ETSI EN 303 645
ETSI EN 303 645 V3.1.3 (2024-09) is the European baseline standard for the cyber security of consumer internet of things devices and their associated services. It sets 78 provisions in thirteen areas plus a reporting duty and data protection provisions: no universal default passwords, a published vulnerability disclosure policy, secure and timely software updates with a published support period, secure storage of keys and credentials, secure communication, a minimised attack surface, software integrity, protection of personal data, resilience to outages, telemetry review, easy deletion of user data, easy secure installation, input validation, and transparency, consent and minimisation for personal data. 36 provisions are mandatory (shall) and 42 are recommendations (should), several of them conditional on a feature or a stated condition; the manufacturer records why any recommendation is not applied.
ETSI EN 303 645 is a compliance framework from European Union with 15 domains and 78 controls that map to 5 other frameworks. The largest domains are 5.3 Keeping software updated – ETSI EN 303 645 (19 controls), 5.6 Minimising exposed attack surfaces – ETSI EN 303 645 (10 controls), 6 Data protection provisions for consumer IoT – ETSI EN 303 645 (9 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (15)
5.0 Reporting implementation – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.0-1 | Justification recorded for each recommendation not applied |
5.1 No universal default passwords – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.1-1 | Passwords unique per device or set by the user |
| etsi-en-303-645::Provision 5.1-2 | Pre-installed unique passwords generated to resist automated attack |
| etsi-en-303-645::Provision 5.1-2A | No passwords for machine-to-machine authentication |
| etsi-en-303-645::Provision 5.1-3 | Best practice cryptography in authentication mechanisms |
| etsi-en-303-645::Provision 5.1-4 | Simple way to change the authentication value |
| etsi-en-303-645::Provision 5.1-5 | Brute-force attacks over network interfaces made impracticable |
5.10 Examining system telemetry data – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.10-1 | Telemetry examined for security anomalies |
5.11 Deletion of user data – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.11-1 | Simple erasure of all user data from the device |
| etsi-en-303-645::Provision 5.11-2 | Deletion of personal data from associated services from the device |
| etsi-en-303-645::Provision 5.11-3 | Clear instructions for deleting personal data |
| etsi-en-303-645::Provision 5.11-4 | Clear confirmation that personal data has been deleted |
5.12 Easy installation and maintenance – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.12-1 | Minimal user decisions and usable security in installation and maintenance |
| etsi-en-303-645::Provision 5.12-2 | Guidance on secure setup |
| etsi-en-303-645::Provision 5.12-3 | Guidance on checking the device is set up and kept secure |
5.13 Input data validation – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.13-1A | Validation of application-layer input from user interfaces |
| etsi-en-303-645::Provision 5.13-1B | Validation of application-layer input from network interfaces |
5.2 Managing reports of vulnerabilities – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.2-1 | Public vulnerability disclosure policy |
| etsi-en-303-645::Provision 5.2-2 | Disclosed vulnerabilities acted on in a timely manner |
| etsi-en-303-645::Provision 5.2-3 | Continuous monitoring and remediation across the support period |
5.3 Keeping software updated – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.3-1 | Mutable software components securely updateable |
| etsi-en-303-645::Provision 5.3-10 | Network-delivered updates verified through a trust relationship |
| etsi-en-303-645::Provision 5.3-11 | User told clearly when a security update is required and why |
| etsi-en-303-645::Provision 5.3-12 | User notified when an update will disrupt basic functioning |
| etsi-en-303-645::Provision 5.3-13 | Defined support period published |
| etsi-en-303-645::Provision 5.3-14 | Rationale and hardware replacement support published for non-updateable devices |
| etsi-en-303-645::Provision 5.3-15A | Non-updateable devices isolable |
| etsi-en-303-645::Provision 5.3-15B | Hardware of non-updateable devices replaceable |
| etsi-en-303-645::Provision 5.3-16 | Model designation clearly recognisable |
| etsi-en-303-645::Provision 5.3-2 | Secure update mechanism present |
| etsi-en-303-645::Provision 5.3-3 | Updates simple for the user to apply |
| etsi-en-303-645::Provision 5.3-4A | At least one secure update mechanism configurable as automatic |
| etsi-en-303-645::Provision 5.3-4B | Automatic secure updates activated at initialization after consent |
| etsi-en-303-645::Provision 5.3-5 | Check for security updates after initialization |
| etsi-en-303-645::Provision 5.3-6A | User control over automatic updates |
| etsi-en-303-645::Provision 5.3-6B | User control over update notifications |
| etsi-en-303-645::Provision 5.3-7 | Best practice cryptography for secure updates |
| etsi-en-303-645::Provision 5.3-8 | Timely security updates |
| etsi-en-303-645::Provision 5.3-9 | Device verifies authenticity and integrity of updates |
5.4 Secure storage of sensitive security parameters – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.4-1 | Sensitive security parameters stored securely in persistent storage |
| etsi-en-303-645::Provision 5.4-2 | Hard-coded unique device identity tamper-resistant |
| etsi-en-303-645::Provision 5.4-3 | No hard-coded critical security parameters in source code |
| etsi-en-303-645::Provision 5.4-4 | Unique per-device keys for update checks and service communication |
5.5 Secure communication – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.5-1 | Best practice cryptography for secure communication |
| etsi-en-303-645::Provision 5.5-2 | Reviewed or evaluated implementations for network and security functions |
| etsi-en-303-645::Provision 5.5-3 | Cryptographic algorithms and primitives replaceable |
| etsi-en-303-645::Provision 5.5-4 | Network access to device functions only after authentication |
| etsi-en-303-645::Provision 5.5-5 | Security-relevant configuration over the network only after authentication |
| etsi-en-303-645::Provision 5.5-6 | Critical security parameters encrypted in transit |
| etsi-en-303-645::Provision 5.5-7 | Confidentiality of critical parameters over remotely accessible interfaces |
| etsi-en-303-645::Provision 5.5-8 | Secure lifecycle management of critical security parameters |
5.6 Minimising exposed attack surfaces – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.6-1 | Unused network and network-reachable logical interfaces disabled |
| etsi-en-303-645::Provision 5.6-2 | Minimal unauthenticated disclosure of security information |
| etsi-en-303-645::Provision 5.6-3 | Physical interfaces not unnecessarily exposed |
| etsi-en-303-645::Provision 5.6-4A | Debug interfaces disabled or protected |
| etsi-en-303-645::Provision 5.6-4B | Physical debug ports physically protected |
| etsi-en-303-645::Provision 5.6-5 | Only needed software services enabled |
| etsi-en-303-645::Provision 5.6-6 | Code minimised to necessary functionality |
| etsi-en-303-645::Provision 5.6-7 | Software runs with least necessary privilege |
| etsi-en-303-645::Provision 5.6-8 | Hardware-level memory access control |
| etsi-en-303-645::Provision 5.6-9 | Secure development processes for device software |
5.7 Software integrity – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.7-1 | Software verified by secure boot |
| etsi-en-303-645::Provision 5.7-2 | Alert on unauthorised software change and restrict connectivity |
5.8 Security of personal data – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.8-1 | Personal data in transit to associated services protected |
| etsi-en-303-645::Provision 5.8-2 | Sensitive personal data in transit protected |
| etsi-en-303-645::Provision 5.8-3 | External sensing capabilities documented for the user |
5.9 Resilience to outages – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 5.9-1 | Resilience to data network and power outages built in |
| etsi-en-303-645::Provision 5.9-2 | Local operation during network loss and clean recovery after power loss |
| etsi-en-303-645::Provision 5.9-3 | Orderly and stable network connection |
6 Data protection provisions for consumer IoT – ETSI EN 303 645
| Code | Title |
|---|---|
| etsi-en-303-645::Provision 6-1 | Clear information on what personal data is processed, why, by whom and for how long |
| etsi-en-303-645::Provision 6-2 | Valid means of obtaining consent |
| etsi-en-303-645::Provision 6-3A | Consent can be withdrawn at any time |
| etsi-en-303-645::Provision 6-3B | Consent information stored |
| etsi-en-303-645::Provision 6-4 | Personal data in telemetry limited to what the functionality needs |
| etsi-en-303-645::Provision 6-5 | Consumers told what telemetry is collected and how it is used |
| etsi-en-303-645::Provision 6-6 | Data limited to purpose and deleted when no longer needed |
| etsi-en-303-645::Provision 6-7 | Minimal collection and early aggregation for aggregate-only purposes |
| etsi-en-303-645::Provision 6-8 | Anonymisation used in collection, processing and storage |
Your Compliance Coverage
If you comply with ETSI EN 303 645, you already cover:
EU Cyber Resilience Act
58%
54 controls mapped
Compare →ISO 27002:2022
43%
40 controls mapped
Compare →NIST SP 800-53 Rev 5
5%
5 controls mapped
Compare →+ 2 more: GDPR (2%), NIST Cybersecurity Framework 2.0 (2%)
See all 5 mapped frameworks ↓Maps to 5 other frameworks
Coverage is not the same as your position
This page shows what ETSI EN 303 645 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is ETSI EN 303 645 and who does it apply to?
ETSI EN 303 645 is a compliance framework from European Union with 15 domains and 78 controls. ETSI EN 303 645 V3.1.3 (2024-09) is the European baseline standard for the cyber security of consumer internet of things devices and their associated services. It sets 78 provisions in thirteen areas plus a reporting duty and data protection provisions: no universal default passwords, a published vulnerability disclosure policy, secure and timely software updates with a published support period, secure storage of keys and credentials, secure communication, a minimised attack surface, software integrity, protection of personal data, resilience to outages, telemetry review, easy deletion of user data, easy secure installation, input validation, and transparency, consent and minimisation for personal data. 36 provisions are mandatory (shall) and 42 are recommendations (should), several of them conditional on a feature or a stated condition; the manufacturer records why any recommendation is not applied. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ETSI EN 303 645 actually require?
ETSI EN 303 645 has 78 controls organised across 15 domains. The largest domains are 5.3 Keeping software updated – ETSI EN 303 645 (19 controls), 5.6 Minimising exposed attack surfaces – ETSI EN 303 645 (10 controls), 6 Data protection provisions for consumer IoT – ETSI EN 303 645 (9 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ETSI EN 303 645 do I already cover?
ETSI EN 303 645 maps to 5 other compliance frameworks. The top mapping partners are EU Cyber Resilience Act (58% coverage), ISO 27002:2022 (43% coverage), NIST SP 800-53 Rev 5 (5% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement ETSI EN 303 645?
Start your ETSI EN 303 645 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ETSI EN 303 645 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 78 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required