Cybersecurity Certifications

Across the globe, a myriad of cybersecurity regulations are being introduced in various countries and regions. In the IoT industry, cybersecurity certifications are gaining heightened importance for both brand owners and consumers. Contemporary cybersecurity regulations and standards, believed to have originated in Europe, are now expanding globally. This topic describes the global standards for certifying the cybersecurity of IoT products.

Overview

In a nutshell, cybersecurity can be divided into two parts: data security and communications security.

• Data security: Protect personal data and sensitive device data.
• Communications security: Assess the vulnerabilities in IoT devices that can be exploited by hackers, and consider the countermeasures and protection mechanisms.

ETSI EN 303 645

ETSI EN 303 645, a globally applicable standard for consumer IoT, is designed to prevent large-scale attacks against smart devices by establishing a security and privacy baseline for connected consumer products and provides a basis for future IoT certification schemes. It also supports products’ compliance with the EU GDPR. It covers the security requirements for devices, communications, and personal data protection. The standard outlines 15 cybersecurity provisions for consumer IoT.

ETSI EN 303 645 has been embraced or cited by many countries, leading to considerable alignment between this standard and the cybersecurity requirements of countries such as Finland, Singapore, Vietnam, Brazil, the United Kingdom, Japan, and more. If your product is already certified under ETSI EN 303 645, you can obtain certification in a specific country or region by meeting distinct requirements that do not overlap.

• Comparison between ETSI EN 303 645 and Japan’s MIC Article 34-10 Amendment (overlaps marked in green)

  

• Comparison between ETSI EN 303 645 and Singapore’s IMDA TS RG-SEC (overlaps marked in green)

  

• Comparison between ETSI EN 303 645 and Brazil’s Act 77/2021 (overlaps marked in green and specific requirements marked in yellow)

  

• Comparison between ETSI EN 303 645 and the U.S.'s NISTIR 8259A (overlaps marked in green)

  

Differences between NISTIR 8425 and NISTIR 8259A

• NISTIR 8259A: IoT Device Cybersecurity Capability Core Baseline
• NISTIR 8425: Profile of the IoT Core Baseline for Consumer IoT Products

NISTIR 8259A device cybersecurity capabilities

Six device cybersecurity capabilities are defined in NISTIR 8259A.

• Device Identification. The ability to uniquely identify devices for management and anti-forgery.
• Device Configuration. The ability for an authorized entity to configure the device security parameters.
• Data Protection. The ability to prevent the user data and security configuration data at rest and in transit from any compromise.
• Logical Access to Interfaces. The ability to restrict access to interfaces to only authorized entities.
• Software and Firmware Update. The ability to employ a secure mechanism for conducting updates to prevent malicious actors from tampering with firmware and software updates, thereby minimizing cybersecurity incidents.
• Cybersecurity Event Logging. The ability to log security events for analysis of cybersecurity incidents or risks and manage vulnerabilities and patches.

NISTIR 8425 product cybersecurity capabilities

Six product cybersecurity capabilities are defined in NISTIR 8425.

• Asset Identification. The ability to identify IoT products and their components is necessary to support such activities as asset management for updates, data protection, and digital forensics capabilities for incident response.
• Product Configuration. The ability to change the permissions to IoT product configurations can help customers tailor the IoT product’s functionality to their needs and goals. Customers can configure their IoT products to avoid specific threats and risks based on their risk appetite.
• Data Protection. The ability to prevent the user data and security configuration data at rest and in transit from any compromise.
• Interface Access Control. The ability to restrict access to interfaces to only authorized entities.
• Software and Firmware Update. The ability to employ a secure mechanism for conducting updates to prevent malicious actors from tampering with firmware and software updates, thereby minimizing cybersecurity incidents.
• Cybersecurity State Awareness. The IoT product can capture and record information about the state of IoT components that can be used to detect cybersecurity incidents affecting or affected by IoT product components and the data they store and transmit.

Singapore’s mutual recognition with Finland and Germany for cybersecurity labels

A cybersecurity label is designed to help consumers quickly identify the security information of smart products and select smart devices that are less vulnerable to hacking.

Cybersecurity label examples

	Finland	Germany	Singapore
Cybersecurity label

Singapore’s Cybersecurity Labelling Scheme (CLS)

There are four levels of rating under the CLS to indicate the security level of home appliances and smart home devices.

Mutual Recognition: Singapore and Finland

Singapore and Finland have signed a Memorandum of Understanding (MoU) to mutually recognize the Cybersecurity Labels issued by CSA and the Transport and Communications Agency of Finland (Traficom) in 2021. Under the MoU, consumer IoT products that have met the requirements of Finland’s Cybersecurity Label are recognized as having met the requirements of Level 3 of Singapore’s Cybersecurity Labelling Scheme, and products with CLS Level 3 and above are recognized by Finland to have met their requirements.

Level 3 and Level 4 applications for consumer IoT products may be granted both Singapore’s Cybersecurity Labelling Scheme label and the Finnish Cybersecurity Label at once, with a single application process.

Mutual Recognition: Singapore and Germany

Singapore and Germany have signed a Mutual Recognition Arrangement (MRA) to mutually recognize the cybersecurity labels issued by CSA and the Federal Office for Information Security of Germany (BSI) in 2022. Under the MRA, smart consumer products issued with Germany’s IT Security Label will be recognized by CSA to have fulfilled Level 2 of Singapore’s Cybersecurity Labelling Scheme, and products with CLS Level 2 and above are recognized by Germany to have met their requirements.

The mutual recognition of cybersecurity labels will apply to devices intended for use by consumers such as smart cameras, smart TVs, smart speakers, smart toys, smart garden and household robots, gateways and hubs for home automation, health trackers, smart lighting, smart plug (smart power socket), and smart thermostats.