A manufacturer of a connected device shall equip the device with a reasonable security feature or features that are all of the following: (1) appropriate to the nature and function of the device; (2) appropriate to the information the device may collect, contain or transmit; and (3) designed to protect the device and any information contained in it from unauthorized access, destruction, use, modification or disclosure (unauthorized meaning not authorized by the consumer). The duty applies to every connected device, meaning any device or physical object that can connect to the internet directly or indirectly and is assigned an IP address or Bluetooth address, made or contracted to be made by a manufacturer for sale in California; a business that only buys, or buys and brands, a device is not the manufacturer. Operative from 1 January 2020.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.