# The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, Paragraph 3: Information on minimum security update periods

Extent: E+W+S+N.I.

(1) A manufacturer is to be treated as complying with the security requirement at paragraph 3 of Schedule 1 where any of the conditions in sub-paragraphs (2) to (2B) are met.
(2) Condition A is that, subject to sub-paragraphs (3), (5) and (6) of paragraph 3 of Schedule 1 and to sub-paragraphs (3) and (4), the manufacturer complies with provision 5.3-13 of ETSI EN 303 645 as if that provision applies to the categories of hardware and software specified in paragraph 3(1) of Schedule 1.
(2A) Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired.
(2B) Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired.
(3) References at provision 5.3-13 of ETSI EN 303 645 to “defined support period” are to be construed in accordance with the definition in regulation 2.
(4) Reference at provision 5.3-13 of ETSI EN 303 645 to the information being published in an accessible way that is clear and transparent includes making the information available to a person (“P”)—
(a) without prior request for such information being made;
(b) in English;
(c) free of charge;
(d) without requesting the provision of P’s personal information; and
(e) in such a way that is understandable by a reader without prior technical knowledge.

---
Source: https://www.legislation.gov.uk/uksi/2023/1007/schedule/2/paragraph/3 (the official version)
Page: https://openlegislation.uk/product-security-and-telecommunications-infrastructure-security-requirements-for-relevant-connectable-products-regulations-2023/schedule-2/paragraph-3
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.