Apple will provide a minimum of five years of iPhone security updates
How does Apple's commitment to providing a minimum of five years of security updates for the iPhone align with the requirements of the PSTI Act?
Apple's commitment to providing a minimum of five years of security updates for the iPhone aligns with the requirements of the PSTI Act, which requires companies selling internet-connected products to meet new security standards. The law compels companies to define the minimum length of time they will provide security updates for a product4. In response to this requirement, Apple submitted a public regulatory filing for the iPhone 15 Pro Max, stating that the device's "defined support period" is a "minimum five years from the first supply date36." The "first supply date" is listed as September 22, 2023, which is when the iPhone 15 series launched6. By providing this commitment, Apple is in compliance with the PSTI regulations.
Does the PSTI Act specify a maximum duration for security updates, or does it only require a minimum duration to be defined?
The PSTI Act does not specify a maximum duration for security updates. It only requires companies to define the minimum length of time they will provide security updates for a product.
What specific requirements does the UK's Product Security and Telecommunications Infrastructure (PSTI) Act impose on companies selling internet-connected products?
The UK's Product Security and Telecommunications Infrastructure (PSTI) Act imposes several requirements on companies selling internet-connected products. The main obligations under the Act include:
-
Security Requirements: The Act requires companies to comply with specific security requirements for their products. These requirements are aimed at ensuring the security of internet-connected devices and protecting consumers from potential cyber threats.
-
Defined Support Period: Companies are mandated to define the minimum length of time they will provide security updates for a product. This information must be made available to consumers, allowing them to make informed decisions about the security of the products they purchase.
-
Statement of Compliance: Companies must provide a statement of compliance confirming that their products meet the security requirements set out in the Act. This statement must accompany the product and be easily accessible to consumers.
-
Retailer Obligations: Retailers have obligations under the Act, such as not supplying products if they are aware of non-compliance with security requirements and informing the relevant manufacturer and authorities in case of compliance failures.
-
Excepted Products: The Act provides a list of products that are excepted from the scope of the regulatory regime. These include electric vehicle smart charge points, medical devices, and smart meters, among others.
The PSTI Act aims to ensure that internet-connected products sold in the UK meet robust security standards, protecting consumers and businesses from potential cyber threats.