ETSI EN 303 645 provides a consumer IoT cybersecurity baseline. A scoped assessment examines password practices, vulnerability reporting, software updates, secure storage, communication and other applicable provisions. Keep a documented applicability rationale and distinguish baseline testing from any additional legal obligations or certification scheme required by the destination market.
Project preparation
Provide the intended markets, product architecture, interfaces, sample configuration, software versions and available design evidence. Agree testing access, restrictions and a version baseline. Record remediation changes and retest the affected controls before closing findings.
Delivery and scope
The agreed deliverables may include an applicability record, gap list, test plan, findings and retest records. Confirm the report purpose and any additional certification or conformity assessment steps required by the recipient. The preparation guidance below explains the information needed to scope a proposal.
Plan your testing project
What determines the testing scope?
Default credentials, vulnerability disclosure, software updates and support-period statements, distinguishing a security baseline from market-specific legal duties. Scope is confirmed against current official requirements and the actual product configuration.
What should be prepared before quotation?
Provide a product description, intended markets, interfaces, architecture and data-flow diagrams, hardware and software versions, update design, account roles and available test samples. Include prior reports and known issues if available.
How are lead time and price determined?
They depend on applicable requirements, number of interfaces and variants, test access, document readiness and remediation cycles. After a document review we agree milestones and quotation assumptions. A universal price or fixed turnaround would not reflect these differences.
What commonly causes retesting?
Missing interface descriptions, inaccessible administrator functions, undocumented cloud dependencies, changing firmware during testing and insufficient evidence of remediation. Agree a version baseline and track each change against affected test cases.
What will be delivered?
The agreed scope may include an applicability record, gap list, test plan, findings, remediation and retest records, and a test report. Confirm report purpose, recipient requirements and any need for a notified or certification body before placing the order.