The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023
Write the words of this act the way you think they should read. Solon shows your change as a redline against the published text and pins it to that exact text, so it can never be applied to wording you did not see.
Change 1
Schedule 2 Conditions for Deemed Compliance with Security Requirements
Regulation 4 Passwords 1 (1) A manufacturer is to be treated as complying with the security requirement at paragraph 1 of Schedule 1 where any of the conditions in sub-paragraphs (2) to (4) are met. (2) Condition A is that the manufacturer complies with provision 5.1-1 of ETSI EN 303 645 and, where relevant, provision 5.1-2 of ETSI EN 303 645 as if those provisions apply to the categories of hardware and software specified in paragraph 1(1) of Schedule 1. (3) Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired. (4) Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired. Information on how to report security issues 2 (1) A manufacturer is to be treated as complying with the security requirement at paragraph 2 of Schedule 1 where any of the conditions in sub-paragraphs (2) to (2B) are met. (2) Condition A is that the manufacturer complies with— (a) provision 5.2-1 of ETSI EN 303 645; or (b) subject to sub-paragraphs (3) and (4), the following paragraphs of ISO/IEC 29147— (i) paragraph 6.2.2; (ii) paragraph 6.2.5; and (iii) paragraph 6.5 as if the provision of ETSI EN 303 645 or the paragraphs of ISO/IEC29147 apply to the categories of hardware and software specified in paragraph 2(1) of Schedule 1. (2A) Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired. (2B) Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired. (3) A manufacturer is required to publish information as to— (a) how a person may access the mechanism for the manufacturer to receive reports described in paragraph 6.2.2 of ISO/IEC 29147; (b) when a person making a vulnerability report will receive an acknowledgement of receipt of a report described in paragraph 6.2.5 of ISO/IEC 29147; and (c) when a person making a vulnerability report will receive ongoing communication as described in paragraph 6.5 of ISO/IEC 29147 (4) The information at sub-paragraph (3) must be accessible, clear and transparent, and must be made available to a person (“P”)— (a) without prior request for such information being made; (b) in English; (c) free of charge; and (d) without requesting the provision of P’s personal information. Information on minimum security update periods 3 (1) A manufacturer is to be treated as complying with the security requirement at paragraph 3 of Schedule 1 where any of the conditions in sub-paragraphs (2) to (2B) are met. (2) Condition A is that, subject to sub-paragraphs (3), (5) and (6) of paragraph 3 of Schedule 1 and to sub-paragraphs (3) and (4), the manufacturer complies with provision 5.3-13 of ETSI EN 303 645 as if that provision applies to the categories of hardware and software specified in paragraph 3(1) of Schedule 1. (2A) Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired. (2B) Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired. (3) References at provision 5.3-13 of ETSI EN 303 645 to “defined support period” are to be construed in accordance with the definition in regulation 2. (4) Reference at provision 5.3-13 of ETSI EN 303 645 to the information being published in an accessible way that is clear and transparent includes making the information available to a person (“P”)— (a) without prior request for such information being made; (b) in English; (c) free of charge; (d) without requesting the provision of P’s personal information; and (e) in such a way that is understandable by a reader without prior technical knowledge.
Schedule 2 Conditions for Deemed Compliance with Security Requirements
Regulation 4 Passwords 1 (1) A manufacturer is to be treated as complying with the security requirement at paragraph 1 of Schedule 1 where any of the conditions in sub-paragraphs (2) to (4) are met. (2) Condition A is that the manufacturer complies with provision 5.1-1 of ETSI EN 303 645 and, where relevant, provision 5.1-2 of ETSI EN 303 645 as if those provisions apply to the categories of hardware and software specified in paragraph 1(1) of Schedule 1. (3) Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired. (4) Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired. Information on how to report security issues 2 (1) A manufacturer is to be treated as complying with the security requirement at paragraph 2 of Schedule 1 where any of the conditions in sub-paragraphs (2) to (2B) are met. (2) Condition A is that the manufacturer complies with— (a) provision 5.2-1 of ETSI EN 303 645; or (b) subject to sub-paragraphs (3) and (4), the following paragraphs of ISO/IEC 29147— (i) paragraph 6.2.2; (ii) paragraph 6.2.5; and (iii) paragraph 6.5 as if the provision of ETSI EN 303 645 or the paragraphs of ISO/IEC29147 apply to the categories of hardware and software specified in paragraph 2(1) of Schedule 1. (2A) Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired. (2B) Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired. (3) A manufacturer is required to publish information as to— (a) how a person may access the mechanism for the manufacturer to receive reports described in paragraph 6.2.2 of ISO/IEC 29147; (b) when a person making a vulnerability report will receive an acknowledgement of receipt of a report described in paragraph 6.2.5 of ISO/IEC 29147; and (c) when a person making a vulnerability report will receive ongoing communication as described in paragraph 6.5 of ISO/IEC 29147 (4) The information at sub-paragraph (3) must be accessible, clear and transparent, and must be made available to a person (“P”)— (a) without prior request for such information being made; (b) in English; (c) free of charge; and (d) without requesting the provision of P’s personal information. Information on minimum security update periods 3 (1) A manufacturer is to be treated as complying with the security requirement at paragraph 3 of Schedule 1 where any of the conditions in sub-paragraphs (2) to (2B) are met. (2) Condition A is that, subject to sub-paragraphs (3), (5) and (6) of paragraph 3 of Schedule 1 and to sub-paragraphs (3) and (4), the manufacturer complies with provision 5.3-13 of ETSI EN 303 645 as if that provision applies to the categories of hardware and software specified in paragraph 3(1) of Schedule 1. (2A) Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired. (2B) Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired. (3) References at provision 5.3-13 of ETSI EN 303 645 to “defined support period” are to be construed in accordance with the definition in regulation 2. (4) Reference at provision 5.3-13 of ETSI EN 303 645 to the information being published in an accessible way that is clear and transparent includes making the information available to a person (“P”)— (a) without prior request for such information being made; (b) in English; (c) free of charge; (d) without requesting the provision of P’s personal information; and (e) in such a way that is understandable by a reader without prior technical knowledge.
One line that says what changes, such as "Halve the dog tax".
Who it helps, what it costs, what it fixes. It is what persuades people to support it.
How this law is officially changed
Solon does not know this law's official route yet. The proposal is recorded all the same, and the route appears here once its source is added.
A proposal here is not law. Support on Solon is evidence that people want the change; the official route says what it takes to make it law.
Sign in to file your proposal. What you have written stays on this page.
Sign in to file itThink it through
Ask what your change would do, who would gain and who would bear a cost, and where something like it is already law. The assistant reads your draft as it stands, cites the law and the studies it finds, and takes no side. What you file stays yours.