UK PSTI Product Security Regime
Baseline product-security obligations for relevant consumer connectable products supplied to UK consumers.
beta · ruleset 1.0.0 · reviewed 2026-09-22
Deterministic decisions
Whether the product is a relevant consumer connectable product supplied in the UK.
engineering_complete_legal_review_required
Role of the assessed economic actor.
engineering_complete_legal_review_required
Authoritative sources
Product Security and Telecommunications Infrastructure Act 2022 — Part 1
https://www.legislation.gov.uk/ukpga/2022/46/part/1/enacted
primary_binding_law · reviewed 2026-09-22
GOV.UK — Regulations: consumer connectable product security
https://www.gov.uk/guidance/regulations-consumer-connectable-product-security
official_guidance · reviewed 2026-09-22
PSTI (Security Requirements for Relevant Connectable Products) Regulations 2023
https://www.legislation.gov.uk/uksi/2023/1007/contents/made
primary_binding_law · reviewed 2026-09-22
Obligation library
No universal/easily guessable default passwords
Meet the applicable password security requirement for in-scope consumer connectable products.
Publish vulnerability-reporting information
Publish information enabling security issues to be reported, with required contact/response information.
Publish minimum security-update period
Publish the minimum period for which security updates will be provided.
Statement of Compliance
Ensure the product is accompanied by the required Statement of Compliance and retain it as required.
Generated artifacts
UK PSTI Scope Report
report · template v1.0.0
UK PSTI Statement of Compliance Draft
statement_of_compliance · template v1.0.0 · signature required
Vulnerability Disclosure Policy Starter
policy · template v1.0.0
Security Update Period Publication Text
disclosure · template v1.0.0