Friendly Assessment of Security and Threats

Secure your product by design

Describe your IoT product in a few minutes. FAST identifies the threats that apply to it and the risks they create, the security measures that address them, the requirements of EN 303 645 you must meet and the documentation the assessor needs, then tracks where you stand.

No account is needed for one product. Sign in to save it and come back to it.

Describe your product About FAST

Step 1

Describe your product

Answer the questions below. A star marks the ones FAST needs. Leave the others unselected when they do not apply.

What to do here. Answer the questions about your product: what it is, what it connects to, what it stores. Tick what is true, leave the rest. Then send: FAST does the analysis at once.

No product at hand? Start from an example

Each one is filled from the questionnaire to the assessment, as a team would after a few weeks. Load it, look around, then change anything: it is yours.

Matter thermostat Very small and light: local network only, no cloud, controlled from a Matter app.
Fitness tracker Wearable, constrained, through a phone app: the middle one.
Smart TV Connected, powerful, many interfaces: the full picture.

What is the product called?

IoT product description

Describe your product by answering the following questions.

Who will use the IoT product? *

Where will this IoT product be installed? *

Development process

Is development outsourced to a third party?
For example, a white-label device or an external development team.

Does the product use open-source libraries?
Select "Yes" if you do not know.

Who will install the product?

How long is the support period planned for? *

This usually runs until the product's end of life.

Ecosystem and data

Describe your product's ecosystem and data collection. Leave options unselected where they do not apply.

Applications and services

Is there a mobile application?

Is there a cloud service?

Is there a web interface?

The device has a web server
A web interface is generally used for administration.

The web interface is in the cloud

Does the product collect personal data?

Personal data is collected and stored in the device

Personal data is collected and stored in a mobile app or in the cloud

Does the product collect telematics or usage data?

Telematics or usage data is collected and stored in the device

Telematics or usage data is collected and sent to the manufacturer or a third party

Device usage and functions

Describe the functions of your product. Only select an answer when the function is present.

How powerful is the device? *

Sensors and actuators

The device contains sensors
For example, the device can measure the room temperature.

The device can perform actions on the physical world
For example, the device turns the heating on remotely.

Connectivity

Is the product permanently connected to a network?
A local network or the Internet.

Can the device act as a gateway to provide network access to other devices?
For example, the device is an IoT hub.

Can the user access the device from the Internet?
Via a mobile app or a web interface.

How is firmware updated?

Firmware is updated remotely, over the air
The device downloads and installs the update itself.

Firmware is updated locally
For example, via a mobile app or a USB port.

Are physical interfaces accessible to the user?

Physical interfaces are accessible outside the case
For example, a USB port or an Ethernet port.

Physical interfaces are accessible inside the case
For example, JTAG.

Changing an answer later recomputes the threats, the measures and the compliance at once. Your decisions and texts are kept.