Which consumer connectable products are in scope
The PSTI Act applies to "consumer connectable products," which are devices that can connect to a public electronic communications network and are intended for use by consumers in the UK market. To comply, an organization must accurately identify every product in its portfolio that meets these criteria to ensure all mandatory security requirements are applied.
What it means
The intent of this scope is to capture the vast ecosystem of Internet of Things (IoT) devices sold to the general public. A product is generally "connectable" if it possesses hardware or software capable of communicating over a network, whether via Wi-Fi, Bluetooth, cellular data, Ethernet, or other wireless protocols.
The term "consumer" typically refers to individuals acting for purposes that are not their trade, business, craft, or profession. However, in practice, this often includes any product sold through retail channels where the end-user is likely a home user, regardless of whether it is marketed as a "smart" device.
Scope determination is a binary exercise: if a device can connect to a network and is available to UK consumers, all PSTI security controls (such as password requirements and vulnerability disclosure) must be implemented. Products that are purely offline or designed exclusively for industrial/medical use may fall outside this specific scope.
How to meet it
- Conduct a full audit of the current product portfolio sold or distributed within the UK market.
- Analyze the technical specifications of each product to identify any capability to connect to a public electronic communications network.
- Review marketing materials and sales channels to determine if the target audience includes consumers/domestic users.
- Create a formal "Scope Matrix" that lists every product SKU and explicitly marks it as "In Scope" or "Out of Scope."
- Document the rationale for any product marked as "Out of Scope," citing the specific reason why it does not meet the definition of a consumer connectable product.
- Integrate a scope check into the New Product Introduction (NPI) process to ensure future designs are flagged for PSTI compliance during the design phase.
Evidence an auditor asks for
- A comprehensive Product Inventory list including all models and versions sold in the UK.
- The Scope Assessment Document or Matrix showing the classification of each product.
- Technical datasheets or architecture diagrams proving connectivity capabilities (or lack thereof).
- Market analysis or distribution lists confirming which products are accessible to UK consumers.
Common pitfalls
- Assuming a device is out of scope because it requires a hub or gateway to connect; usually, both the peripheral and the hub are in scope.
- Overlooking "Prosumer" devices that are marketed for business use but are commonly purchased by individuals for home use.
- Failing to re-evaluate scope after a firmware update adds new connectivity features to an existing product.
- Confusing PSTI scope with other certifications (like CE or UKCA), which have different criteria and requirements.