Smart device vulnerability reporting requirements
For an in-scope smart device, publish a security-reporting contact and state when reporters will receive acknowledgement and progress updates until resolution. Make the information accessible in English, free and available without request or personal details. Factory coordination can be handled by Cambridge China Bridge.
Publish a route that reaches the manufacturer
The manufacturer must publish a contact through which people can report product security issues, together with acknowledgement and status-update timescales. Start with our PSTI importing guide for product scope and the wider documentation checks.
Ask the supplier for the public reporting page and the contact it identifies. An email address or reporting form is a practical choice. Check that it reaches someone who can involve the manufacturer's security team, rather than ending in an unmonitored sales inbox.
Make the information openly accessible in English
The published reporting information must be accessible, clear and transparent. It must be available in English, free of charge, without prior request and without requesting the reader's personal information. A Chinese-only policy does not meet that English publication requirement.
Open the page while signed out. Check whether a reader can find the contact and timing commitments without registering, paying or giving personal details. Distinguish access to this information from submitting a report: the publication rule concerns access to the information.
State acknowledgement and update timings separately
Publish when the reporter will receive acknowledgement of receipt and when they will receive status updates until the reported security issues are resolved. The reporting provision requires published timings; it does not prescribe a fixed response interval.
Ask the manufacturer to replace vague wording such as 'we respond promptly' with explicit commitments it can meet. Clarify when the acknowledgement clock starts, whether timings use working or calendar days, how updates will arrive and how the reporter will hear about delays. An acknowledgement confirms receipt; it does not demonstrate a fix.
Check who owns the reporting workflow
Ask who monitors incoming reports, who replies in English and who obtains progress from the firmware, app and cloud-service providers. Agree cover for staff absence and a route for escalating missed commitments. Check that the public page clearly identifies the products covered.
Put the reporting page, responsible team and published timing commitments into the purchasing specification. Our product specification guide explains how to turn supplier assurances into written acceptance points.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Test the route and retain the result
Arrange a clearly labelled test message with the manufacturer before ordering. Confirm receipt, the responsible contact and how progress messages will be delivered. Save a dated copy of the public page and the test correspondence against the model being purchased. Recheck the route if the brand website or software provider changes.
If a real vulnerability arrives, use our security failure after sale guide for investigation and escalation. Cambridge China Bridge's own staff in China can help obtain the factory contacts and records needed to check the reporting arrangement.
Frequently asked questions
Must a smart-device vulnerability policy be in English?
The published reporting information must be available in English, accessible, clear, free and available without prior request or the reader's personal details.
What acknowledgement deadline does PSTI require?
The reporting provision requires the manufacturer to publish when acknowledgement will arrive. It does not set a fixed response interval. Check the actual commitment on the manufacturer's page.
Must manufacturers publish progress-update timescales?
Yes. They must publish when reporters will receive status updates until the reported security issues are resolved. A receipt acknowledgement alone does not cover that publication requirement.
How can I check a factory's vulnerability reporting route?
Read the public page while signed out, check the English contact and timing commitments, then arrange a labelled test message. Keep the page and correspondence with your purchasing records.