Home & Commercial Cybersecurity

Overview

Helping Secure the Future of Home & Commercial Systems

Navigation Guide:

Cybersecurity Regulations
General Cybersecurity Standards
Applicable Cybersecurity Standards for Home & Commercial Smart Devices and Connected Systems
Key Cybersecurity Themes for Home & Commercial Systems
Home & Commercial Cybersecurity Resources

With the widespread adoption of smart homes, building automation, and connected commercial systems, cybersecurity has become a growing concern in the home and commercial space. As devices and networks become more interconnected, the risks of data breaches, hacking, and system vulnerabilities multiply, highlighting the need for robust cybersecurity solutions.

Key Challenges in Home & Commercial Cybersecurity
Home and commercial systems face a unique set of cybersecurity challenges that demand thoughtful approaches. In this dynamic and expanding ecosystem, protecting sensitive information and maintaining the integrity of networks is critical. For manufacturers of smart devices, some of the key challenges include:

Device Security: Confirming the security of connected devices, from smart thermostats to building management systems, against potential cyberattacks.
Data Privacy: Protecting sensitive personal and business data from unauthorized access and breaches.
Interoperability: Managing the security complexities arising from the integration of diverse devices and platforms within smart homes and commercial spaces.
Software Updates & Patching: Enforcing timely and secure updates to prevent exploitation of known vulnerabilities.

Applicable Standards & Regulations

Demonstrating compliance with applicable cybersecurity standards is an important aspect of managing cybersecurity risks in home and commercial environments. These standards provide a framework to validate the safety, performance, reliability, and security of connected devices and systems while maintaining data privacy and integrity.

Cybersecurity Regulations

Regulation	Description
Delegated Regulation (EU) 2022/30	This regulation outlines cybersecurity requirements for certain categories of radio equipment, extending the scope of the original Radio Equipment Directive (RED) 2014/53/EU. It focuses on safeguarding networks and preventing unauthorized access, particularly for devices with internet connectivity, confirming they meet applicable security standards before entering the EU market.
EU Cyber Resilience Act (CRA)	The Cyber Resilience Act (CRA) aims to improve the cybersecurity of connected devices and digital products within the EU by imposing mandatory security requirements throughout their lifecycle. Manufacturers, developers, and businesses are responsible for maintaining compliance to enhance product security and protect consumers from cyber threats.
EU NIS2 Directive	The NIS2 Directive strengthens cybersecurity requirements for essential and digital service providers within the EU, expanding the scope of the original NIS Directive. It mandates enhanced risk management and incident reporting obligations for critical infrastructure sectors, including healthcare, energy, and transportation, to protect against cyberattacks.
EU Cybersecurity Act	The EU Cybersecurity Act establishes a framework for cybersecurity certification of products, services, and processes across the EU. It strengthens the mandate of ENISA (the EU Agency for Cybersecurity) and introduces a European-wide certification scheme to promote high standards of cybersecurity for connected devices and systems.
EU Digital Operational Resilience Act (DORA)	DORA focuses on the financial sector, setting cybersecurity standards to validate that financial institutions can withstand and recover from operational disruptions. The regulation requires firms to adopt robust risk management strategies and testing protocols to protect against cyber threats and enhance operational resilience.
EU General Data Protection Regulation (GDPR)	The GDPR is the EU’s data protection law, which sets strict rules on how organizations collect, store, and use personal data. It grants EU citizens certain rights over their data, such as the right to access, rectify, or delete it, and imposes hefty fines for non-compliance to help enforce robust privacy protections across the EU.
UK Product Security and Telecommunications Infrastructure (PSTI) Act	The PSTI Act establishes cybersecurity requirements for consumer connected devices in the UK. It mandates basic security standards, such as banning default passwords, providing security update information, and confirming vulnerability reporting mechanisms, to enhance the security of connected products sold in the UK.
California Privacy Rights Act (CPRA)	The CPRA, an expansion of the California Consumer Privacy Act, strengthens data privacy protections for California residents by creating the California Privacy Protection Agency and introducing new rights, such as the right to limit the use of sensitive personal data. It also increases business obligations around data collection, storage, and usage transparency.
SB-1121 California Consumer Privacy Act (CCPA)	SB-1121, an amendment to the original CCPA, clarifies certain provisions of the law and adjusts its enforcement timeline. The CCPA gives California residents broad rights over their personal data, such as the right to know, delete, and opt out of the sale of their information, applying to businesses that meet specific thresholds for data processing.
SB-327 California IoT Cybersecurity Law	California’s SB-327 is a pioneering law that mandates cybersecurity protections for all IoT devices sold in the state. It requires manufacturers to equip devices with reasonable security features, such as unique passwords and secure authentication protocols, to protect against unauthorized access and data breaches.

General Cybersecurity Standards

Standard	Description
UL 2900-1	A cybersecurity standard that focuses on securing network-connected products and systems. It provides guidelines for identifying vulnerabilities, conducting penetration testing, and performing source code analysis to manage cybersecurity risks. The standard helps manufacturers implement security measures for their products and meet necessary regulatory expectations. UL 2900-1 is commonly applied to validate the security of connected devices in various industries.
IEC 62443 Series	A set of international standards designed to protect Industrial Automation and Control Systems (IACS) from cybersecurity threats. It offers a structured approach for addressing risks in industrial environments, covering areas such as system design, security levels, and access control. By following this series, organizations can enhance the resilience of their industrial systems against cyber threats, supporting the protection of critical infrastructure and operations. The standards are versatile and can be leveraged across various industries, including energy, manufacturing, transportation, and healthcare, to improve the security of industrial systems in different sectors.

Standard

Description

UL 2900-1

A cybersecurity standard that focuses on securing network-connected products and systems. It provides guidelines for identifying vulnerabilities, conducting penetration testing, and performing source code analysis to manage cybersecurity risks. The standard helps manufacturers implement security measures for their products and meet necessary regulatory expectations. UL 2900-1 is commonly applied to validate the security of connected devices in various industries.

IEC 62443 Series

A set of international standards designed to protect Industrial Automation and Control Systems (IACS) from cybersecurity threats. It offers a structured approach for addressing risks in industrial environments, covering areas such as system design, security levels, and access control. By following this series, organizations can enhance the resilience of their industrial systems against cyber threats, supporting the protection of critical infrastructure and operations. The standards are versatile and can be leveraged across various industries, including energy, manufacturing, transportation, and healthcare, to improve the security of industrial systems in different sectors.

Cybersecurity Standards for Home & Commercial Smart Devices and Connected Systems

Standard	Description
ETSI EN 303 645	This standard sets baseline cybersecurity requirements for consumer connected devices, such as smart home appliances and connected commercial products. It focuses on areas like data protection, software updates, and vulnerability management, helping manufacturers address security challenges in connected environments.
CEN EN 18031 Series	The EN 18031 series addresses privacy and data protection requirements for smart devices. It is important for manufacturers of home and commercial devices to follow these standards to manage personal data securely, especially when dealing with sensitive consumer information.
CSA T200	This standard evaluates the cybersecurity of connected devices in both home automation and commercial systems. It tests for vulnerabilities and aligns with international cybersecurity best practices, helping protect connected devices from evolving security threats.
NIST IR 8259 & NIST IR 8425	These NIST standards provide guidelines for secure development and management of connected devices. NIST IR 8259 outlines core cybersecurity capabilities for manufacturers of connected device, while NIST IR 8425 emphasizes maintaining device security throughout its lifecycle, supporting the protection of smart home and commercial systems.
EN 18031 Series	The EN 18031 Series focuses on privacy management and data protection in connected devices, covering both home and commercial applications. Compliance with this series helps manufacturers build privacy protections into devices that handle increasing amounts of personal and operational data.

Key Cybersecurity Themes for Home & Commercial Systems

CIA Triad

Cybersecurity Risk

Secure Design

Cryptography

Network Security

Wireless Security

Web Application Security

Mobile Application Security

Embedded Security Systems

Industrial Security

Secure Coding

Cybersecurity Testing

Governance, Risk, and Compliance (GRC)

Secure Software Development Lifecycle (SDLC)