ETSI EN 303 645 is a European standard of baseline cybersecurity requirements for consumer Internet of Things devices. Version 2.1.1 is dated June 2020. Section 5 has 13 groups of provisions, from no universal default passwords to validating input data, mixing mandatory "shall" and recommended "should" items.
The 13 groups
- No universal default passwords.
- Implement a means to manage reports of vulnerabilities.
- Keep software updated.
- Securely store sensitive security parameters.
- Communicate securely.
- Minimize exposed attack surfaces.
- Ensure software integrity.
- Ensure that personal data is secure.
- Make systems resilient to outages.
- Examine system telemetry data.
- Make it easy for users to delete user data.
- Make installation and maintenance of devices easy.
- Validate input data.
Shall and should
The standard marks some provisions as mandatory and others as recommendations, and some are conditional. The document says it uses non mandatory "should" provisions for recommendations. An implementation table at the end lets a maker record whether each is supported, not applicable or not supported, with a reason.
A few examples worth knowing
- Passwords: where used, they shall be unique per device or defined by the user, and pre installed ones must not be guessable, such as incremental counters or values derived from a MAC address or Wi-Fi name.
- Vulnerability disclosure: the manufacturer shall publish a policy with contact details and timelines for acknowledgement and status updates.
- Support period: the manufacturer shall publish the defined support period in a clear, transparent way.
- Debug interfaces: where physically accessible they shall be disabled in software.
- Sensing: all external sensing capabilities, such as cameras or microphones, shall be documented clearly.
- Deletion: users shall be able to erase user data from the device in a simple manner.
How to use it
- Pick one product and fill in the implementation table honestly.
- Treat each shall without evidence as a defect to fix.
- Treat each should as a decision to record, not to ignore.
- Link each row to proof, such as a test report or design note.
- Repeat for each product line.
Relationship to other rules
The UK requirements on passwords, vulnerability reporting and update periods map closely to provisions 5.1, 5.2 and 5.3 of the standard. NIST IR 8425 covers similar ground in the US. I have not verified which laws formally rely on this standard, so check the relevant regulator before claiming compliance with one by meeting another.
Where Safeguard fits
Several provisions depend on knowing what software is in your firmware. Safeguard provides SBOM and dependency scanning, and you can try a free scan at gold.safeguard.sh/scan.
Quick check
Is ETSI EN 303 645 a law?
No. It is a standard. Other rules or schemes may refer to it, so check each one.
Sources
- ETSI EN 303 645 V2.1.1 (2020-06)
- GOV.UK: The UK product security regime
- NIST: IR 8425 publication page
Last reviewed: 19 October 2026.
