[Home](/)/[Resources](/resources)/UK PSTI Security PSTI ActCybersecurity # UK PSTI Act: Product Security Requirements Guide The Product Security and Telecommunications Infrastructure Act 2022 establishes minimum security requirements for connectable products placed on the UK market. The regulations mandate three key security requirements to improve baseline security for IoT and connected devices. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fuk-psti-security) ## Security requirements Req 1 ### No universal default passwords Products must not have universal default passwords. Each product must have unique passwords or require user-defined credentials during setup. Req 2 ### Implement a means to manage reports of security issues Manufacturers must provide a public point of contact for security researchers and others to report vulnerabilities. Reports must be acknowledged and assessed. Req 3 ### Keep software updated Security updates must be provided for a defined period. Products must clearly state the minimum update support period or update mechanisms must be in place. ## Products in scope ### Internet-connectable products Smart TVs, smart speakers, connected appliances, IoT devices ### Network-connectable products Routers, switches, access points, network storage ### Products with associated apps/services Products controlled via smartphone apps or cloud services ## Excluded products Laptops and desktop computers (though their software may be covered) Medical devices (covered by separate medical device regulations) Smart meter equipment (regulated by energy sector rules) Electric vehicle charging points (separate regulations apply) Products covered by national security exemptions Note: Excluded products may be covered by other regulations. Always verify full compliance requirements. ## Compliance and enforcement PSTI compliance is self-declared. Manufacturers must ensure their products meet the three security requirements before placing them on the UK market. A Statement of Compliance should accompany the product. Enforcement is carried out by the Office for Product Safety and Standards (OPSS) and Trading Standards. Non-compliant products may be subject to corrective measures, recalls, or penalties. The regulations include provisions for: * Compliance notices requiring corrective action * Stop notices preventing further supply * Recall notices for products already on the market * Forfeiture and destruction of non-compliant products * Financial penalties for non-compliance ## Learn this properly, not just for one product In-depth courses and books that teach the process β€” not a one-off answer you'll need to look up again next time. [Start the course β€” $149](/courses/18-uk-psti-act-iot-product-security-compliance)See your free roadmap [Prefer to read? Get the book β€” $24.99](/books/18-uk-psti-act-iot-product-security-compliance) ## Frequently asked questions ### What is the PSTI Act? The Product Security and Telecommunications Infrastructure Act 2022 establishes minimum security requirements for connectable consumer products placed on the UK market. It aims to improve baseline security for IoT and network-connected products. ### Do I need to test for PSTI compliance? PSTI compliance is primarily self-declared. There is no mandatory third-party testing or certification required. However, manufacturers must ensure their products meet the three security requirements and be prepared to demonstrate compliance if requested by authorities. ### What is the Statement of Compliance? The Statement of Compliance is a document that accompanies the product, confirming it complies with PSTI security requirements. It should include: product details, manufacturer's declaration of compliance, and contact information for the manufacturer. πŸ‡¬πŸ‡§ UK roadmap for your product Every standard, document, and test that applies β€” free, no account required. See your free roadmap[ Want an expert to take your product through πŸ‡¬πŸ‡§ UK compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course β€” $149](/courses/18-uk-psti-act-iot-product-security-compliance)[Prefer to read? Get the book β€” $24.99](/books/18-uk-psti-act-iot-product-security-compliance) Related guides * [UKCA Marking OverviewComplete guide to UKCA marking for the Great Britain market: requirements, timeline, costs, GB vs NI differences, and how to tr…](/guides/ukca-marking) * [UKCA Consumer ElectronicsComplete guide to UKCA marking for consumer electronics: applicable regulations, testing requirements, cost breakdown, and real…](/guides/ukca-consumer-electronics) * [UK Radio EquipmentComplete guide to UK Radio Equipment Regulations for GB market: UKCA marking, designated standards, testing requirements, and t…](/guides/uk-radio-equipment) * [UK EMC ComplianceComplete guide to UK Electromagnetic Compatibility Regulations: EMC testing requirements, designated standards, UKCA marking, a…](/guides/uk-emc-compliance) Educational resource only. PSTI is a relatively new regulation. Always verify current requirements with OPSS.