Certification mark for consumer IoT products ETSI EN 303 645

Consumer Internet of Things (CIoT) product was assessed against the provisions in ETSI EN 303 645 which are widely considered as good practice in IoT security.

This third-party assessment was performed by a harmonized approach with test groups/cases defined by ETSI TS 103701, to assess the conformance of consumer IoT products against implemented provisions of ETSI EN 303 645 declared by manufacturer.

ETSI EN 303 645 assessment are independent from any assurance scheme and aims to contribute to the protection of consumer IoT products against the most common cybersecurity threats. Multi-medium or highly targeted/sophisticated attacks and thus the invasive analysis of hard- and software modules is out of scope of the assessment.

The voluntary certification mark with the statement “Safety tested” is issued for products, indicating that the product was tested and certified by the independent third-party organisation of TÜV SÜD Product Service for conformity with the essential technical safety requirements.

Periodic surveillance and/or monitoring of the manufacture of a product constitutes the basic premise for certification that includes the award of a certification mark. Certification always requires product testing and regular factory inspections.

As a third-party expert organisation, TÜV SÜD Product Service verifies that the manufacturer is able to maintain consistent quality in line with the requirements throughout high-volume production and has established the necessary quality system, including incoming goods inspections, lists of materials and final product testing.

In addition, calibration of the necessary measuring and monitoring equipment must be ensured. Surveillance and/or monitoring covers the testing of safety-critical components and other materials used. If unauthorised changes are made to the product, the certificate will become invalid and the TÜV SÜD certification mark may no longer be used.