MatterODM by Shenan YangguangCybersecurity compliance, in one sentence
Cybersecurity compliance for connected security hardware means meeting the legal and standards-based requirements that a device resist unauthorised access and that its maker run a process to disclose and fix vulnerabilities — distinct from Matter certification, which proves interoperability, not security robustness. A sensor can carry a perfect Matter certificate and still fail the cybersecurity rules of the market it ships to. The two marks answer different questions: "does it work with the ecosystem?" versus "can it be trusted and maintained?"
The UK: PSTI Act
The UK Product Security and Telecoms Infrastructure (PSTI) Act is the regime that, from 29 April 2024, bans default and easily guessable passwords, requires a public vulnerability-disclosure policy, and demands transparency about the minimum security-update period for connectable products sold in Great Britain. For a brand, this is not a test you book at a lab; it is a set of product and process obligations that must be true before the device can be supplied. The practical consequences reach the factory: firmware must not ship with universal default credentials, and the brand must publish how long updates will be supported.
The baseline: ETSI EN 303 645
ETSI EN 303 645 is the widely adopted consumer-IoT security baseline that underpins the UK and EU rules: no universal default passwords, unique credentials where used, secure storage and transmission of secrets, secure software update, and a stated support period. It is the checklist most brands are measured against even where it is referenced indirectly through radio-equipment or product-safety law. We treat it as the default engineering baseline for any connectable security product, because designing to it early is far cheaper than retrofitting it after a compliance gap is found.
The EU: Cyber Resilience Act
The EU Cyber Resilience Act is a horizontal regulation setting cybersecurity requirements for products with digital elements — including connected hardware — across the full lifecycle from secure design through maintenance to end-of-life. It was adopted and phases in over a multi-year transition; the bulk of product obligations are expected to apply around 2027, though specific dates continue to be implemented, so brands should confirm the current effective schedule rather than rely on a fixed memory of it. For security hardware, the practical effect is that cybersecurity becomes a documented, lifecycle-long duty, not a one-time checkbox at launch.
The US: a patchwork, converging on the same ideas
In the United States, several states have enacted baseline IoT security laws requiring reasonable security features, while federal guidance such as NIST IR 8259 is widely used as the design baseline for connected-device security. The US picture is less centralised than the UK or EU, but the direction is the same: no hardcoded credentials, supportable update paths, and a documented approach to vulnerability handling. Brands selling across all three regions therefore benefit from a single, conservative engineering baseline that satisfies the strictest common denominator.
Where the white-label app and cloud fit
A brand's own application and cloud stack are part of the product's attack surface, so a connected security device is only as strong as the weakest of its device firmware, its white-label app and its cloud services combined. We integrate a standard CSA-certified connectivity module and build the device firmware to the baseline; the brand's white-label app and cloud stack must meet the same disclosure and update commitments, because a certified radio does not protect a backend shipped with a default API key. Cybersecurity is therefore a shared duty across the stack, not a single certificate that one party holds.
How this relates to Matter device attestation
Matter device attestation — the DAC, PAI/PAA chain and the Distributed Compliance Ledger — proves a device is a genuine, factory-provisioned unit, which is a trust layer at boot, whereas regulatory cybersecurity rules govern the device's resistance to attack and its maker's maintenance process over time. The two are complementary: attestation stops counterfeits and impersonation, while PSTI, ETSI and the CRA stop the product itself from being an easy target and force a responsible patch process. Our article on Matter device attestation and brand protection covers the attestation layer in detail.
The cost of getting it wrong
The penalty for weak connected-device security is no longer theoretical: a product that ships with default credentials or no disclosure process can be blocked at the border, pulled from a retailer, or recalled — each far more expensive than designing the baseline in from the first schematic. Because the rules now apply at the point of supply rather than only after an incident, the factory's early engineering choices are what keep a brand's shipment legal. Treating cybersecurity as a launch-phase checkbox is the most common and the most costly mistake we see in connected-hardware programmes.
Factory stance — we build the secure baseline in
Shenan Yangguang designs the firmware and the update path, so the cybersecurity baseline is engineered into the product rather than audited in afterwards. Concretely, we avoid hardcoded or default credentials in shipped firmware, implement a signed over-the-air update path (the field-fix mechanism covered in our article on Matter OTA and device lifecycle), and can provide a component list or SBOM and a defined support period on request. Because we own the schematic and firmware, the secure-boot and update-signing decisions are ours to make and document — which is what a brand's cybersecurity questionnaire actually asks for.
What a brand should ask before launch
Five questions clear most of the risk. Does the firmware ship without default credentials? Is there a documented secure-boot and update-signing path? Can the factory provide a component list or SBOM and a stated support period? Is there a vulnerability-disclosure contact? And is the device also protected by Matter device attestation? A manufacturer that answers all five without hesitation is one that has already built the baseline — and one whose product will clear UK, EU and US expectations without a last-minute scramble. The broader export-compliance picture, including GPSR and WEEE, is covered in our article on exporting Matter sensors to the EU and UK.