Security update provision and defined support period

Description

A published commitment to provide security updates for a defined period, plus the engineering pipeline that actually delivers them. The connectable-product regimes converge on the same two ideas: the manufacturer has to tell buyers how long the product will receive security updates (a minimum support period), and it has to actually ship those updates during that window. The UK PSTI regime requires the minimum support-period information to be published and kept current; the EU Cyber Resilience Act requires manufacturers to provide security updates free of charge for the support period and to ship products with a secure-by-default configuration. The control therefore has a disclosure leg (publish the support-period statement and the secure-default configuration) and an operational leg (a build-and-release pipeline that can push updates to fielded devices for the duration of the commitment). The recurring mistake is publishing a support period the organization cannot actually staff for; the statement is a binding representation, and an end-of-support date that arrives while the product is still on shelves is the kind of gap a market-surveillance authority is structured to find.

Required by (2 regulations)

• EU CRA

  Manufacturers must ensure products with digital elements are made available with a secure-by-default configuration and provide security updates free of charge for the support period (Annex I Part I and Part II).

  Regulation (EU) 2024/2847 (Cyber Resilience Act), Annex I Parts I and II; main obligations apply 2027-12-11

  Source →

• UK PSTI

  Manufacturers must publish the minimum length of time for which security updates will be provided for a relevant connectable product, and update that information if the period is extended.

  The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 (SI 2023/1007), Schedule 1; in force 2024-04-29

  Source →

Evidence formats

• published minimum support-period statement on the product or packaging
• secure-by-default configuration documentation
• release pipeline records showing security updates shipped during the support period
• end-of-support communications plan