply or make available faulty products. All responses should be submitted until 6 September 2020. 

This call follows the government’s response to the regulatory proposals for consumer Internet of things (IoT) devices security consultation from January 2020.