Glossary

Plain definitions of the terms used in firmware security and device regulation: SBOM, VEX, CVE, the EU CRA, EN 18031, UK PSTI, ER: 01, ITSAR, NDAA 889 and more.

Vulnerabilities and SBOMs

SBOM: Software bill of materials: a machine-readable list of the components in a piece of software or a firmware release, with their versions, suppliers and dependencies. CISA, SBOM
CycloneDX: An SBOM format from OWASP, standardised by Ecma International as ECMA-424. It can also carry VEX information. ECMA-424
SPDX: Software Package Data Exchange, an SBOM format from the Linux Foundation, published as the international standard ISO/IEC 5962:2021. SPDX
VEX: Vulnerability Exploitability eXchange: a statement of whether a known vulnerability affects a product, with a status such as not affected, affected, fixed or under investigation. CISA, SBOM and VEX
OpenVEX: A minimal, open format for VEX statements, published as an open specification. OpenVEX specification
CSAF: Common Security Advisory Framework, an OASIS standard for machine-readable security advisories, including a VEX profile. OASIS, CSAF 2.0
CVE: Common Vulnerabilities and Exposures: the public catalogue of disclosed vulnerabilities, each with an identifier such as CVE-2024-3094. CVE Program
NVD: The US National Vulnerability Database, run by NIST, which adds severity scores and affected product data to CVE records. NIST, NVD
CPE: Common Platform Enumeration: a naming scheme for products and versions that the NVD uses to say which products a CVE affects. NIST, CPE
PURL: Package URL: a standard way to identify a software package by its type, namespace, name and version, used in SBOMs. Package URL specification
OSV: Open Source Vulnerabilities: a database and format that maps vulnerabilities to exact package versions in open source ecosystems. OSV
CVSS: Common Vulnerability Scoring System: a score from 0 to 10 for the severity of a vulnerability, maintained by FIRST. FIRST, CVSS
EPSS: Exploit Prediction Scoring System: an estimate from FIRST of the probability that a vulnerability will be exploited in the next 30 days. FIRST, EPSS
KEV: The Known Exploited Vulnerabilities catalogue kept by CISA, the US cyber defence agency: vulnerabilities with evidence of exploitation. CISA, KEV catalogue
CWE: Common Weakness Enumeration: MITRE's list of types of software and hardware weakness, such as CWE-798, hard-coded credentials. MITRE, CWE
Coordinated vulnerability disclosure: A process in which a vulnerability is reported privately to the maker and made public once a fix or mitigation is available. CISA, coordinated vulnerability disclosure

European Union

Cyber Resilience Act (CRA): Regulation (EU) 2024/2847, which sets security requirements for products with digital elements sold in the EU. In force since 10 December 2024; reporting applies from 11 September 2026 and the rest from 11 December 2027. Exporting devices to the EU? What the CRA asks of you
Article 14 reporting: The CRA duty to report actively exploited vulnerabilities and severe incidents: an early warning within 24 hours, a notification within 72 hours and a final report, for products sold in the EU. European Commission, CRA reporting obligations
Single Reporting Platform: ENISA's platform through which manufacturers send CRA Article 14 reports to the national CSIRT acting as coordinator. ENISA, the CRA Single Reporting Platform
Support period: Under the CRA, the time during which a manufacturer handles a product's vulnerabilities and provides security updates: at least five years unless the product is expected to be in use for less. Regulation (EU) 2024/2847
Technical documentation: The file described in CRA Annex VII that shows how a product meets the essential requirements, kept for at least ten years. Regulation (EU) 2024/2847
CE marking: The mark a manufacturer puts on a product to declare that it meets the EU rules that apply to it. European Commission, CE marking
Harmonised standard: A European standard cited in the Official Journal; applying it gives a presumption of conformity with the legal requirements it covers. European Commission, harmonised standards
Radio Equipment Directive (RED): Directive 2014/53/EU on radio equipment. Its Article 3(3)(d), (e) and (f) security requirements have applied since 1 August 2025. Directive 2014/53/EU
EN 18031: The harmonised standard in three parts for the RED security requirements: network protection (part 1), personal data (part 2) and fraud protection (part 3). ETSI EN 303 645 and EN 18031
ETSI EN 303 645: The European baseline standard for consumer IoT security, covering passwords, vulnerability reports, updates, storage, communication and more. ETSI EN 303 645 and EN 18031

United Kingdom

UK PSTI: The Product Security and Telecommunications Infrastructure regime: since 29 April 2024, consumer connectable products sold in the UK need unique or user-set passwords, a published way to report security issues and a published minimum update period. GOV.UK, the PSTI regime
Statement of compliance: Under UK PSTI, the document that must accompany each product to state that it meets the security requirements; it may be digital. GOV.UK, the PSTI regime

India

ER: 01: MeitY's Essential Requirement(s) for Security of CCTV: the security test a CCTV or IP camera must pass before BIS registers it, mandatory since 9 April 2025 except for analog cameras. Device security rules in India
BIS registration: Registration with the Bureau of Indian Standards under the compulsory registration order, which covers CCTV cameras among other electronics. BIS, CCTV implementation guidelines
STQC: The Standardisation Testing and Quality Certification Directorate under MeitY, which publishes the ER: 01 test procedure and recognises the labs. STQC
NCCS: The National Centre for Communication Security, which certifies the security of telecom equipment such as IP routers and Wi-Fi CPE. NCCS ITSAR and TEC 31318
ITSAR: Indian Telecom Security Assurance Requirements: the security requirements NCCS certifies telecom equipment against, with versions for IP routers and Wi-Fi CPE. NCCS ITSAR and TEC 31318
MTCTE: Mandatory Testing and Certification of Telecommunication Equipment, the scheme run by the Telecommunication Engineering Centre (TEC). TEC, MTCTE portal
TEC 31318:2025: The Telecommunication Engineering Centre's voluntary code of practice for securing consumer IoT, which follows ETSI EN 303 645. TEC 31318:2025 (PDF)
CERT-In: India's national computer emergency response team. Its directions of 28 April 2022 require the cyber incidents they list to be reported within six hours. CERT-In directions of 28 April 2022 (PDF)

United States

California SB-327: The California law, in Civil Code section 1798.91.04, requiring reasonable security features on connected devices; for remote access, a unique password per device or one the user sets before first use. California Civil Code 1798.91.04
NDAA section 889: The procurement rule that bars US federal agencies from buying equipment that uses covered telecommunications or video surveillance equipment as a substantial or essential component. FAR 52.204-25
FCC Covered List: The FCC's list of communications equipment and services that pose an unacceptable risk to US national security. FCC, Covered List
U.S. Cyber Trust Mark: A voluntary FCC label for consumer wireless IoT products, built on NIST's consumer IoT criteria. FCC, U.S. Cyber Trust Mark
NIST IR 8425: NIST's profile of the IoT core baseline for consumer IoT products, on which the Cyber Trust Mark's criteria build. NIST IR 8425
NIST IR 8259A: NIST's core baseline of cybersecurity capabilities for IoT devices, such as device identification, configuration, data protection and software update. NIST IR 8259A
IEC 62443-4-2: The international standard setting technical security requirements for components of industrial automation and control systems. IEC 62443-4-2 and NIST IR 8425

Firmware analysis

Firmware: The software stored on a device that runs its hardware: typically a bootloader, a kernel, a file system and the applications on top. NIST, firmware
Firmware emulation: Running a device's firmware, or programs from it, on a computer that imitates the device's processor, so it can be tested without the hardware. QEMU
Taint analysis: Following untrusted input, such as network data or form fields, through a program to see whether it reaches a risky call such as a copy or a command without a check. Taint checking
Hard-coded credentials: Passwords or keys written into the firmware itself, the same on every unit and hard to change; CWE-798. MITRE, CWE-798
Default credentials: A username and password shipped the same on every unit, which attackers can look up; CWE-1392. MITRE, CWE-1392
Secure boot: A boot process in which each stage checks the signature of the next before running it, so only firmware signed by the maker runs. NIST SP 800-193, platform firmware resiliency
UEFI: The Unified Extensible Firmware Interface, the firmware standard that starts most PCs and many servers and gateways. UEFI Forum
BusyBox: A single program that provides many common Unix tools, found in most embedded Linux firmware. BusyBox
OWASP FSTM: The OWASP Firmware Security Testing Methodology: nine stages for testing firmware, from gathering information to exploitation. OWASP FSTM