An educational tool that takes you through the shape of a security audit for your connected-product deployment. You pick the archetype and markets; the tool resolves which regulatory frameworks apply and tailors the assessment accordingly.
Not a compliance tool. This scorecard is for orientation and learning. Formal assessment requires a qualified assessor and the authoritative standards themselves.
Signify's Philips Hue Bridge is the hub that turns a box of Zigbee bulbs into a system: it holds the mesh, talks to the app on the local network, and reaches the cloud for remote control and voice assistants. Sold in the EU and the UK, it is archetype 3, gateway + sensor fleet, in a home environment. Here is how the scorecard would work through it.
Archetype 3 at home selects the consumer bank of 19 questions. With EU and UK as markets, the resolver returns ETSI EN 303 645, the EU Cyber Resilience Act, GDPR and the UK PSTI Act. Had the same bridge been deployed as a building-automation gateway, the tool would have escalated it to the composite bank (7 more questions on the management layer) and added the 5-question OT supplement, because a gateway managing a fleet in an industrial setting behaves like a general-purpose computer.
The answers below are a plausible reading of a Zigbee hub from public documentation. They are not Signify's audited posture, and the grade is not a verdict on the product. The point is to show what each answer does to the score.
| Category | Answers | Points |
|---|---|---|
| Identity & access | Strong password at setup (2), optional 2FA off by default (1), lockout after repeated failures (2), keys in a protected partition (2) | 7 / 12 |
| Software updates | Automated signed OTA (3), signed with the manufacturer key (2), automatic rollback (2) | 7 / 9 |
| Data protection | Mixed on-device and cloud processing (2), core data plus opt-in analytics (2), account dashboard (2) | 6 / 9 |
| Communication | No internet-facing admin interface (3), per-device Zigbee keys with pairing (2), segmentation documented but not enforced (1) | 6 / 9 |
| Resilience | Lights keep working without the cloud (2), basic logging only (1), systematic input validation (2) | 5 / 9 |
| Compliance | Formal disclosure policy (2), ad-hoc pen test (1), internal component list, no SBOM (1) | 4 / 9 |
| Total | 35 of 57 points, 61% | C |
One mandatory flag fires: the CRA's SBOM obligation (Annex I, Part II, 1), because the component list is not in a standard format. No ceiling applies. Change one answer, though, and the arithmetic stops mattering: ship with a universal default password and the grade is capped at C− regardless of the other 18 answers, because PSTI Schedule 1 paragraph 1 bans the product from the UK market outright. Remove the update mechanism and the cap is C, because the CRA's secure-update requirement cannot be met.
The category table tells you where the points are. Here, mandatory 2FA and a hardware secure element lift identity and access from 7 to 11; a CycloneDX SBOM in the build pipeline clears the flag and adds two points; security event logging with alerting adds two more. That is eight points, 43 of 57, a B, from three work items. The requirements generator writes those items up, with owners and clause citations.
Each applicable question scores 0 to 3 points. The total is divided by the maximum to give a percentage, which maps to a letter grade from A (90% and above) to F (below 45%). Two critical failures then cap the grade regardless of the percentage: a universal default password caps it at C-, and no update mechanism caps it at C.
The 19 consumer questions follow the provisions of ETSI EN 303 645. Regulatory flags cite the EU Cyber Resilience Act, the UK PSTI Act and GDPR. Composite products add CIS Controls v8, and industrial deployments add IEC 62443-4-2 and NIS2. Each flag names the clause it comes from.
A flag is an answer that, on its own, puts you on the wrong side of a specific legal or standards clause in one of your target markets. Mandatory flags are market-access issues; advisory flags are expectations you will meet in procurement. Flags are listed separately from the grade because a B product with a mandatory flag still cannot ship.
Yes, and for free. The iframe snippet below renders the tool without site chrome, with attribution built in. No permission is needed and your readers do not have to sign up.
No. It is an educational orientation. It tells you which of the 19 areas need work and which clauses you would be measured against, so you can brief an assessor and prioritise a backlog. Formal assessment needs the authoritative standards and a qualified assessor.