Want to show your consumer IoT device meets a recognized security baseline? We assess the device and its companion app against ETSI EN 303 645 and give you the report, provision by provision.
For manufacturers of consumer IoT devices and the companion apps that control them.
ETSI EN 303 645 is the baseline security standard for consumer IoT. It sets provisions such as no universal default passwords, a means to report vulnerabilities, secure updates, secure storage of credentials, protected communication and minimized attack surface. The companion test specification, ETSI TS 103 701, defines how each provision is assessed.
It is a baseline: generally voluntary, unless a national label or scheme requires it. Either way, you end up needing an assessment against the provisions, with the evidence behind each result.
The device is usually set up and controlled from a mobile app, so the app is part of the assessment. Depending on your product, it can cover:
States what we assessed and the result for each applicable EN 303 645 provision, following the TS 103 701 method, whether or not we found issues. Every finding includes evidence, reproduction steps, impact, a CVSS score and vector, CWE and, where they apply, OWASP MASWE references, and how to fix it.
Covers the scope and build tested, the results and the priorities, for management and non-technical readers.
If you include the retest, we send a new version of the report with the status of each finding on the new build.
We published how we analyzed the app of a Legrand/BTicino connected video intercom until we could open the door from Home Assistant. The app, the cloud API and the update path are our daily work.
Our team comes from security certification laboratories, with experience in schemes such as Common Criteria and EMVCo SBMP. We contribute to OWASP MASVS and MASTG, and OWASP recognized this by naming vulnit an OWASP MAS Advocate.
Chameleon gives us deep visibility into what the app does inside the operating system, which makes the analysis faster and more thorough. The controls that usually slow testing down, such as root, pinning and anti-instrumentation checks, are handled at the OS level by default.
Meet the teamIt is a baseline and generally voluntary. Some national labels and schemes require it, and it overlaps with the RED cybersecurity requirements and the Cyber Resilience Act. We scope the assessment so the same work serves what applies to you.
Generally no: the baseline can be self-assessed or assessed by a third party, and our report against TS 103 701 is usable as that evidence. Some formal labels require an accredited lab to issue the result; in that case our assessment prepares you for it. We are not an accredited lab.
Both. EN 303 645 covers the device and its associated services, which include the companion app and the cloud it talks to. We assess the app and those channels alongside the device.
No. By default, testing is black-box: we work with the same information an attacker would have, using the build you ship. If you prefer, we can also review the source code.
When needed. On Android we mainly work with Chameleon, our analysis environment: it gives us deep visibility into what the app does in the operating system, and handles root, pinning and anti-instrumentation checks at the OS level by default. For the device itself we work with a physical unit. On iOS we use physical devices.
It depends on the number of apps and platforms, the device interfaces in scope and how many provisions apply to your product. We send you a proposal with a fixed price and the schedule. We can usually start the same week you accept the proposal; the start date depends on our team's workload and is stated in the proposal.
The app builds (APK or AAB for Android, IPA for iOS), one or more test devices, test accounts and access to the backend environments in scope. The proposal sets out the details.
English by default. If you need it in Spanish, just tell us.
We agree confidentiality terms before you share builds, documentation or devices. We have a standard NDA, but if you prefer to use yours, we are happy to review it.
Tell us about your device and its app. We reply within one business day to arrange a scoping call.
Talk to our team