CCDS-GR01-2023

IoT Devices Security Requirements
Guidelines 2023:
CCDS-GR01-2023
Ver. 1.0

General Incorporated Association
Connected Consumer Device Security Council
December 28, 2022

Copyright Connected Consumer Device Security Council Proprietary

CCDS-GR01-2023

Update History
Revision

Date of

Description of Update

Formulated byVer. 1.0 release

CCDS

UpdateRev. 1.0

Dec. 28,2022

Trademarks
・All company names, product names and the like in this document are either trademarks
or registered trademarks of their respective companies.
Notice・Information in this document is that available at the time of publication of this document
and is subject to change without notice.
・Duplication or reproduction of the contents of this document without prior permission
from the CCDS is strictly prohibited.

Copyright Connected Consumer Device Security Council Proprietary

CCDS-GR01-2023

1. Purpose of This Document
This Guidelines defines a minimum set of requirements (action level: ★) to be satisfied byconnected devices. These minimum requirements are to apply to IoT device and system
implementations of connected devices.

2. Scope of Granting of the CCDS Certification MarkThe scope of granting of the CCDS Certification Mark encompasses those devices andsystems with Internet Protocol-ready hardware and software interfaces. It also covers devices
and systems with Wi-Fi, Bluetooth, and/or USB interfaces (see Figures 1 to 3 below), because
relatively more vulnerabilities and attacks related to these interfaces are observed among
IoT devices.

[Figure 1] Example 1 of certification-eligible products that implement a subject interface:
Broadband Routers

Copyright Connected Consumer Device Security Council Proprietary1

CCDS-GR01-2023[Figure 2] Example 2 of certification-eligible products that implement a subject interface:
Car Navigation Systems[Figure 3] Example 3 of certification-eligible products that implement a subject interface:
Webcams

3. IoT Device Security Requirements
The requirements of the IoT Device Security Requirements_2023 Edition (CCDS-GR01-2023)
are summarized in Table 1. Details on each IoT device security requirement is provided inTable 2.

Copyright Connected Consumer Device Security Council Proprietary2

CCDS-GR01-2023[Table 1] CCDS IoT Device Security Requirements_2023 Edition (CCDS-GR01-2023) List
Classification
1.

Functional
requirements for

Security Requirements

ID

1-1

IoT devices(subset ID, security requirements)
Access Control and Authentication

Identification, access control,

1-1-1Disabling of TCP/UDP ports

configuration change, privilege

1-1-2

Change of credentials

management, authentication

Data Protection
1-2

1-3

Objectives and purpose

1-2-1

Data erasure function

Software Update

Data protection,
protection of credentials and key
information
Operational incident response

Requirements with a particularly large number of incidents and high impact

1-4

2.

3.

1-4-1

Wi-Fi authentication method

1-4-2

Bluetooth vulnerability countermeasures

1-4-3

USB access control

1-4-4

Injection countermeasures

Requirements for

2-1

Contact point and security support system

the operation of

2-2

Product document management

Documentation of security activities

IoT devices

2-3

Provision of information to users

Operational support

Requirements forauditing IoT
devices

Operational incident response

Audit log recording
3-1

3-1-1

Time management function[Table 2] Details of individual IoT device security requirements
Copyright Connected Consumer Device Security Council Proprietary

Operational incident response

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)1.

Functional requirements for IoT devices

1-1changeAccess Control

Mandatory requirements

CWE-287:[Threat background]

and

1)

Have an ID that allows users

ImproperAppropriate authentication or(general users and privileged users)

Authentication

communication access control in TCP/UDP

and other IoT devices to uniquely

CWE-264:

sessions is not performed for the open

identify the target device.

Permissions,ports required for system operation.

Enforce appropriate authentication

Privileges, andVarious problems such as informationor access control for access from

Accessleakage of device data and privilege

users and other IoT devices forControls

escalation (management functionality

Authentication

2)

3)

TCP/UDP communication that isunder control) could occur.

necessary for system operation. For[Example]authentication, the default-

password shall be unique to each

[Reference]

device.

Technical standards conformity approval

Take countermeasures against(Telecommunications Business Act)

consecutive login attempts in user

Related requirements

authentication, e.g., sending alert-

notifications to privileged users,

Access control function

equipment operators or-

maintenance personnel when login

Access control function during powerattempts exceed a certain number

outage, software maintenance function

Wi-Fi wireless router, IP camera, etc.

Article 34 (10-1)

Article 34 (10-4)

NIST IR8425 Related requirements

Copyright Connected Consumer Device Security Council Proprietary1

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)4)of times, or disabling the target#1 Asset Identificationaccount for a certain period of time.

#2 Product Configuration

Identify and authenticate users for#4 Interface Access Control

functions that enable to change

ETSI EN 303 645 Related requirements

significant configurations,

5.1 No universal default passwords

including device security-related

5.4 Securely store sensitive security

functions to restrict anyone otherparametersthan privileged users, device

5.5 Communicate securely

operators or maintenance

5.9 Make systems resilient to outages

personnel from executing thefunctions.
5)

After network communication isbroken, re-establish the connection
with other devices in a secure statethrough the access control and/or
authentication processes.

Recommended requirements
None
1-1

1-1-1

ChangeDisabling of

Mandatory requirements

CWE-671:[Threat background]

TCP/UDP ports

1)

Close TCP/UDP ports not used forLack ofBy leaving unnecessary TCP/UDP ports

system operation.

Administrator

open, communication that might possibly

Regarding ports that need to beControl overbe exploited for cyberattacks could be2)

Copyright Connected Consumer Device Security Council Proprietary2

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)
opened for system operation,

Securityenabled.

demonstrate that they meet the[Example]

specified conformity criteria-

through vulnerability inspection.

[Reference]

Wi-Fi wireless router, IP camera, etc.

Recommended requirements

NIST IR8425 Related requirements

1)

Implement a function that can*No relevant requirements specified

identify open TCP/UDP ports andETSI EN 303 645 Related requirementschange open/close.

5.6 Minimize exposed attack surfaces

2)

Restrict anyone other thanprivileged users, equipment
operators or maintenancepersonnel from executing functions
that open/close TCP/UDP ports.

1-1

1-1-2

ChangeChange of

Mandatory requirements

CWE-259: Use[Threat background]

credentials

1)

Implement a function to change

of Hard-codedIf credentials such as IDs and passwords

credentials such as user IDs andPassword

required in accessing the device and/or its

passwords, and ensure that theCWE-255:

applications are hard-coded or cannot becredentials are not hard-coded.

Credentials

changed through the configuration

Implement a function that requires

Management

anyway, it is not possible to address thethe user to change the password

Errorscase where the credentials are2)

when the target of verification

compromised, which would lead tostarts for the first time if thevulnerability.

Copyright Connected Consumer Device Security Council Proprietary3

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)3)

default password is not unique to[Example]each target of verification.

-

Restrict those other than privileged

Wi-Fi wireless router, IP camera,
medical institution system, etc.

users, equipment operators or[Reference]

maintenance personnel fromTechnical standards conformity approvalchanging credentials.

(Telecommunications Business Act)
Related requirements

Recommended requirements-

Article 34 (10-4)

None

Function to prompt change of initial stateof identification code related to access
control function
NIST IR8425 Related requirements#2 Product Configuration#4 Interface Access Control
ETSI EN 303 645 Related requirements
5.1 No universal default passwords
5.4 Securely store sensitive security
parameters

1-2

New

Data Protection

Mandatory requirements

CWE-200:[Threat background]1)

Protect information assets stored in

Exposure of

If data protection mechanism such as

the storage area of the device from

Sensitive

encryption for the main storage, memory

unauthorized access andInformation toarea, and communication is implemented

Copyright Connected Consumer Device Security Council Proprietary

4CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)2)

3)

modification. (The same applies toaninadequately or has some vulnerabilities,

data stored in storage media such

Unauthorized

this could lead to information leakage.

as SD cards.

Actor

Regarding digital certificates used forProtect information assets

CWE-255:

encryption, if they are managed

transmitted to other IoT devices

Credentials

inadequately or have vulnerabilities, thisand servers (including cloudManagement

could also lead to information leakage

servers) from information leak andErrorsthrough data analysis.

alteration.

[Example]Manage credentials (password,-

Operating systems such as Windows

private key, etc.) in an area

and Linux, software modules such asprotected from unauthorized access

OpenSSL, image viewers for medical(tampering, theft, etc.) via theequipment, etc.

network, when the device stores[Reference]the credentials.

NIST IR8425 Related requirements#3 Data Protection[Remarks]ETSI EN 303 645 Related requirements

For data handled as information assets,

5.4 Securely store sensitive security

perform a risk analysis for eachparameters

product/service and clarify the target

5.5 Communicate securely

information.

5.8 Ensure that personal data is secure

Recommended requirements

Copyright Connected Consumer Device Security Council Proprietary5

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-IDType

Explanation(Threat backgrounds, examples)1)

Implement encryption and prevent
tampering data. Encryption
algorithms and key management
methods shall conform to theguidelines shown below.

2)

Protect keys and certificates used
for encryption from unauthorizedaccess and modification.

[Guidelines related to cryptography]-“List of reference ciphers for egovernment procurement(CRYPTREC)”（Last revised:
March 30, 2022, CRYPTREC LS0001-2012R7）-“Criteria for setting cryptographic
strength requirements (algorithm
and key length selection)”（First
Edition: June 2022, CRYPTREC
LS-0003-2022）

Copyright Connected Consumer Device Security Council Proprietary

6

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)[Supplementary documents for theabove guidelines]-“CRYPTREC Cryptography
Guidelines (SHA-1) Revised
version” (CRYPTREC GL-20012013R1)-“CRYPTREC Cryptographic
Technology Guidelines(Lightweight Cryptography)”(CRYPTREC GL-2003-2016JP)-“Encryption key setting
guidance“ (CRYPTREC GL-30031.0)-“Encryption Key Management
System Design Guidelines (Basics)”(CRYPTREC GL-3002-1.0)-“TLS cipher setting guidelines”(CRYPTREC GL-3001-3.0.1)

1-2

1-2-1

No

Data erasure

Mandatory requirements

CWE-226:[Threat background]changefunction

1)

Ensure that the information

Sensitive

If functions to delete security settings,

configured by the user and theInformation in

confidential information, privacy

information obtained during use of

Resource Not

information, etc. stored in the device andCopyright Connected Consumer Device Security Council Proprietary

7

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)2)

the target of verification can be

Removedits applications are not implemented,

easily deleted.

Before Reuse

there is a possibility that confidential

Ensure that updated system

information, security settings, privacy

software is maintained even after

information, etc. might be leaked at thedeleting the information.

time of disposal or reuse.
[Example]

Recommended requirements-

PC, USB memory, smartphone

None[Reference]
NIST IR8425 Related requirements*No relevant requirements specified
ETSI EN 303 645 Related requirements
5.11 Make it easy for users to delete user
data

1-3

ChangeSoftware Update

Mandatory requirements

CWE-1277:[Threat background]1)

Implement software update

Firmware Not

If a function to update software/firmware

functionality.

Updateable

is not implemented, and a vulnerability is2)

3)

Ensure that the software update

found in the software/firmware, thestatus is maintained even after thevulnerability might be exploited because it

power is turned off.

would not be fixed.

Have a means to confirm that the[Example]software update has been

・Wi-Fi wireless router, IP camera, etc.

completed normally, such as[Reference]

Copyright Connected Consumer Device Security Council Proprietary8

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)4)

displaying the version after theTechnical standards conformity approval

update.

(Telecommunications Business Act)Regarding the update program, theRelated requirements

applicant shall guarantee that only-

genuine update is applicable,

Software update functionality

without any alterations through

NIST IR8425 Related requirements

the update process#5 Software Update(countermeasures against

ETSI EN 303 645 Related requirements

alteration).

5.3 Keep software updated

Article 34 (10-3

5.4 Securely store sensitive security[Remarks]

parameters

Either of the following methods is

5.7 Ensure software integrity

applicable. The software update is:-

automatically initiated; or-manually performed bymaintenance personnel or
privileged users who have explicit
management responsibility.

Recommended requirements
1)

Have a mechanism to verify theauthenticity of the update software

Copyright Connected Consumer Device Security Council Proprietary

9CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)when the target of verification
installs the update(countermeasures against
tampering).
2)

Encrypt communication channels
or encrypt data duringtransmission for update software(data protection).

3)

Restrict anyone other thanprivileged users, equipment
operators or maintenancepersonnel from executing afunction that disables the software
update function, if implemented.

4)

Implement a function to enable anddisable notification of updates.

1-4

1-4-1

No

Wi-Fi

Mandatory requirements

CWE-326:[Threat background]changeauthentication

1)

Implement the latest

Inadequate

If the communication encryption protocols

authentication method

Encryption

used in the Wi-Fi device are not the latest,

recommended by the Wi-Fi

Strengthencryption algorithms used aremethodAlliance®.

vulnerable.
[Example]

Copyright Connected Consumer Device Security Council Proprietary

10

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)
Recommended requirements-

Wi-Fi wireless router

None[Reference]
NIST IR8425 Related requirements#4 Interface Access Control
ETSI EN 303 645 Related requirements
5.5 Communicate securely

1-4

1-4-2

No

Bluetooth

Mandatory requirements

CWE-287:[Threat background]changevulnerability

1)

Implement the latest pairing

Improper1)

method recommended by Bluetooth

Authentication

countermeasures

2)

3)

In the specifications before Bluetooth
2.0 + EDR, you input a common

SIG.

number called “PIN code” into devices

Ensure that unnecessary Bluetooth

to be paired. In general, 4-digit

profiles are not recognized.

numeric input such as "0000" is used

Ensure that the target of

in many implementations, so security

verification is not vulnerable tocan be easily breached by guessing theBluetooth's Blueborne

number.

vulnerability.

2)

If unnecessary Bluetooth profiles are
implemented then it would be subject

Recommended requirements
None

to attacks.
3)

If a device has the Blueborne
vulnerability, the device could possibly
be taken over by the malicious actors.

[Example]

Copyright Connected Consumer Device Security Council Proprietary11

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)-

Devices before Bluetooth 2.0+EDR-

Devices that implement Bluetooth
functionality and use OS versions thatmay potentially be vulnerable toBlueborne[Reference]
NIST IR8425 Related requirements#4 Interface Access Control
ETSI EN 303 645 Related requirements
5.6 Minimize exposed attack surfaces
1-4

1-4-3

ChangeUSB access

Mandatory requirements

CWE-284:[Threat background]

control

1)

Appropriately control access to the

ImproperIf unnecessary device classes are

USB interface and restrict access

Access Control

implemented, it would be subject torights.

attacks such as malware.
[Example]

Recommended requirements-

1)

Do not implement USB ports that

[Reference]

are not necessary for the service.

NIST IR8425 Related requirements

Take measures to make the USB#4 Interface Access Control

ports difficult to be utilized by

ETSI EN 303 645 Related requirements

anyone other than the person in

5.6 Minimize exposed attack surfaces

2)

USB-mounted devices in generalcharge of operation.

Copyright Connected Consumer Device Security Council Proprietary

12

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type
1-4

1-4-4

Change(Threat backgrounds, examples)
Injection

Mandatory requirements

CWE-78: OS[Threat background]countermeasures

1)

Significant vulnerabilities such asCommandIf injecting commands or manipulating

injection via Web input have been

Injection

pathnames are possible by specially

fixed.

CWE-89: SQL

crafting the user input, it might be

Injection

exploited to tamper with the backend

Recommended requirements

CWE-352:

database, to execute system commands, toNone

Cross-Sitebypass security checks, etc.

Request[Example]

Forgery-

6319）(CSRF)
CWE-22: Path

Wi-Fi wireless router（CVE-2015--

Wi-Fi wireless router（CVE-20147270）

Traversal-

IP camera（CVE-2017-7461）[Reference]
NIST IR8425 Related requirements#4 Interface Access Control
ETSI EN 303 645 Related requirements
5.13 Validate input data2.
2-1

Requirements for the operation of IoT devices
ChangeContact andMandatory requirements

No applicable[background]security support

1)

CWE

Security standards for IoT devices at home

Have a contact regarding productvulnerabilities, and it is open to theand abroad provide criteria for

Copyright Connected Consumer Device Security Council Proprietary

13

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)2)

public.

organizational system and operations ofHave a mechanism to provide

product providers.

security updates of products in a

[Reference]

timely manner.

NIST IR8425 Related requirements#8 Information and Query Reception

Recommended requirementsETSI EN 303 645 Related requirements

None

5.2 Implement a means to manage reportsof vulnerabilities
5.3 Keep software updated

2-2

New

Product

Mandatory requirements

No applicable[background]documentation

1)

CWE

Security standards for IoT devices at homemanagement

Define and manage information
related to cyber security

and abroad provide criteria forthroughout the life cycle of theorganizational system and operations of

product, which includes recording it

product providers.

in documents and updating them.

[Reference]
NIST IR8425 Related requirements

Recommended requirements#7 Documentation

None

ETSI EN 303 645 Related requirements*No relevant requirements specified

2-3

New

Provision of

Mandatory requirements

No applicable[background]information to

1)

CWE

Security standards for IoT devices at home

users

Clearly indicate the procedure forusers to use the products securely

and abroad provide criteria for

Copyright Connected Consumer Device Security Council Proprietary

14

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)

2)

3)

4)

5)

regarding configurations and/ororganizational system and operations ofusage that can impact

product providers.

cybersecurity.

[Reference]

Inform users of the content and

NIST IR8425 Related requirements

necessity of product software#9 Information Dissemination

updates, and the impact in case of#10 Product Education and Awarenessnot updating software.

ETSI EN 303 645 Related requirements

Inform users of disclaimers for

5.2 Implement a means to manage reports

possible accidents and failures.

of vulnerabilities

Notify the user of the support

5.3 Keep software updated

period and end-of-support policy for5.11 Make it easy for users to delete user

the relevant products and/or

data

services.

5.12 Make installation and maintenance ofInform users of the assumed risks

devices easyof disposing of devices with dataremaining in them, and how tosecurely dispose of devices,
including data deletion.

Recommended requirements
None
3.

Requirements for auditing IoT devices

Copyright Connected Consumer Device Security Council Proprietary

15

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type
3-1

New

(Threat backgrounds, examples)
Audit log

Mandatory requirements

CWE-778:[background]recordingNone

Insufficient

In product incident response and security

Logging

audits, recorded log data (audit trails) is

Recommended requirements

required for post-incident analysis and1)

Implement audit trail recording

improvement consideration. Security

features and enable privileged

standards for IoT devices at home andusers, equipment operator orabroad also include requirements formaintenance personnel to accessrecording logs for the purpose of

the audit trail

recognizing the status of cybersecurity.

Ensure there is sufficient storage[Reference]for recording audit trail. If the

NIST IR8425 Related requirements

storage capacity for the audit trail#6 Cybersecurity State Awarenessis exceeded, take appropriate

ETSI EN 303 645 Related requirements

measures such as overwriting the

5.2 Implement a means to manage reports

oldest records in order.

of vulnerabilities

Take measures to prevent

5.7 Ensure software integrity

2)

3)

unauthorized deletion or
modification for recorded audit
trail.

[Remarks]-

The audit trail shall be stored in

Copyright Connected Consumer Device Security Council Proprietary

16

CCDS-GR01-2023

ID

SubID

ChangeSecurity Requirements

CWE-ID

Explanation

Type(Threat backgrounds, examples)
the target of verification itself
and/or servers to control the targetof verification.
The necessary size of the storage shallbe separately examined based on theusage of each product.

3-1

3-1-1

New

Time

Mandatory requirements

No applicable[background]management

None

CWE

Appropriate time management of the datefunctionand time of each event is required because
Recommended requirements

recording log data (audit trail) in

1)

Implement a time management

chronological order is important for post-

function to record the date andincident analysis.

time of a security event in the audit[Reference]

trail.

NIST IR8425 Related requirements[Remarks]*No relevant requirements specified

The requirement will be satisfied in the

ETSI EN 303 645 Related requirements

case where the date and time of an*No relevant requirements specified

event can be managed by either thedevice or the server.

Copyright Connected Consumer Device Security Council Proprietary17