{"id":6241,"date":"2025-08-15T13:23:50","date_gmt":"2025-08-15T12:23:50","guid":{"rendered":"https:\/\/amtivo.com\/uk\/standards\/\/\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/"},"modified":"2025-12-15T16:16:03","modified_gmt":"2025-12-15T16:16:03","slug":"the-uk-edges-closer-to-new-uk-regulations-on-iot-security","status":"publish","type":"standard-post-filter","link":"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/","title":{"rendered":"The UK Edges Closer to New UK Regulations on IoT Security"},"content":{"rendered":"<p><em>IoT and OT devices now outnumber conventional computing devices such as PCs, smartphones, and laptops by two to one, a ratio that will rise to three-to-one by 2025. Is regulation now overdue?<\/em><\/p>\r\n<p>If market data company Statista is correct, there are now around <a href=\"https:\/\/www.statista.com\/statistics\/1101442\/iot-number-of-connected-devices-worldwide\/\" target=\"_blank\" rel=\"noopener\">13.8 billion Internet of Things (IoT) devices<\/a> in the world, a definition that covers everything from smart TVs, smart speakers, thermostats, security cameras, and doorbells to motor vehicles and a growing array of Internet-enabled M2M industrial operational technology (OT) and medical monitoring. By contrast, Gartner reckons it\u2019s more like 21 billion devices, including those being used by two-thirds of the world\u2019s enterprise networks.<\/p>\r\n<p>Significantly, IoT and OT devices now outnumber conventional computing devices such as PCs, smartphones, and laptops by two to one, a ratio that will rise to three-to-one by 2025. Beyond that, it\u2019s anyone\u2019s guess but it\u2019s not hard to believe that the growth of smart cities and universal IoT enablement might one day mean that there are ten, twenty or a hundred times as many of these devices in the world as any other type of computer.<\/p>\r\n<p>What\u2019s striking about all this IoT and OT \u2013 or \u2018smart\u2019 products as the former is now more commonly termed &#8211; is how little anyone knows about its security, past or future. IT professionals are probably sick of hearing about this, hoping against hope that someone is working on a solution. In fact, a lot of agencies are working on a solution. The issue is that the problem keeps getting larger and more complex the more engineers think about how to solve it.<\/p>\r\n<h2>\u00a0<\/h2>\r\n<h2>Secure by Design Regulation<\/h2>\r\n<p>But what <em>is <\/em>that problem? According to the UK Government, which trailed an initiative called <a href=\"https:\/\/www.gov.uk\/government\/collections\/secure-by-design\" target=\"_blank\" rel=\"noopener\">Secure by Design<\/a> in 2018, the IoT malaise is that too many hardware makers have been turning out poorly-designed and secured smart products because it was the cheapest and fastest way to make money.\u00a0 While this read like a set of good practice guidelines, the Department for Digital, Culture, Media &amp; Sport (DCMS) followed up <a href=\"https:\/\/www.gov.uk\/government\/news\/plans-announced-to-introduce-new-laws-for-internet-connected-devices\" target=\"_blank\" rel=\"noopener\">in 2019<\/a> and April 2021 with drafts of binding laws, which have now expanded to include other connected devices such as smartphones. Among the eminently sensible proposals:<\/p>\r\n<ul>\r\n\t<li>Hardcoded\/default passwords will be banned. Every device must mandate a unique password, including after resets.<\/li>\r\n\t<li>Makers will have to set up public contacts for vulnerability disclosure.<\/li>\r\n\t<li>Makers will have to state how long devices will receive security updates. Importantly, this will also apply to smartphones, which today are often quickly orphaned without buyers being made aware of the implications.<\/li>\r\n<\/ul>\r\n<p>There will also need to be secure updating mechanisms, better back-end security and APIs, and upgraded privacy protection, to name only some improvements. The DCMS has even thought about the issue of assurance \u2013 third parties that might test products for compliance \u2013 offering a <a href=\"https:\/\/www.gov.uk\/government\/publications\/grant-programme-for-consumer-iot-assurance-schemes-202021\" target=\"_blank\" rel=\"noopener\">modest funding pot<\/a> to encourage organisations to set up commercial schemes.<\/p>\r\n<p>The UK Government is not the only one interested in taming IoT security, with the IEEE Standards Association, the IoT Security Foundation, the GSMA, the Cloud Security Alliance, OWASP, the <a href=\"https:\/\/www.enisa.europa.eu\/news\/enisa-news\/iot-security-enisa-publishes-guidelines-on-securing-the-iot-supply-chain\" target=\"_blank\" rel=\"noopener\">EU\u2019s ENISA<\/a>, and a US IoT Cybersecurity Improvement Act, all working on the same issue in similar but not identical ways.<\/p>\r\n<h2>\u00a0<\/h2>\r\n<h2>Will Regulation of IoT Work?<\/h2>\r\n<p>Secure by Design\u2019s timetable for implementation is not yet clear but it is likely to have a knock-on influence on IoT and OT products for the business sector too. That\u2019s because some of the platforms used by consumer and business products are similar, as are some of the vulnerabilities they suffer. Many manufacturers have improved their OT, medical and IoT security design but it\u2019s still not easy to know which meet the highest standards of good practice. It\u2019s also possible consumer and SME smart products are finding their way into even larger companies, for example, LED lightbulbs, IoT smoke alarms, and some printer-scanners.<\/p>\r\n<p>But even assuming everyone agrees on a set of standards, fixing devices will not be enough to patch IoT\/OT on its own. The first reason is the obvious one that there\u2019s still a lot of insecure IoT and OT is still out there. A lot of this won\u2019t be ripped out for years, if at all. A second and perhaps bigger problem is the traditional assumption that a device and its communication can ever be secure. As Britain\u2019s NCSC alludes to in its <a href=\"https:\/\/www.ncsc.gov.uk\/collection\/cyber-security-design-principles\/cyber-security-design-principles\" target=\"_blank\" rel=\"noopener\">Secure Design Principles<\/a> guide, security is now as much about the security of the network devices are connected to, the provenance of its updating mechanisms, and the supply chain and chain of trust that went into its making.<\/p>\r\n<p>Securing those for large numbers of often highly proprietary networks is a huge undertaking the industry is only now starting to think about. To reduce this to a simple formulation, you might say that the data that transits IoT networks represents the ultimate IoT security challenge, something which depends on the entire infrastructure supporting devices and not simply the devices themselves.<\/p>\r\n<h2>\u00a0<\/h2>\r\n<h2>Advice for IoT Buyers<\/h2>\r\n<p>On the face of it, Secure by Design is good news for SMEs going forward because the rules offer a baseline that weeds out weak products. Meanwhile, the issue of smartphone end of life should also be made clearer before acquiring these devices, something that\u2019s often shrouded in some mystery right now. Another response might be simply to avoid using consumer-level products altogether.<\/p>\r\n<p>More urgently, the same rules should be used to assess any of these products currently in use, including older smartphones. As is so often the case in cybersecurity today, it\u2019s the legacy products that cause the biggest problems. Managing that risk is not going to be easy. A second area where Secure by Design can\u2019t help businesses is understanding the risk present in the communications design, data storage and chain of trust that comes with any IoT or OT product, including ones designed specifically for business or industrial use.<\/p>\r\n<h2>\u00a0<\/h2>\r\n<h2>Conclusion<\/h2>\r\n<p>Today, cybersecurity is gradually adjusting to the idea that the best form of defence is knowledge. You can\u2019t stop all cyberattacks but what matters is knowing they have happened, which allows you to try to understand their scope, origin, and mitigations. From this point of view, constructing a giant mesh of unmanaged devices that do their job in an automated way was always asking for trouble.<\/p>\r\n<p>There is no easy answer to this today but organisations large and small should at least perform a risk assessment on every IoT device they add to their network. The forthcoming regulation of consumer IoT outlined in Secure by Design at least offers a place to start.<\/p>","protected":false},"excerpt":{"rendered":"Keep up to date on information security management systems, in particular the Internet of Things (IoT).","protected":false},"author":24,"featured_media":6242,"template":"","meta":{"_acf_changed":false,"_searchwp_excluded":"","footnotes":""},"standard-post-categories":[31],"standard-post-tags":[32],"class_list":["post-6241","standard-post-filter","type-standard-post-filter","status-publish","has-post-thumbnail","hentry","standard-post-categories-insights","standard-post-tags-cyber-essentials"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>The UK Edges Closer to New UK Regulations on IoT Security<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The UK Edges Closer to New UK Regulations on IoT Security\" \/>\n<meta property=\"og:description\" content=\"Keep up to date on information security management systems, in particular the Internet of Things (IoT).\" \/>\n<meta property=\"og:url\" content=\"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/\" \/>\n<meta property=\"og:site_name\" content=\"Amtivo UK\" \/>\n<meta property=\"article:modified_time\" content=\"2025-12-15T16:16:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/amtivo.com\/uk\/wp-content\/uploads\/sites\/20\/2025\/09\/Internet-of-Things-IoT-Regulation_11zon.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"2000\" \/>\n\t<meta property=\"og:image:height\" content=\"1176\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/amtivo.com\/uk\/wp-content\/uploads\/sites\/20\/2025\/04\/testimonialImage-placeholder.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"6 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"The UK Edges Closer to New UK Regulations on IoT Security","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/","og_locale":"en_GB","og_type":"article","og_title":"The UK Edges Closer to New UK Regulations on IoT Security","og_description":"Keep up to date on information security management systems, in particular the Internet of Things (IoT).","og_url":"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/","og_site_name":"Amtivo UK","article_modified_time":"2025-12-15T16:16:03+00:00","og_image":[{"width":2000,"height":1176,"url":"https:\/\/amtivo.com\/uk\/wp-content\/uploads\/sites\/20\/2025\/09\/Internet-of-Things-IoT-Regulation_11zon.jpeg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_image":"https:\/\/amtivo.com\/uk\/wp-content\/uploads\/sites\/20\/2025\/04\/testimonialImage-placeholder.jpg","twitter_misc":{"Estimated reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/","url":"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/","name":"The UK Edges Closer to New UK Regulations on IoT Security","isPartOf":{"@id":"https:\/\/amtivo.com\/uk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/#primaryimage"},"image":{"@id":"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/#primaryimage"},"thumbnailUrl":"https:\/\/amtivo.com\/uk\/wp-content\/uploads\/sites\/20\/2025\/09\/Internet-of-Things-IoT-Regulation_11zon.jpeg","datePublished":"2025-08-15T12:23:50+00:00","dateModified":"2025-12-15T16:16:03+00:00","breadcrumb":{"@id":"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/#primaryimage","url":"https:\/\/amtivo.com\/uk\/wp-content\/uploads\/sites\/20\/2025\/09\/Internet-of-Things-IoT-Regulation_11zon.jpeg","contentUrl":"https:\/\/amtivo.com\/uk\/wp-content\/uploads\/sites\/20\/2025\/09\/Internet-of-Things-IoT-Regulation_11zon.jpeg","width":2000,"height":1176,"caption":"Internet of Things (IoT) Regulation"},{"@type":"BreadcrumbList","@id":"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/insights\/the-uk-edges-closer-to-new-uk-regulations-on-iot-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/amtivo.com\/uk\/"},{"@type":"ListItem","position":2,"name":"Standards","item":"https:\/\/amtivo.com\/uk\/standards\/"},{"@type":"ListItem","position":3,"name":"Cyber Essentials","item":"https:\/\/amtivo.com\/uk\/standards\/cyber-essentials\/"},{"@type":"ListItem","position":4,"name":"Insights","item":"https:\/\/amtivo.com\/uk\/standards\/insights\/"},{"@type":"ListItem","position":5,"name":"The UK Edges Closer to New UK Regulations on IoT Security"}]},{"@type":"WebSite","@id":"https:\/\/amtivo.com\/uk\/#website","url":"https:\/\/amtivo.com\/uk\/","name":"Amtivo","description":"","publisher":{"@id":"https:\/\/amtivo.com\/uk\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/amtivo.com\/uk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/amtivo.com\/uk\/#organization","name":"Amtivo","url":"https:\/\/amtivo.com\/uk\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/amtivo.com\/uk\/#\/schema\/logo\/image\/","url":"https:\/\/amtivo.com\/uk\/wp-content\/uploads\/sites\/20\/2025\/10\/cropped-BAB-Amtivo-Joint-Logo-Updated-300ppi.png","contentUrl":"https:\/\/amtivo.com\/uk\/wp-content\/uploads\/sites\/20\/2025\/10\/cropped-BAB-Amtivo-Joint-Logo-Updated-300ppi.png","width":371,"height":203,"caption":"Amtivo"},"image":{"@id":"https:\/\/amtivo.com\/uk\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/amtivo.com\/uk\/wp-json\/wp\/v2\/standard-post-filter\/6241","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/amtivo.com\/uk\/wp-json\/wp\/v2\/standard-post-filter"}],"about":[{"href":"https:\/\/amtivo.com\/uk\/wp-json\/wp\/v2\/types\/standard-post-filter"}],"author":[{"embeddable":true,"href":"https:\/\/amtivo.com\/uk\/wp-json\/wp\/v2\/users\/24"}],"version-history":[{"count":3,"href":"https:\/\/amtivo.com\/uk\/wp-json\/wp\/v2\/standard-post-filter\/6241\/revisions"}],"predecessor-version":[{"id":7007,"href":"https:\/\/amtivo.com\/uk\/wp-json\/wp\/v2\/standard-post-filter\/6241\/revisions\/7007"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/amtivo.com\/uk\/wp-json\/wp\/v2\/media\/6242"}],"wp:attachment":[{"href":"https:\/\/amtivo.com\/uk\/wp-json\/wp\/v2\/media?parent=6241"}],"wp:term":[{"taxonomy":"standard-post-categories","embeddable":true,"href":"https:\/\/amtivo.com\/uk\/wp-json\/wp\/v2\/standard-post-categories?post=6241"},{"taxonomy":"standard-post-tags","embeddable":true,"href":"https:\/\/amtivo.com\/uk\/wp-json\/wp\/v2\/standard-post-tags?post=6241"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}