IoT cybersecurity audits target the security of all devices on the Internet of Things (IoT). These devices include sensors and actuators as well as back-end connections and optionally communicate with gateways and smartphone apps – security measures to protect against threats should be set up accordingly.
Digital networking in particular makes applications and components of mobile or static IoT devices vulnerable to attacks. To access a networked device, three main targets are attacked: the device itself, the network and the infrastructure (app, cloud). However, the security of the networked environment, for example in industry, can prevent such external access or IoT attacks. Elements of holistic IoT cybersecurity include:
With our cetecom advanced IoT cybersecurity services, we verify the current security status of your networked devices – an important milestone in the market launch of your products. Benefit from our many years of experience in the regulatory certification of products with wireless technologies. When it comes to Internet of Things cybersecurity, cetecom advanced is your partner of choice.
The standards were developed by CEN/CLC/JTC 13/WG 8 and consist of the following parts:
The assignment to the essential requirements of the Radio Equipment Directive (RED) Article 3.3 (d), (e) and (f) is as follows:
|
Essential requirement |
EN 18031-1 RED 3.3 (d) |
EN 18031-2 RED 3.3 (e) |
EN 18031-3 RED 3.3 (f) |
| Security asset |
X |
X |
X |
| Network asset |
X |
– |
– |
| Privacy asset |
– |
X |
– |
| Financial asset |
– |
– |
X |
An overview of the relevant safety requirements is shown below:
|
Abbreviation |
Mechanism |
EN 18031-1 |
EN 18031-2 |
EN 18031-3 |
|
ACM |
Access control mechanism |
X |
X |
X |
|
AUM |
Authentication mechanism |
X |
X |
X |
|
SUM |
Secure update mechanism |
X |
X |
X |
|
SSM |
Secure storage mechanism |
X |
X |
X |
|
SCM |
Secure communication mechanism |
X |
X |
X |
|
RLM |
Resilience mechanism |
X |
– |
– |
|
LGM |
Logging mechanism |
– |
X |
X |
|
NMM |
Network monitoring mechanism |
X |
– |
– |
|
DLM |
Deletion mechanism |
– |
X |
– |
|
TCM |
Traffic control mechanism |
X |
– |
– |
|
UNM |
User notification mechanism |
– |
X |
– |
|
CCK |
Confidential cryptographic keys |
X |
X |
X |
|
GEC |
General equipment capabilities |
X |
X |
X |
|
CRY |
Cryptography |
X |
X |
X |
These cybersecurity tests in accordance with CEN/CENELEC EN 18031-1, EN 18031-2 and EN 18031-3 can be carried out in the cetecom advanced test laboratory. We are happy to help you on the path to cybersecurity for your devices.
Our notified bodies will also be happy to assist you with the certification of your radio equipment in accordance with RED Article 3.3 (d), (e) and (f).
Do you have any questions about EN 18031-x? Then please do not hesitate to contact us. We look forward to hearing from you: mail@cetecomadvanced.com / Tel. +49 681 598 0
The Radio Equipment Directive (RED Directive) 2014/53/EU sets the legal framework for all products that use radio technologies. The main defined requirements are health and safety, electromagnetic compatibility and efficient use of radio frequencies. Manufacturers and suppliers of these products must demonstrate compliance with RED in the EU market by providing a type examination based on technical documentation (TD) or a declaration of conformity (DoC) and CE marking.
Since 2022, the topic of IoT cybersecurity has also been defined in the RED and thus provides manufacturers with specifications as to which device security requirements must be taken into account in the future:
| Essential Requirements | Applicable Radio Equipment | NOT Applicable Radio Equipment |
|---|---|---|
| RED Article 3.3 point (d) (does not harm the network) |
any internet-connected radio equipment (directly or via any other equipment) |
|
| RED Article 3.3 point (e) (personal data and privacy are protected) |
capable of processing personal data, traffic data or location data
|
|
| RED Article 3.3 point (f) (protection from fraud) |
any internet-connected radio equipment to transfer money, monetary value or virtual currency (Directive (EU) 2019/713)
|
Originally, the new requirements for sections d) to f) of Article 3.3 were to come into force as early as August 1,2024 and thus become mandatory for affected manufacturers in a timely manner. However, the European Commission has now issued an extension of the transition period, so that the new cybersecurity requirements will come into force on August 1, 2025. Manufacturers must test their products against the new cybersecurity requirements and declare compliance with Delegated Regulation EU 2022/30. This affects both devices that are newly approved and devices that enter the EU market after August 1, 2025.
Even though the deadline has now been postponed by the EU Commission and the standards are currently not yet harmonized, we can already help you with the topic of IoT cybersecurity. With the involvement of our notified bodies, we test your products according to the cybersecurity requirements of the RED and support you in the declaration of conformity. Secure your devices now for the time after August 1, 2025 – with our expertise in the field of IoT device security, we make sure your devices are prepared for future requirements and regulations.
Do you have any questions about IoT cybersecurity tests according to the Radio Equipment Directive (RED)?
Contact us, we look forward to your inquiry: mail@cetecomadvanced.com / Phone: +49 2054 9519 0
ETSI EN 303 645 defines essential security requirements for IoT devices intended for consumers. Thanks to its universal focus, the standard can cover a wide range of IoT devices, from fitness trackers to smart fridges. This standard is primarily aimed at the manufacturers of these devices. These have the option of voluntarily integrating the requirements during the development process (security by design) and implementing them in the manufacture of their products:
Another document that can be used for IoT cybersecurity testing is ETSI TS 103 701. The specification helps manufacturers to design networked devices securely from the outset (security by design). At the same time, it acts as an internationally recognized benchmark for assessing minimum cybersecurity requirements for devices. The specification describes how conformance can be defined and comprehensively tested in accordance with the ETSI EN 303 645 security standard.
ETSI TS 103 701 ensures that test results of the security properties of IoT devices are comparable. This enables experienced IoT experts to make accurate safety assessments. Manufacturers have the option of using the test specification for self-testing or having their products evaluated by a testing body.
The cybersecurity tests according to ETSI EN 303 645 and ETSI TS 103 701 can be performed in the cetecom advanced laboratories. We are happy to help you on the way to cyber security for your devices.
Contact us, we look forward to your inquiry: mail@cetecomadvanced.com
Our laboratories in Germany and the USA have been recognized by CTIA as Authorized Test Laboratory (ATL) for the CTIA Test Plan for IoT devices.
The CTIA Cybersecurity Test Plan defines test cases that must be performed with the device in an Authorized Test Laboratory (ATL) to obtain CTIA Cybersecurity certification. The certification is defined for two levels of security. The first level (for consumer devices) tests basic security features of IoT devices, while the second level (for enterprise devices) tests security elements for devices with increasing complexity and manageability.
Based on the cetecom advanced test report, you will receive an IoT cybersecurity certification from CTIA according to the latest CTIA requirements.
Cybersecurity is becoming an integral part of product or device security and can have a positive signal effect on product sales with clear legal requirements and independent cybersecurity tests. A first step has been taken – a Europe-wide security certificate is offered by the new test mark: the CyberSecurity Certified (CSC) label.
As part of this three-stage approval process, we and our partner TÜV NORD are focusing on meeting the fundamental requirements for secure development and operation throughout the product’s lifecycle. These requirements are largely based on the basic cybersecurity requirements for consumer IoT devices according to ETSI EN 303 645.
Based on the cetecom advanced test report, you will receive the CyberSecurity Certified (CSC) label
from TÜV NORD and certification according to the latest CSC cybersecurity requirements.
