Understanding and Complying with the RED 3.3 Directive for Products with Wireless Capabilities

1. Significance and Scope of RED 3.3 Compliance:

• The RED (Radio Equipment Directive) 3.3 regulations will become mandatory by August 2025, impacting manufacturers of products with wireless capabilities such as NFC, Wi-Fi, and Bluetooth. The directive focuses on ensuring cybersecurity and data privacy for wireless devices, covering aspects like encryption, firmware updates, and preventing unauthorized access.
• Compliance involves multiple stakeholders, including manufacturers, test labs, notified bodies, and market surveillance authorities. Each has a role in ensuring that the products meet the regulatory standards before being placed on the market. Notably, products already in the hands of users are excluded, but any new or modified products sold after August 2025 must comply.

2. Compliance Procedure and Standards:

• The compliance process under RED 3.3 includes several steps: initial awareness, health check or gap analysis, conceptual and functional assessment, and finally, obtaining certification. This process typically takes six to nine months, emphasizing the urgency for manufacturers to start now to meet the deadline.
• Manufacturers can use various standards to demonstrate compliance, such as ETSI EN 303 645 for IoT consumer products, IEC 62443 for industrial automation, and the upcoming EN 18031, which will allow self-assessment once harmonized by the EU. The involvement of test labs and notified bodies is crucial for standards that require third-party validation.

3. Challenges and Practical Examples of Vulnerabilities:

• The webinar highlighted common vulnerabilities found during assessments, such as insecure debug interfaces on security cameras, insecure storage of sensitive information of wireless credentials on smart lights, and command injection vulnerabilities in industrial routers. These examples highlight the importance of physical and network security in preventing full fleet compromises. Vulnerabilities are not device specific, these are just some examples encountered during testing.
• Manufacturers are advised to adopt a risk management approach, rather than treating compliance as a simple checklist. This involves thorough testing and continuous monitoring for vulnerabilities, ensuring that devices remain secure throughout their life-cycle.
  These takeaways stress the importance of early preparation, understanding the regulatory framework, and adopting a comprehensive security approach to comply with RED 3.3.

WATCH THE REPLAY HERE