Regulating Consumer Smart Product Security: Call for Views

Thursday 16th July 2020 Written Statements

[The Parliamentary Under-Secretary of State for Digital, Culture, Media and Sport (Matt Warman)]

This Government have ambitious plans to ensure the UK’s smart technology, products and services are more secure by having cyber-security designed into them by default.

From January 2017 to February 2018, my Department conducted a review, in collaboration with the National Cyber Security Centre, to identify proposals for improving the cyber-security of consumer smart products and associated services. This led to the creation of our code of practice for consumer internet of things (IoT) security, which was published on 14 October 2018.

The Government initially encouraged industry to adopt the guidelines in the code of practice for consumer IoT security voluntarily. However, in many cases, poor security practices remain commonplace.

In a consultation held in 2019, we found widespread support for the introduction of a mandatory cyber-security baseline for consumer smart products sold in the UK. As part of the Government response to the 2019 consultation, in January 2020 I announced the Government’s intention to implement regulation to ensure that stronger security is built into consumer smart products, aligned with the top three security requirements of the code of practice for consumer IoT security.

Since then, my officials have been working with the National Cyber Security Centre, industry leaders and cyber-security experts to develop world-leading legislation in this space. Today I am pleased to inform members that we are launching a public call for views on the Government’s proposed regulatory approach to consumer smart products on 16 July. This will run until 6 September 2020, and represents an important opportunity for us to test our proposed approach, and for industry to input and build a regulatory framework that is world-leading, promotes innovation, and protects consumers.

Our proposed regulation will set a cyber-security baseline for consumer smart products sold in the UK. The call for views will detail the scope of products the legislation would apply to, security requirements that we are proposing to mandate, obligations on producers and distributors, and a proposed enforcement approach. Following the conclusion of this call for views, we will develop our regulation approach further, before introducing legislation as soon as parliamentary time allows.

As a reserved matter, these proposed amendments will apply across the UK. The safety of consumer smart products is a priority across the whole of the UK, and my officials will continue to work closely with the devolved Administrations on this policy.

[HCWS375]