WIREDGOV

The Department for Science, Innovation and Technology have published their response to the 2025 Call for Views on enterprise connected device security.

Following the introduction of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022, which came into force in April 2024, government have been considering how to strengthen baseline cyber security requirements for enterprise devices that do not fall into into scope of Part 1 of the Act. As part of this work, they proposed a series of interventions, including a Code of Practice which would align with DSIT’s broader approach to improve the security of technology. 

A number of themes emerged in response to the proposed principles:

• The need for clarity around wording and definitions
• Requests for more detail and clearer timeframes
• The importance of alignment with international standards and legislation
• Questions around practicality and IoT device applicability
• Broad support for government’s activity in this space

Before publishing the Code, government will look to streamline the principles, improve the clarity of the language and assess the options to align more closely with other regimes which they hope will give greater certainty for businesses and support its uptake. 

The government have committed to the following next steps:

• Manufactures will be asked to use the device security principles for manufactures which is hosted on the National Cyber Security Centre (NCSC) website.
• Government will review whether they should expand the scope of this activity beyond enterprise connected devices, this would be part of their ongoing analysis of securing the broader technology landscape.
• Government will develop the Code of Practice, to fit into the broader set of secure by design codes of practice. They will also explore the feasibility of a certification scheme for manufacturers.
• Government will also assess the potential regulatory measures they could introduce based on feedback that government should be going further to incentivise uptake.

You can read Government’s full response to the Call for Views here.

techUK looks forward to working with government as they continue to shape their approach to enterprise connected device security. We look forward to further engagement with DSIT as it develops the Code of Practice, ensuring businesses are supported to comply with the proposed measures.