{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/uk-psti-connectable-product-security-procurement-questions/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/",
        "slug": "uk-psti-connectable-product-security-procurement-questions",
        "url": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/uk-psti-connectable-product-security-procurement-questions/"
        },
        "title": "Use the UK’s connected-product security law as three procurement questions for cameras and IoT devices",
        "summary": "Since 29 April 2024, UK law requires consumer connectable products to ship without guessable shared passwords, to publish how to report security issues, and to state a minimum security update period with an end date. Those three requirements make practical buying questions anywhere.",
        "format": {
            "slug": "explainer",
            "name": "Explainer"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "physical-security",
            "label": "Physical security",
            "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "video-surveillance",
                "name": "Video Surveillance",
                "url": "https://update.dsesecurity.com/topic/video-surveillance/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-18T21:00:37+00:00",
        "modified_at": "2026-10-18T22:22:07+00:00",
        "reviewed_on": "2026-10-18",
        "reading_minutes": 2,
        "word_count": 347,
        "potentially_affected": "Organizations buying cameras, doorbells, smart locks, sensors and other connected devices, and the integrators and resellers who specify them.",
        "dse_recommendation": "DSE recommends asking every connected-device vendor for its password approach, vulnerability reporting route and security update end date before approving a product.",
        "primary_source": {
            "name": "GOV.UK — The UK Product Security and Telecommunications Infrastructure (Product Security) regime",
            "url": "https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime",
            "published_on": null,
            "authority": "www.gov.uk"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Since 29 April 2024, UK law requires consumer connectable products to ship without guessable shared passwords, to publish how to report security issues, and to state a minimum security update period with an end date. Those three requirements make practical buying questions anywhere.</p>\n<h2>Source facts</h2>\n<p>The UK government’s <a href=\"https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime\">product security regime guidance</a> says the consumer connectable product security regime came into effect on 29 April 2024. Its duties apply to manufacturers, importers and distributors, and the Office for Product Safety and Standards enforces it.</p>\n<p>The security requirements start with passwords: they must be unique per product or capable of being defined by the user, and unique passwords must not be based on incremental counters, publicly available information or unique identifiers such as a serial number, or be otherwise easily guessable. Manufacturers must also say how to report security issues and the timescales for acknowledgment and status updates.</p>\n<p>Manufacturers must publish a minimum security update period, stating the minimum length of time security updates will be provided along with an end date. A statement of compliance must accompany each product, and importers and distributors must not make a product available without one.</p>\n<h2>Applicability</h2>\n<p>The regime is UK law for consumer connectable products and does not bind US purchases. Use it as a procurement benchmark; US federal and state rules, such as FCC equipment restrictions, apply separately.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends asking every connected-device vendor for its password approach, vulnerability reporting route and security update end date before approving a product. Reject devices that ship with a shared default password, record each model’s security update end date in the asset inventory, and plan replacement before that date. Keep the vendor’s answers with the product approval so later purchases of the same model can be checked against them.</p>\n<h2>Verification</h2>\n<p>During commissioning, confirm each device required a unique or user-set credential, and compare installed models with the update end dates recorded at approval. Review the inventory annually for devices approaching or past their stated update period.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime\">GOV.UK — The UK Product Security and Telecommunications Infrastructure (Product Security) regime</a>. Reviewed October 18, 2026.</p>",
        "content_text": "Since 29 April 2024, UK law requires consumer connectable products to ship without guessable shared passwords, to publish how to report security issues, and to state a minimum security update period with an end date. Those three requirements make practical buying questions anywhere.\nSource facts\nThe UK government’s product security regime guidance says the consumer connectable product security regime came into effect on 29 April 2024. Its duties apply to manufacturers, importers and distributors, and the Office for Product Safety and Standards enforces it.\nThe security requirements start with passwords: they must be unique per product or capable of being defined by the user, and unique passwords must not be based on incremental counters, publicly available information or unique identifiers such as a serial number, or be otherwise easily guessable. Manufacturers must also say how to report security issues and the timescales for acknowledgment and status updates.\nManufacturers must publish a minimum security update period, stating the minimum length of time security updates will be provided along with an end date. A statement of compliance must accompany each product, and importers and distributors must not make a product available without one.\nApplicability\nThe regime is UK law for consumer connectable products and does not bind US purchases. Use it as a procurement benchmark; US federal and state rules, such as FCC equipment restrictions, apply separately.\nDSE recommendation\nDSE recommends asking every connected-device vendor for its password approach, vulnerability reporting route and security update end date before approving a product. Reject devices that ship with a shared default password, record each model’s security update end date in the asset inventory, and plan replacement before that date. Keep the vendor’s answers with the product approval so later purchases of the same model can be checked against them.\nVerification\nDuring commissioning, confirm each device required a unique or user-set credential, and compare installed models with the update end dates recorded at approval. Review the inventory annually for devices approaching or past their stated update period.\nOfficial reference\nGOV.UK — The UK Product Security and Telecommunications Infrastructure (Product Security) regime. Reviewed October 18, 2026.",
        "content_markdown": "Since 29 April 2024, UK law requires consumer connectable products to ship without guessable shared passwords, to publish how to report security issues, and to state a minimum security update period with an end date. Those three requirements make practical buying questions anywhere.\n\n## Source facts\n\nThe UK government’s [product security regime guidance](https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime) says the consumer connectable product security regime came into effect on 29 April 2024. Its duties apply to manufacturers, importers and distributors, and the Office for Product Safety and Standards enforces it.\n\nThe security requirements start with passwords: they must be unique per product or capable of being defined by the user, and unique passwords must not be based on incremental counters, publicly available information or unique identifiers such as a serial number, or be otherwise easily guessable. Manufacturers must also say how to report security issues and the timescales for acknowledgment and status updates.\n\nManufacturers must publish a minimum security update period, stating the minimum length of time security updates will be provided along with an end date. A statement of compliance must accompany each product, and importers and distributors must not make a product available without one.\n\n## Applicability\n\nThe regime is UK law for consumer connectable products and does not bind US purchases. Use it as a procurement benchmark; US federal and state rules, such as FCC equipment restrictions, apply separately.\n\n## DSE recommendation\n\nDSE recommends asking every connected-device vendor for its password approach, vulnerability reporting route and security update end date before approving a product. Reject devices that ship with a shared default password, record each model’s security update end date in the asset inventory, and plan replacement before that date. Keep the vendor’s answers with the product approval so later purchases of the same model can be checked against them.\n\n## Verification\n\nDuring commissioning, confirm each device required a unique or user-set credential, and compare installed models with the update end dates recorded at approval. Review the inventory annually for devices approaching or past their stated update period.\n\n## Official reference\n\n[GOV.UK — The UK Product Security and Telecommunications Infrastructure (Product Security) regime](https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime). Reviewed October 18, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/",
                "url": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-18"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Use the UK’s connected-product security law as three procurement questions for cameras and IoT devices",
                        "item": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/#article",
                "identifier": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/",
                "url": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/",
                "headline": "Use the UK’s connected-product security law as three procurement questions for cameras and IoT devices",
                "description": "Since 29 April 2024, UK law requires consumer connectable products to ship without guessable shared passwords, to publish how to report security…",
                "abstract": "Since 29 April 2024, UK law requires consumer connectable products to ship without guessable shared passwords, to publish how to report security issues, and to state a minimum security update period with an end date. Those three requirements make practical buying questions anywhere.",
                "articleBody": "Since 29 April 2024, UK law requires consumer connectable products to ship without guessable shared passwords, to publish how to report security issues, and to state a minimum security update period with an end date. Those three requirements make practical buying questions anywhere.\nSource facts\nThe UK government’s product security regime guidance says the consumer connectable product security regime came into effect on 29 April 2024. Its duties apply to manufacturers, importers and distributors, and the Office for Product Safety and Standards enforces it.\nThe security requirements start with passwords: they must be unique per product or capable of being defined by the user, and unique passwords must not be based on incremental counters, publicly available information or unique identifiers such as a serial number, or be otherwise easily guessable. Manufacturers must also say how to report security issues and the timescales for acknowledgment and status updates.\nManufacturers must publish a minimum security update period, stating the minimum length of time security updates will be provided along with an end date. A statement of compliance must accompany each product, and importers and distributors must not make a product available without one.\nApplicability\nThe regime is UK law for consumer connectable products and does not bind US purchases. Use it as a procurement benchmark; US federal and state rules, such as FCC equipment restrictions, apply separately.\nDSE recommendation\nDSE recommends asking every connected-device vendor for its password approach, vulnerability reporting route and security update end date before approving a product. Reject devices that ship with a shared default password, record each model’s security update end date in the asset inventory, and plan replacement before that date. Keep the vendor’s answers with the product approval so later purchases of the same model can be checked against them.\nVerification\nDuring commissioning, confirm each device required a unique or user-set credential, and compare installed models with the update end dates recorded at approval. Review the inventory annually for devices approaching or past their stated update period.\nOfficial reference\nGOV.UK — The UK Product Security and Telecommunications Infrastructure (Product Security) regime. Reviewed October 18, 2026.",
                "datePublished": "2026-10-18T21:00:37+00:00",
                "dateModified": "2026-10-18T22:22:07+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Use the UK’s connected-product security law as three procurement questions for cameras and IoT devices"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Video Surveillance"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Video Surveillance",
                    "Explainer",
                    "Information priority"
                ],
                "genre": "Explainer",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Video Surveillance",
                        "url": "https://update.dsesecurity.com/topic/video-surveillance/"
                    }
                ],
                "wordCount": 347,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "GOV.UK — The UK Product Security and Telecommunications Infrastructure (Product Security) regime",
                    "url": "https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime"
                }
            }
        ]
    }
}