Market research published report:
Cyber security of consumer IoT – manufacturer survey

The Cyber security of consumer IoT – manufacturer survey was commissioned by the UK Government’s Department for Science, Innovation and Technology (DSIT) to support the introduction of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022 and PSTI Regulations 2023, the world’s first legal regime on the cyber security of consumer Internet of Things (IoT) products. Consumer IoT devices – such as smart home products, connected appliances and security cameras – are an increasingly common target for cyber-attacks, and the legislation aims to improve protections for UK consumers and organisations.

DJS Research, in partnership with the Centre for Strategy & Evaluation Services (CSES), was commissioned to carry out the manufacturer research that underpins this report, combining quantitative and qualitative methods to provide robust insight into the market, compliance levels and industry understanding ahead of the PSTI Regulations coming into force on 29 April 2024.

Our team conducted a telephone survey with 33 manufacturers of consumer connectable products, collecting primary data on awareness, compliance and anticipated impacts of the new legal requirements. The survey was supplemented with extensive desk research to map the UK market for consumer IoT and to identify publicly available evidence of compliance, and with semi-structured interviews with manufacturers and industry associations to provide deeper context and industry perspectives.

The research provided a baseline assessment of manufacturer compliance with key PSTI requirements – including password protections, information on reporting security issues, and transparency on security update periods – as well as evidence of industry challenges in engaging with research and interpreting complex regulatory obligations.

By delivering this evidence base, DJS Research helped inform Government understanding of current manufacturer readiness and support future monitoring and evaluation of the Regulations’ impacts on consumer IoT security.