Skip to main content
Next Step PM
Back to the library

Launch · Add-on

Plan secure firmware updates after launch, including UK connected-device security law (PSTI)

Connected devices need security updates for years. In the UK, consumer connected products must meet baseline security rules, including how long you will provide updates.

UK guidanceWritten for the UK. Check the equivalent rules where you work.

About 5-15 daysChanges yearlyLast reviewed 5 November 2026

Who this applies to

Skills it builds
Technical and AI fluencyDelivery and execution
PM types
Hardware or IoT
Product types
All
Starting points
All
Ways of working
All
Experience
All
Size of organisation
All

Steps, by experience

Beginner (under 1 year)

  1. Check whether your product connects to the internet or a home network.
  2. Read the UK rules for consumer connectable products (the PSTI regime).
  3. Make sure there are no default passwords shared across devices.
  4. Publish how people can report security issues.
  5. Decide and publish how long you will provide security updates.

Intermediate (1 to 4 years)

  1. Plan secure over-the-air updates, including how to recover from a failed update.
  2. Prepare the statement of compliance with your legal team.
  3. Agree how quickly security fixes ship after a report.

Experienced (5+ years)

  1. Set an update and support-period policy across devices.
  2. Budget for updates over the whole support period.
  3. Track related rules in other markets, such as the EU Cyber Resilience Act.

Who can do this

Owner: Product manager

Can be delegated to

  • Hardware / manufacturing engineer or Tech Lead or Backend Engineer: Design the update mechanism
  • Policy / Legal / Compliance: Prepare the statement of compliance

Reviewed by: Hardware / manufacturing engineer, Policy / Legal / Compliance, Tech Lead

Tool examples

GitHub
Keep firmware release notes with each tagged release.
Confluence
Publish the security reporting page and support period.

Definition of done

  • No shared default passwords
  • Security reporting route published
  • Support period published
  • Update mechanism tested

Common pitfalls

  • Treating launch as the end of the work
  • No way to recover a device after a failed update
  • A support period nobody has budgeted for

If you lead the team

What good looks like: Connected devices get secure updates for their whole supported life.

Ask your PM

  • How long will we support updates, and is that published?
  • How do we push a security fix quickly?

Warning signs

  • There's no plan for updates after launch.
  • Security fixes take months to reach devices.

Do these first

Sources