What labs, tenders and buyers check in your firmware

Practical notes for camera and router makers: what labs, tenders and buyers check in your firmware, the rules by market, and how to be ready before they ask.

Show posts for

  • For leaders

    Choosing a firmware security platform: questions to ask first

    Firmware security tools are easy to compare on feature names and hard to compare on evidence. Choose a firmware security platform by what it can prove on your own images. Look at the formats and processors it reads, how it reports what it could not read, which SBOM and VEX formats it exports and which markets' rules it maps to. On the vendors' own pages, ONEKEY publishes a longer list of firmware formats, exports more CycloneDX versions and holds ISO/IEC 27001. FDIE by Magdox covers India's ER-01, NCCS ITSAR and TEC 31318, exports VEX in three formats and publishes measured rates. Both import supplier SBOMs.

    · 6 min read

  • For engineers

    Buyers asking for VEX? CycloneDX, OpenVEX and CSAF compared

    When a vulnerability makes the news, buyers ask whether your product is affected. CycloneDX, OpenVEX and CSAF all say the same thing, that a product is affected, not affected, fixed or under investigation for a vulnerability. But they name the product, the vulnerability and the reason differently. Map the four statuses one to one, and carry any justification label the target format lacks as text instead of guessing. Identify the product so the customer's tools can match it, and keep non-CVE identifiers out of fields that accept only CVEs.

    · 7 min read

  • For leaders

    Exporting devices to the EU? What the CRA asks of you

    Indian makers who sell into the EU are covered by the Cyber Resilience Act even without an EU office. The Cyber Resilience Act applies to Indian companies whose connected products are sold in the EU, through their own brand or through an importer. Since 11 September 2026 they must report actively exploited vulnerabilities within 24 hours. From 11 December 2027, every product they place on the EU market must meet the essential requirements, with a technical file kept for at least ten years.

    · 6 min read

  • For leaders

    Buyers now ask for your SBOM. Here is what they check

    Buyers and regulators now ask device makers for an SBOM before they buy. A software bill of materials is now a condition of sale. BIS asks for one with every CCTV registration, and CERT-In recommends that public buyers require one in SPDX or CycloneDX. The EU Cyber Resilience Act puts one in every technical file. Buyers check that it names each component with its version and supplier, and that it matches the firmware you actually ship. They also want a VEX statement explaining which listed vulnerabilities do not affect the product.

    · 5 min read

  • For engineers

    Selling to industry or the US? What firmware can evidence

    Industrial and US buyers ask for different security baselines, and much of the proof sits in the firmware. IEC 62443-4-2 sets technical requirements for industrial automation components at capability security levels 1 to 4. NIST IR 8259A and NIST IR 8425 are voluntary US baselines for IoT devices and consumer IoT products. The FCC adopted NIST IR 8425 as the basis of its Cyber Trust Mark. In FDIE's catalogue, firmware evidence helps with 8 of the 47 IEC component requirements, 7 of NIST IR 8259A's 22 capabilities and 8 of NIST IR 8425's 33 outcomes. It decides none of them alone. Identity, configuration, documentation and support need your team.

    · 9 min read

  • For engineers

    ETSI EN 303 645 or EN 18031: one evidence base for both

    Consumer IoT sold in Europe is judged against two overlapping documents. ETSI EN 303 645 is a voluntary consumer IoT baseline. EN 18031-1, -2 and -3 are the harmonised standards for the Radio Equipment Directive's security requirements. Those apply from 1 August 2025 until 11 December 2027, when the Cyber Resilience Act takes over. Most ETSI provisions on passwords, updates, storage, communication and attack surface have an EN 18031 counterpart, and the same firmware evidence feeds both. They differ on legal role, scope, vulnerability handling, privacy and three restrictions in the Official Journal.

    · 8 min read

  • For leaders

    Which device security rules apply where you sell, and when

    Device makers who sell in several markets face many rules that ask for overlapping evidence. Four families of these frameworks are law for some products. In India they are ER-01 for CCTV cameras and NCCS ITSAR for routers. In the EU they are the Cyber Resilience Act, and EN 18031 under the Radio Equipment Directive. The rest are voluntary baselines that buyers and labels use. Across the 720 provisions FDIE tracks in 13 of them, a firmware analysis decides 38 on its own and helps with 180. The other 502 need product data or documents, tests and procedures from people.

    · 7 min read

  • For engineers

    Routers in India: preparing firmware for NCCS ITSAR

    Router and Wi-Fi CPE makers cannot sell in India without NCCS security certification. IP routers and Wi-Fi CPE sold in India need NCCS security certification under the ComSec scheme of MTCTE, tested against ITSAR by a designated laboratory. Version 2.0.0 of the two documents has 179 and 133 clauses. Firmware evidence helps with 39 clauses in each, and the rest needs the lab's tests on the device or the maker's documents and undertakings. TEC 31318:2025 is a voluntary 21-provision code that follows ETSI EN 303 645, so work done for it carries over.

    · 8 min read

  • For engineers

    Default passwords and keys in firmware: find and fix them

    One default password or shared private key can fail a lab test and put every device at risk. Hard-coded secrets in firmware sit in six places: the account database, the web interface's configuration, init scripts and NVRAM defaults, keys and certificates, cloud and API tokens, and program strings. The fix is the same everywhere: nothing secret is the same on two devices, and secrets are created at first boot or in the factory and stored securely. The release fails if a known secret is found in the image.

    · 6 min read

  • For leaders

    Selling devices in India: what you must now prove

    Indian device makers now have to prove security in writing, model by model. CCTV cameras sold in India need an ER: 01 security test report for BIS registration since 9 April 2025. IP routers and Wi-Fi CPE need NCCS security certification under MTCTE since mid 2024. On top of that, CERT-In expects incidents reported within six hours and recommends SBOMs in procurement. Exporters to the EU must report actively exploited vulnerabilities under the Cyber Resilience Act from 11 September 2026.

    · 6 min read

Find out what the lab would flag in your firmware

A 45-minute call with our team. Bring one firmware image.

Request access