Secure Global Market Access with Cybersecurity Compliance

ETSI EN 303 645 Compliance

What is ETSI EN 303 645?

•  The EU Cyber Resilience Act
• The UK PSTI (Product Security and Telecommunications Infrastructure) Act
• Global regulatory frameworks for IoT security
  
  

• Compliance & Certification Support
  • Pre-Compliance Assessment – Identify gaps in ETSI EN 303 645 compliance
  • Technical Documentation & Test Reports – Prepare for regulatory approval
  • Certification Assistance – Meet EU regulatory requirements efficiently

• Penetration Testing & Risk Assessment
  • Resilience Testing – Evaluate IoT device security against cyber threats
  • Vulnerability Assessment – Identify weaknesses in firmware, APIs, and network protocols

• Testing for a Wide Range of IoT Products
  • Smart Home & Consumer IoT – Cameras, doorbells, smart speakers, and wearables
  • Industrial & Enterprise IoT – Smart meters, factory automation, and connected healthcare devices
  • Networked Communication Devices – Routers, gateways, and smart hubs

EU Cyber Resilience Act (CRA)

The European Union's Cyber Resilience Act (CRA) establishes stringent cybersecurity requirements that manufacturers and retailers must adhere to before their hardware and software products can be authorized for sale within the EU market. This regulation, lined up to be implemented in December 2027, aims to ensure that products with digital elements available to consumers meet current cybersecurity standards, thereby enhancing the overall security posture of the EU digital landscape.

CRA encompasses all products that have the capability to connect directly or indirectly to another device or network. This includes everything from daily consumer electronics to complex industrial systems. However, open-source software and services that are already covered by other existing regulations are excluded from the CRA's purview.

By mandating compliance with cybersecurity standards, the CRA aims to mitigate the risks associated with cyber threats, such as data breaches, malware infections, and unauthorized access. Products that successfully meet the CRA's requirements will be affixed with the CE marking, which signifies conformity with EU safety, health, and environmental protection standards. 

Obtain EU CRA marking for your products

What is the EU Cyber Resilience Act (CRA)?

The CRA applies to:

• Consumer & Industrial Digital Products – Any device or software that connects to a network
  
  • IoT & Smart Devices – Wearables, smart home devices, and connected appliances
  • Enterprise & Critical Infrastructure Systems – Cloud software, industrial automation, and communication equipment

• Excluded: Open-source software and products already regulated under existing EU cybersecurity laws.

GRL’s CRA Compliance & Cybersecurity Testing Services

• Cybersecurity Risk & Vulnerability Assessment.
  • Identify cyber threats, software vulnerabilities, and network risks
  • Secure data storage, transmission, and system integrity
• Penetration Testing & Security Validation
  • Test resilience against cyberattacks, malware, and unauthorized access
  • Assess firmware, software, and API security
• Compliance & CE Marking Readiness
  • Pre-certification assessments to identify gaps in CRA compliance
  • Technical documentation & test reports for regulatory submission
  • Support for CE marking approval
• Secure Software Development & Lifecycle Management
  • Ensure regular software updates, security patches, and incident response plans
  • Implement strong authentication & access control mechanisms

UK’s Product Security and Telecommunications Infrastructure Act 2022 (PSTIA)

The PSTIA 2022 enhances UK consumer "smart" product security by mandating strong passwords and provision of security information to customers. While these requirements only apply to manufacturers at the time of writing, experts believe that they may extend to importers and distributors in the future. Supply chain stakeholders are advised to prioritize PSTIA compliance to avoid the high cost of non-compliance.

The UK’s consumer connectable product security regime has been in effect since 29 April 2024. Since inception, the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, has required manufacturers of UK consumer connectable products (or ‘smart’ products) to comply with the relevant obligations set out in the Act, which include the following minimum-security requirements.

1. These Regulations may be cited as the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023.
2. These Regulations come into force on 29th April 2024 and extend to England and Wales, Scotland and Northern Ireland.

Enforcement of these regulations falls under the capable oversight of the Office for Product Safety and Standards (OPSS), collaborating with DSIT under an MoU, guaranteeing strict adherence to the PSTI Act 2022 and the 2023 Regulations.

• Who's in the spotlight? Manufacturers, importers, and distributors of relevant connectable products—our economic actors committed to ensuring your safety and security.
• What exactly are "relevant connectable products"? These are the game-changers—internet-connectable or network-connectable products designed to enhance your life, excluding those deemed excepted products.

Schedule 1 to the 2023 Regulations sets out the specific requirements that must be complied with in relation to relevant connectable products.

1. Passwords: Passwords must be unique per product; or capable of being defined by the user of the product. Should comply with provision 5.1-1 of ETSI EN 303 645 and, where relevant, provision 5.1-2 of ETSI EN 303 645.

2. Information on how to report security issues: The manufacturer must provide information on how to report to them security issues about their product. Should comply with provision 5.2-1 of ETSI EN 303 645.

3. Information on minimum security update periods: Information on minimum security update periods must be published and made available to the consumer in a clear accessible and transparent manner. Should comply with provision 5.3-13 of ETSI EN 303 645

National Centre for Communication Security (NCCS)

The National Centre for Communication Security (NCCS), operating under the Department of Telecommunications (DoT), Government of India, is responsible for ensuring the cybersecurity of India's critical communication infrastructure through security certification and evaluation of telecom equipment.  

The NCCS has formulated the Indian Telecom Security Assurance Requirements (ITSAR), a set of security guidelines applicable to all telecom service providers and importers of telecom infrastructure in India. 

Falling under the Mandatory Testing and Certification of Telecommunication Equipment (MTCTE), the ITSAR covers areas such as network security, data privacy, and lawful interception. Compliance with ITSAR not only ensures the security of India's telecom infrastructure but also provides telecom equipment manufacturers with a competitive advantage when bidding for contracts with Indian public and private organizations.

As a NCCS-designated Telecom Security Testing Laboratory (TSTL) GRL provides cyber security testing in accordance with ITSARs and other national and international standards to the following equipment:

• IP Routers ( Standalone, Cloud Managed, Virtual Routers)
• Wi-Fi Customer Premises Equipment (CPEs) 
• Standalone or Cloud Managed Access Points (AP)
• Optical Line Terminals (OLT) and Optical Network Terminals (ONT)
• 5G/LTE Core & Radio Network Components

Obtaining NCCS certification is a prerequisite to achieving MTCTE certification for telecom devices, which in turn is a mandatory requirement for telecom devices to enter the Indian market. 

Kickstart your ITSAR compliance journey with GRL

Learn more about NCCS

BIS CCTV cybersecurity

The Ministry of Electronics & Information Technology (MeitY) has implemented a Compulsory Registration Scheme (CRS) that requires all consumer electronics manufacturers to register their products with the Bureau of Indian Standards (BIS). This registration can only be obtained after the products have undergone testing at BIS-recognized laboratories.

In addition to electrical safety standards, all CCTV cameras must also meet the cybersecurity requirements specified in Essential Requirements (ER01), effective from 9th April 2025.

Securing a CCTV camera is crucial to protect sensitive information and ensure the system operates effectively. Key areas of testing include exposed network services, device communication protocols, physical access to the device’s UART, JTAG, SWD, etc., the ability to extract memory and firmware, firmware update process security and storage and encryption of data. OEMs should ensure the minimum-security requirements in CCTV camera such as –

• Access Control - Implement role-based authentication for administrators, operators, and users.
• Network Security - Ensure end-to-end encryption for data storage and transmission to prevent eavesdropping or data breaches.
• Software Security - Perform regular firmware & software updates to patch vulnerabilities. Disable unused features and restrict unnecessary network services. Enforce strong password policies, including multi-factor authentication (MFA).
• Penetration Testing & Cyber Threat Resistance - Conduct regular penetration testing to identify and fix vulnerabilities. Ensure systems can withstand cyberattacks, malware, and unauthorized access attempts.

GRL India is authorized by BIS for cybersecurity testing of CCTV cameras under the Compulsory Registration Scheme (CRS) helping manufacturers before certification (Pre-compliance and to test the security parameters defined in essential security requirements listed in ER01 under following categories–

1. Hardware Level Security Parameters
2. Software/ Firmware
3. Secure Process Conformance
4. Secure Conformance at Product Development stage

Learn how you can make sure your CCTV cameras are BIS compliant.

Vulnerability Assessment & Penetration Testing (VAPT)

VAPT is crucial for identifying, analyzing, and mitigating security risks in connected devices, including telecom, IoT, and drones. The National Institute of Standards and Technology (NIST) SP 800-115 provides a structured methodology for security testing, to ensure robust cyber resilience and regulatory compliance.

The services offered include

• Vulnerability Assessment (VA) – Identifying Security Gaps
  • Automated & manual scanning for vulnerabilities in hardware, firmware, and software.
  • Evaluate encryption, authentication, and access control mechanisms.
  • Risk assessment & prioritization based on severity impact.
    
    
• Penetration Testing (PT) – Simulating Real-World Attacks
  • Black-box, grey-box, and white-box testing methodologies.
  • Simulated cyberattacks, malware injection, and unauthorized access attempts.
  • Test firmware integrity, API security, and network resilience.

Application Security Testing (AST)

Modern applications—whether running on web, mobile, IoT, telecom networks, or embedded devices—are a prime target for cyberattacks. Weak authentication, insecure APIs, and unpatched vulnerabilities can expose systems to breaches, data leaks, and service disruptions. Ensuring robust application security is essential to maintain user trust, regulatory compliance, and business continuity.

• Testing Offerings

  Web & Mobile Application Security Testing

• IoT & Embedded System Application Security

• API & Cloud Application Security Testing

• Penetration Testing & Exploit Simulation

• Secure Software Development & DevSecOps

Granite River Labs (GRL) as a NABL (ISO/IEC 17025) accredited lab helps manufacturers, software developers, and service providers strengthen their applications through rigorous security testing based on OWASP Top 10 and CWE 25 frameworks. Our end-to-end security assessment ensures that applications are resilient against cyber threats at every stage—from development to deployment”

CIS benchmark Compliance Testing

Network infrastructure is a critical target for cyber threats, making security hardening a top priority for routers, switches, firewalls, VPN gateways, and other network devices. The Center for Internet Security (CIS) Benchmarks provide industry-recognized security configurations to reduce vulnerabilities, prevent unauthorized access, and enhance system resilience. GRL’s CIS Benchmark Compliance Testing Services

• Baseline Security Configuration Validation
• Network Hardening & Secure Configuration Testing
• Automated Compliance Auditing & Reporting
• Penetration Testing & Vulnerability Assessments