Back 
From TVs to watches, fridges, lightbulbs, or coffee machines, it seems everything needs to be connected now to be marketable. The Internet of Things (IoT) environment is growing in homes and workplaces, but it has established itself way ahead of regulation. IoT devices do not currently have to comply with any specific cybersecurity standards and malicious actors are already making use of these endpoints. Famously, a senior researcher at Avast even demonstrated in 2020 that he had successfully hacked his own coffee machine with ransomware. It’s amazing what some of us got up to in lockdown!
With awareness of the risk growing, it is unsurprising that this month the European Union announced plans for a Cyber Resilience Act. The legislation aims to establish cybersecurity standards and stricter conformity assessment procedures for IoT. Connected devices are often seen as organisational cybersecurity’s weakest link, and regulation will doubtless improve cyber resilience—just as regulation improved data protection standards with the GDPR.
Baseline cybersecurity standards for all connected devices, and stricter conformity assessment procedures for critical products, are certainly much needed. But this proposal raises many questions, such as, will legislation cover legacy products and those already in use? And how will small manufacturers manage the expense?
It is not yet known if the intention is for a simple pass/fail system, or if there will be gradings assigned to help customers understand the value of more stringent security. What is known is that the threat landscape is not stati