We publish what we learn. The studies below map the regulations that apply to connected products around the world, the standards they rely on and how those standards depend on each other, how manufacturers handle vulnerability disclosure in practice, and how the market for secure components is organised. They are free, independent and updated as the regulations evolve, and they are the material our advisors use in client work.
Studies
Panorama of IoT Cyber Security Regulations
A review of global IoT cyber security requirements to ensure your products meet market access standards. For anyone selling products in more than one market.
- Map and PDFs
- Free
- Product managers, compliance, sales
1-click compliance
A cetome initiative to make product security and compliance simple enough to adopt in one click. We turn the analysis our advisors do by hand into free tools that give the answer at once, starting with the vulnerability disclosure policy and the CRA scope of a product. For every manufacturer, with or without a security specialist.
- cetome initiative
- Free tools
- Product teams
dataviz
Dependency graphs to better visualise IoT cyber security standards and their relationships. Visualisation improves compliance and assessment against the standards, where a wall of text does not. For the engineers and compliance managers who implement them.
- Web app
- Free
- Engineers, compliance
CRA Basics
The Cyber Resilience Act in plain words, with guidance and checklists to prepare for compliance. For small and medium-sized manufacturers facing the CRA without a legal or security team. A joint initiative with RS Strategy.
- Website
- Free
- SMEs
Vulnerability Disclosure and Management
VDP accessibility and usability in consumer IoT
How easy it is to find and use the vulnerability disclosure policies of consumer IoT brands, where they fail, and what an accessible policy looks like. For product security owners and whoever publishes the policy.
- Study
- Free
- Product security owners
Market studies
Unique identity for devices
How to give every device a unique and secure identity, and the commercial and open-source solutions that do it, compared independently. For hardware and firmware teams choosing how to provision it.
- Market study
- Free
- Hardware and firmware teams
Panorama of IoT Cyber Security Regulations
A review of global IoT cyber security requirements to ensure your products meet market access standards. For anyone selling products in more than one market.
- Map and PDFs
- Free
- Product managers, compliance, sales
1-click compliance
A cetome initiative to make product security and compliance simple enough to adopt in one click. We turn the analysis our advisors do by hand into free tools that give the answer at once, starting with the vulnerability disclosure policy and the CRA scope of a product. For every manufacturer, with or without a security specialist.
- cetome initiative
- Free tools
- Product teams
dataviz
Dependency graphs to better visualise IoT cyber security standards and their relationships. Visualisation improves compliance and assessment against the standards, where a wall of text does not. For the engineers and compliance managers who implement them.
- Web app
- Free
- Engineers, compliance
CRA Basics
The Cyber Resilience Act in plain words, with guidance and checklists to prepare for compliance. For small and medium-sized manufacturers facing the CRA without a legal or security team. A joint initiative with RS Strategy.
- Website
- Free
- SMEs
VDP accessibility and usability in consumer IoT
How easy it is to find and use the vulnerability disclosure policies of consumer IoT brands, where they fail, and what an accessible policy looks like. For product security owners and whoever publishes the policy.
- Study
- Free
- Product security owners
Unique identity for devices
How to give every device a unique and secure identity, and the commercial and open-source solutions that do it, compared independently. For hardware and firmware teams choosing how to provision it.
- Market study
- Free
- Hardware and firmware teams