We had to recently look at this as we sell our product in the UK. The rules are really quite pissweak. From the article:
* that password procedures are more secure, including ensuring any set by the manufacturer are not left blank or using easy-to-guess choices like "12345" or "admin"
Reasonable. But that's a _really_ low bar.
* that there is clarity around how to report "bugs" or security problems that arise
i.e. an email address published on the vendor website. No actual requirement to take action.
* that manufacturers and retailers inform customers how long they will receive support, including software updates, for the device they are buying
which means nothing if the manufacturer goes bankrupt.
* that password procedures are more secure, including ensuring any set by the manufacturer are not left blank or using easy-to-guess choices like "12345" or "admin"
Reasonable. But that's a _really_ low bar.
* that there is clarity around how to report "bugs" or security problems that arise
i.e. an email address published on the vendor website. No actual requirement to take action.
* that manufacturers and retailers inform customers how long they will receive support, including software updates, for the device they are buying
which means nothing if the manufacturer goes bankrupt.