# The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, Paragraph 2: Information on how to report security issues

Extent: E+W+S+N.I.

(1) A manufacturer is to be treated as complying with the security requirement at paragraph 2 of Schedule 1 where any of the conditions in sub-paragraphs (2) to (2B) are met.
(2) Condition A is that the manufacturer complies with—
(a) provision 5.2-1 of ETSI EN 303 645; or
(b) subject to sub-paragraphs (3) and (4), the following paragraphs of ISO/IEC 29147—
(i) paragraph 6.2.2;
(ii) paragraph 6.2.5; and
(iii) paragraph 6.5
as if the provision of ETSI EN 303 645 or the paragraphs of ISO/IEC29147 apply to the categories of hardware and software specified in paragraph 2(1) of Schedule 1.
(2A) Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired.
(2B) Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired.
(3) A manufacturer is required to publish information as to—
(a) how a person may access the mechanism for the manufacturer to receive reports described in paragraph 6.2.2 of ISO/IEC 29147;
(b) when a person making a vulnerability report will receive an acknowledgement of receipt of a report described in paragraph 6.2.5 of ISO/IEC 29147; and
(c) when a person making a vulnerability report will receive ongoing communication as described in paragraph 6.5 of ISO/IEC 29147
(4) The information at sub-paragraph (3) must be accessible, clear and transparent, and must be made available to a person (“P”)—
(a) without prior request for such information being made;
(b) in English;
(c) free of charge; and
(d) without requesting the provision of P’s personal information.

---
Source: https://www.legislation.gov.uk/uksi/2023/1007/schedule/2/paragraph/2 (the official version)
Page: https://openlegislation.uk/product-security-and-telecommunications-infrastructure-security-requirements-for-relevant-connectable-products-regulations-2023/schedule-2/paragraph-2
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.