UK Product Security and Telecommunications Infrastructure Act (PSTI)
Security requirements (Schedule 1) and deemed compliance – UK Product Security and Telecommunications Infrastructure Act (PSTI)

UK Product Security and Telecommunications Infrastructure Act (PSTI) R.D: Deemed compliance routes

What does R.D require?

A manufacturer is treated as meeting a security requirement if it meets the corresponding deemed-compliance condition: ETSI EN 303 645 V2.1.1 provisions 5.1-1 (and 5.1-2) for passwords, 5.2-1 or ISO/IEC 29147:2018 paragraphs 6.2.2, 6.2.5 and 6.5 (publishing how to access the reporting mechanism and when acknowledgement and ongoing communication follow) for reporting, and 5.3-13 for the support period; or, since 4 December 2025, the product holds an unexpired Japan JC-STAR STAR-1 label or a label at any level of the Singapore Cybersecurity Labelling Scheme.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in Security requirements (Schedule 1) and deemed compliance – UK Product Security and Telecommunications Infrastructure Act (PSTI)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll UK Product Security and Telecommunications Infrastructure Act (PSTI) controls