Connected devices playbook

A connected devices playbook for any product with firmware that talks to a network. That covers smart home gadgets, wearables, sensors, meters, trackers and the cloud service and app behind them. The chapters run from the factory to the end of support. They cover device identity, onboarding, firmware updates, the link to the cloud and the local network. Then come fleet monitoring, sensor data, support periods and vulnerability reports.

A device sits in someone's home for years, often unwatched. One shared password or one unsigned update can turn a whole product line into a botnet overnight. Most rules here keep each device separate, so a stolen key or a hijacked unit stays one problem instead of a million.

Laws now set a floor for these products. ETSI EN 303 645 is the European baseline for consumer devices. The EU's radio equipment rules have required cybersecurity for internet-connected radio products since 1 August 2025. The Cyber Resilience Act takes over from 11 December 2027, and the compliance playbook holds those duties.

Start with Give every device its own credentials. Then read Verify the firmware signature on the device before your first update ships.

Chapters

1. Device identity

   Give every device its own password and key, kept in secure hardware. Ship no shared secret in firmware, and plan certificates for the device's whole life.

   • Required 2
   • Recommended 2

2. Provisioning and onboarding

   Register every device at the factory and let only the person holding it claim it. Send network details encrypted, and wipe everything on reset.

   • Required 1
   • Recommended 3

3. Firmware updates

   Install only signed firmware and keep the old version until the new one works. Refuse old versions, and roll out in stages that stop on bad numbers.

   • Required 2
   • Recommended 4

4. Device to cloud

   Connect each device with its own certificate and topics. Spread reconnects, notice who is offline, keep working without the cloud and distrust the device clock.

   • Required 2
   • Recommended 6

5. Local network exposure

   Open no port the product does not need and never ask the router to let the internet in. Lock debug ports at the factory, and announce little.

   • Required 1
   • Recommended 2
   • Avoid 1

6. Fleet monitoring and control

   Know each device's version and last contact, and alert on fleet-wide changes. Cut off one device alone, and switch risky features off with a signed command.

   • Recommended 4

7. Sensor data and privacy

   List every sensor and every field a device sends, and compute on the device. Keep location coarse, and ask before a camera or microphone turns on.

   • Recommended 4

8. Support and vulnerability reports

   Publish an end date for security updates on every model and plan what happens after it. Make every report and advisory name model and firmware.

   • Recommended 3

All 37 rules on one page

This is a lot to check. An Expert can check it for you.

Related playbooks

• Product and sector laws

  In the Compliance and governance playbook. The Cyber Resilience Act and the Data Act set legal duties for devices sold in the EU. That chapter holds the scope, reporting and support rules.

• Update integrity

  In the Desktop apps, extensions and CLIs playbook. Desktop updates face the same attacks as firmware. Signatures, refusing old versions and staged rollouts work the same way.

• Supply chain and setup

  In the Adversarial testing playbook. Firmware is built from many third-party parts. Lock and audit them, and keep a bill of materials for every release.

• Alerts and on-call

  In the Operations and observability playbook. A fleet of devices needs the same alerts as a server fleet. Alert on what owners feel, and make every alert actionable.