The world is becoming increasingly connected with the rapid growth of “smart” technology in various devices, such as televisions, speakers, appliances, locks, exercise trackers, and even games. According to Alex Rubert, Sales Manager at SGS Brightsight, a cybersecurity evaluation laboratory network, there were approximately 8.6 billion IoT-connected devices in 2019, which is expected to rise to 15.14 billion by 2023 and reach 29.42 billion by 2030.
However, along with the rise in IoT devices, there has been an increase in cyberattacks. A report by Check Point Research (CPR) revealed a 38% increase in attacks between 2021 and 2022, with education, government, and healthcare being the most common targets. These cyberattacks can have severe consequences, such as eavesdropping through smart speakers, compromising life support systems in hospitals, or stealing bank details.
To address these growing concerns, SGS, a global network of testing and certification laboratories for the wireless industry, provides compliance against various global regulations. These regulations include the California Consumer Privacy Act (CCPA), EU General Data Protection Regulation (GDPR), National Institute of Standards and Technology (NIST) Cybersecurity Framework (NISTIR 8259A-NIST 8425), and Australia’s Demand-response Standard AS4755.2.
According to Rubert, there is a need for more regulation to keep up with the increasing number of IoT devices and cyber threats. While implementing new legislation can be slow, it seems that cybersecurity regulation is about to catch up in 2024.
SGS highlights several new regulations and standards for consumer products that are expected to come into force in the coming months. These include the UK Product Security and Telecommunications Infrastructure (PSTI) Regulation 2023, the US Cyber Trust Mark voluntary labelling scheme based on NIST criteria, the Cybersecurity Labelling Scheme (CLS) for Singapore, and the EU-wide Cyber Resilience Act (CRA) introducing common cybersecurity rules for manufacturers and developers.
Additionally, the EU Radio Equipment Directive (RED) Article 3.3, which relates to cybersecurity and covers networks, personal data and privacy, and protection from fraud, has been postponed to 2025.
Manufacturers and importers of IoT devices will need to ensure their products conform to these new regulations and demonstrate compliance in an easily recognizable manner. SGS can assess products against required standards, issue EU-type certification for European markets, and provide the internationally recognized SGS Cybersecurity Mark for compliant products.
To gain an advantage in competitive markets, a comprehensive technical approach to compliance is necessary. In the US, assessment against NIST 8259 is required, while in Europe, compliance with ETSI EN 303 645, RED, and CLS standards is essential.
For more information on SGS Cybersecurity Services, please visit the provided link.