E-Book21 chapters # UK Cyber Security and Resilience Bill Handbook A handbook to UK cyber law for device makers: PSTI Act security requirements, the Cyber Security and Resilience Bill, supply chain rules and documentation. The complete reference for UK connected-device cyber security compliance — the Product Security and Telecommunications Infrastructure Act 2022's three security requirements, the statement of compliance and technical file OPSS expects, and the Cyber Security and Resilience Bill's expanded scope, designated critical supplier power, incident reporting timelines, and penalties. Built for manufacturers, compliance teams, and hardware startups who need a durable desk reference, not just a video course. ## What you'll learn * Map the UK's cyber security regulatory landscape and know exactly which law — PSTI, CSRB, or both — applies to your product * Classify any connected product into or out of PSTI Act scope, and correctly apply its exemptions * Implement all three PSTI security requirements — password, vulnerability disclosure, and update-period rules — correctly * Build the statement of compliance and technical documentation file OPSS actually expects to see * Understand the Cyber Security and Resilience Bill's expanded scope and the designated critical supplier power * Meet CSRB incident reporting timelines and understand the two-tier turnover-based penalty structure * Compare the UK regime to the EU's NIS2, RED cybersecurity requirements, and Cyber Resilience Act * Build a real, ongoing compliance program instead of treating registration as a one-time checkbox $24.99 One-time purchase · Read in browser · No subscription * Map the UK's cyber security regulatory landscape and know exactly which law — PSTI, CSRB, or both — applies to your product * Classify any connected product into or out of PSTI Act scope, and correctly apply its exemptions * Implement all three PSTI security requirements — password, vulnerability disclosure, and update-period rules — correctly Buy for $24.99 Secure checkout via Paddle Not what you expected? Contact us within 14 days. This book is included free when you enroll in the full course — [$199.00 for the complete video curriculum plus this book](/courses/37-uk-cyber-security-resilience-bill-connected-devices). Built from a regulatory graph already at work 2,051 users this week 658 guides 323 product types 9 markets ## Chapters Read Chapter 1 free → 1 The Big Picture Two separate UK laws reach a connected device manufacturer, and they are not the same law wearing two names. 2 The UK Regulatory Framework Every rule in this book traces back to a specific piece of legislation, and this chapter establishes how the PSTI Act and the Cyber Security and Resilience B… 3 PSTI Act 2022: Scope & Product Classification Every PSTI obligation flows from one prior question: is your product actually inside the Act's scope. 4 Security Requirement 1: No Default Passwords The first PSTI security requirement is the one manufacturers most often get partially right and then quietly undermine through a non-compliant reset path. 5 Security Requirement 2: Vulnerability Disclosure A published, standing invitation for outsiders to tell you when your product is broken — mandatory, not a courtesy — and this chapter covers exactly what a c… 6 Security Requirement 3: Minimum Security Update Period A promise made at launch that has to be kept for years afterward. 7 Statement of Compliance & Technical Documentation Meeting the three security requirements in engineering isn't compliance by itself — PSTI requires you to prove it. 8 PSTI Enforcement: OPSS Powers & Penalties Every requirement covered so far exists inside a real enforcement structure. 9 The Cyber Security and Resilience Bill: Scope & Structure With PSTI's product-level requirements fully covered, this chapter turns to the second law — critical infrastructure regulation that can reach a manufacturer… 10 CSRB's Newly Regulated Entities Data centres, large load controllers, and managed service providers — three genuinely new categories under this Bill, each one relevant to a device manufactu… 11 Designated Critical Suppliers The mechanism most likely to surprise a device manufacturer who has never thought of themselves as critical infrastructure — and a deliberate regulatory tool… 12 Incident Reporting Under CSRB The obligation with the tightest real-world clock: a 24-hour initial notification and a 72-hour full report, alongside customer notification running in paral… 13 CSRB Enforcement & Penalties What actually happens when CSRB obligations aren't met — the two-tier penalty structure, daily fines, and what genuinely triggers enforcement in practice. 14 The NCSC Cyber Assessment Framework Behind both PSTI's technical expectations and CSRB's security-measure obligations sits a common reference point — the clearest picture available of what UK r… 15 UK vs. EU: NIS2, RED & the Cyber Resilience Act For any manufacturer selling into both markets — where the UK and EU regimes align closely enough to share evidence, and where they genuinely diverge and nee… 16 Full Walkthrough: A Connected Device Manufacturer's Compliance Program Corvid Sensing is a composite case study, built from real patterns, walking every system in this book through one realistic company building a compliance pro… 17 Common Mistakes & Edge Cases Every mistake catalogued in this chapter traces back to a system covered earlier in the book — which is exactly the argument for treating compliance as one i… 18 Your Compliance Action Plan The closing chapter turns everything in this book into a concrete thirty, sixty, ninety-day plan, and an honest look at what comes after it. 19 Knowledge Checks Every knowledge check from the course, collected here for quick self-testing. 20 Appendix A: Downloadable Tools 21 Appendix B: Cross-Reference & Enforcement Response Playbook Buy for $24.99 ## Want the full video course? This book's companion course covers the same material with video lessons and downloadable resources — and includes this book free. [ ![UK Cyber Security and Resilience Bill Course](/posters/37-uk-cyber-security-resilience-bill-connected-devices.svg) ](/courses/37-uk-cyber-security-resilience-bill-connected-devices) Intermediate2h 21m [ ### UK Cyber Security and Resilience Bill Course ](/courses/37-uk-cyber-security-resilience-bill-connected-devices) UK connected device cyber law explained: the PSTI Act's three security requirements, the Cyber Security and Resilience Bill, supply chain duties and compliance. Includes the ebook, free $199.00[View course →](/courses/37-uk-cyber-security-resilience-bill-connected-devices) Need more than one? The **All-Access Krono Vault** unlocks every course and book for one payment, or put your whole team on it with **Krono Team Vault**. [See pricing](/pricing) Short on time? ### Rather hand it over than learn it? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. [See services](/services)