UK PSTI preparation begins with product scope and the applicable exclusions. Assess password practices, the vulnerability reporting contact and published security update support information. Check the required statement of compliance against the actual product and responsible operator. Technical evidence should support the claims made to distributors and customers.
Project preparation
Provide the intended markets, product architecture, interfaces, sample configuration, software versions and available design evidence. Agree testing access, restrictions and a version baseline. Record remediation changes and retest the affected controls before closing findings.
Delivery and scope
The agreed deliverables may include an applicability record, gap list, test plan, findings and retest records. Confirm the report purpose and any additional certification or conformity assessment steps required by the recipient. The preparation guidance below explains the information needed to scope a proposal.
Official references
Check current official texts and applicable standards for your product.Plan your testing project
What determines the testing scope?
UK supply routes, product exclusions, password controls, vulnerability reporting contacts and security update support information. Scope is confirmed against current official requirements and the actual product configuration.
What should be prepared before quotation?
Provide a product description, intended markets, interfaces, architecture and data-flow diagrams, hardware and software versions, update design, account roles and available test samples. Include prior reports and known issues if available.
How are lead time and price determined?
They depend on applicable requirements, number of interfaces and variants, test access, document readiness and remediation cycles. After a document review we agree milestones and quotation assumptions. A universal price or fixed turnaround would not reflect these differences.
What commonly causes retesting?
Missing interface descriptions, inaccessible administrator functions, undocumented cloud dependencies, changing firmware during testing and insufficient evidence of remediation. Agree a version baseline and track each change against affected test cases.
What will be delivered?
The agreed scope may include an applicability record, gap list, test plan, findings, remediation and retest records, and a test report. Confirm report purpose, recipient requirements and any need for a notified or certification body before placing the order.