When I obtain software as part of a product purchase or I install purchased or free software I

want to know:

1. The software labelling must be integrated with the contract between the supplier and

owner. It should not be a totally separate disclosure. I think typical software licenses

limit the supplier's liability - NIST must ensure that any gains from labelling are not

reduced by fine print in Terms and Conditions.

2. Is it part of another product or independently sourced?

3. Will all software, including embedded software, be labelled for cybersecurity? (E.g.

washing machines, door locks)

4. Will any communications software be considered part of the product?

5. Can I replace it with an alternate supplier's product?

6. Data

1. Will any data be stored outside the product?

2. Where and at who's cost?

3. Will data be available to me and future owners in perpetuity?

4. Can data be transferred to other software outside my control?

5. Can data be transferred to replacement software that achieves the same results?

6. What data can be imported to the software and how is it checked for security?

7. Is it safe?

1. Will it disrupt any of my devices or accounts?

2. Has it been independently tested?

8. What efforts will the supplier and / or manufacturer make to keep it safe?

9. What compensation will I receive if it turns out to be unsafe?

10. What organization or entity warrants the above?

11. How reliable is that organization or entity?

12. Is the labelling valid worldwide or only within the jurisdiction of the warranting entity?

13. What is required for the updating process? (E.g. high speed internet access). What if

the product is moved and used somewhere where there is no internet?

14. Updates:

1. How will updates be delivered?

2. Will earlier versions be supported?

3. What compensation will the owner receive if the manufacturer changes their

mind? (E.g. developing windows 11 after telling everyone that window 10 would

be updated forever.)

15. Will the software fail safely if it is hacked or if it breaks? (E.g. autonomous car control

software interacting with other cars.)

16. Will the consumer be able to install all software updates? (E.g. to a motor car, without

going to the dealer.)

17. If the software is unusable because the software update cannot be installed what

compensation will the customer receive?
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

2.1 2 When is the 'software development cycle' complete? I would hope that all software will

come with maintenance, especially for cybersecurity.

2.3.1.5 Software End of Support Date

Allow for the possibility that the product hardware lasts beyond the End of Support Date. Can

the supplier force the product to stop working? It seems to me that the supplier should be

obliged to support the software for the expected life of the product. Perhaps for as long as

spare parts are available for the product - and what if a 3rd party makes spare parts?

Perhaps software suppliers should be obliged to provide source code or whatever when they

stop providing support. This would enable users to maintain it themselves or for third parties

to create competing versions. Similar to drugs and generic drugs.

2.3.3.1 Free from Known Vulnerabilities

I think there must be a mechanism that allows the software developer to provide updates after

manufacture and before switching on the product. What will happen if I order a product

online, the label is valid when the product is shipped but a fault is found before it reaches the

customer?

2.3.4.1 Personally Identifiable Information (PII) Data Manifest

What happens if the software is for a product that identifies the owner? (E.g. a car)

4 2 ... withdrawing the declaration ... Surely you won't allow a simple withdrawal! What

happens if the software for detecting a flat tire on a car has its certificate withdrawn - then the

whole car is probably useless.

David Guttridge

Consumer