Paragraph 2 Information on how to report security issuesI1

A manufacturer is to be treated as complying with the security requirement at paragraph 2 of Schedule 1 where F1any of the conditions in sub-paragraphs (2) to (2B) are met.

F2Condition A is that the manufacturer complies with—

as if the provision of ETSI EN 303 645 or the paragraphs of ISO/IEC29147 apply to the categories of hardware and software specified in paragraph 2(1) of Schedule 1.

Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired.

Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired.

A manufacturer is required to publish information as to—

The information at sub-paragraph (3) must be accessible, clear and transparent, and must be made available to a person (“P”)—