Compliance FrameworksEurope
ETSI EN 303 645
IoT Security Standard: software update management, supply chain security for IoT devices.
IoT Security Standard: software update management, supply chain security for IoT devices.
| Short name | ETSI IoT |
| Region | Europe |
| Country or scope | European Union |
| Sector | IoT |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ETSI IoT
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for ETSI IoT.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for ETSI IoT and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ETSI-645-5.2-1 Vulnerability Disclosure Contact | Manufacturers must publish a vulnerability disclosure policy including a contact point for reporting issues, so the SBOM/creator metadata must include reachable contact details (ETSI EN 303 645, provision 5.2-1) | Scan |
ETSI-645-5.3-UPD Update Management Visibility | Keeping software updated requires the manufacturer to know each software component and its version on the device to determine update needs (ETSI EN 303 645, provisions 5.3 series - keep software updated) | Scan |
ETSI-645-5.3-INV Device Software Inventory | Managing updates across all software components on a consumer IoT device presupposes an inventory of those components (ETSI EN 303 645, provision 5.3 - software update management scope) | Scan |
ETSI-645-5.7 Software Integrity Verification | Devices should verify their software using secure boot or equivalent mechanisms, supported by cryptographic hashes for the software components shipped (ETSI EN 303 645, provision 5.7 - ensure software integrity) | Scan |
ETSI-645-SUPP Third-Party Component Accountability | The manufacturer remains responsible for security of third-party software in the device, requiring supplier attribution for included components (ETSI EN 303 645, supply chain considerations in 5.3/vulnerability handling) | Scan |
ETSI-645-DEFPUB Defined Support Documentation | Manufacturers must publish the defined support period and update information transparently, supported by identifiable, dated composition documentation (ETSI EN 303 645, provision 5.3 - published support period) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
ETSI-4.1 | Eliminate Universal Default Passwords |
ETSI-4.2 | Implement Vulnerability Disclosure Policy |
ETSI-4.3 | Keep Software Updated |
ETSI-5.1 | Securely Store Credentials and Security-Sensitive Data |
ETSI-5.2 | Communicate Securely |
ETSI-5.3 | Minimise Exposed Attack Surfaces |
ETSI-5.4 | Ensure Software Integrity |
ETSI-5.5 | Protect Personal Data |
ETSI-5.6 | Ensure Device Resilience to Outages |
ETSI-5.7 | Examine System Telemetry Data |
ETSI-5.8 | Make It Easy for Users to Delete Personal Data |
ETSI-SUPPORT | Disclose Defined Support Period |
Policy templates
Written for ETSI IoT:
- ETSI EN 303 645 IoT Device Security Policy
- ETSI EN 303 645 Vulnerability Disclosure Policy
And 22 from the standard set, adapted to ETSI IoT.