Managing cybersecurity compliance across multiple connected or smart devices can be complex and costly.
The Family of Products approach provides a practical solution — allowing manufacturers to certify several related devices under a single compliance declaration.
This method streamlines testing, documentation, and approval in line with the RED Delegated Act (EU 2022/30) and harmonized cybersecurity standards such as ETSI EN 303 645 and EN 18031.
This approach ensures compliance with RED cybersecurity obligations and supports CE Marking for connected and wireless products.
At 360Compliance, we help manufacturers implement this efficient compliance method to achieve CE Marking and UKCA certification while ensuring full cybersecurity conformity under EU regulations.
What Is a Family of Products?
A Family of Products allows manufacturers to include multiple devices under a single cybersecurity certification if they share the same technical and cybersecurity foundation.
A valid product family typically includes devices that have:
- The same operating system or firmware
- Identical chipsets or SoC
- Consistent interfaces and connectivity
- A parent product supporting all functions of the variants
This recognized approach minimizes redundant testing and ensures a consistent cybersecurity posture across all models.
👉 See official EU guidance in the European Commission’s RED Delegated Act and CE Compliance Framework.
How the RED Delegated Act Defines Cybersecurity Obligations
The RED Delegated Act (EU 2022/30) expands the Radio Equipment Directive to include mandatory cybersecurity requirements for all radio and connected products placed on the EU market from 1 August 2025.
Manufacturers must ensure that devices — whether individual models or part of a product family — include mechanisms to:
- Protect network and personal data
- Prevent unauthorized access
- Enable secure software and firmware updates
- Maintain integrity and resilience of communication services
The Family of Products approach ensures these requirements are applied consistently across related models while reducing repetitive testing and documentation.
EN 303 645 – Cybersecurity Baseline for IoT Devices
ETSI EN 303 645 is the leading harmonized standard supporting the RED Delegated Act.
It defines cybersecurity best practices for consumer IoT, including:
- Secure credential and password management
- Safe software update mechanisms
- Protection of personal data
- Vulnerability disclosure and patching policies
Applying EN 303 645 consistently across a family of products ensures each model demonstrates equivalent protection and compliance.
👉 Download the official ETSI EN 303 645 specification.
EN 18031 – Cybersecurity for Smart Appliances
EN 18031 extends the cybersecurity framework to household and smart appliances, addressing:
- Security-by-design in embedded systems
- Supply-chain and software integrity
- Lifecycle maintenance and post-market monitoring
For manufacturers producing multiple smart appliances with similar hardware and firmware, the Family of Products strategy allows these variants to be covered under a single cybersecurity certification — reducing costs while maintaining compliance with EN 18031 and the RED Delegated Act.
Cybersecurity Requirements for Product Families
Even within a shared compliance declaration, every product in the family must meet essential cybersecurity criteria, including:
- Secure update mechanisms
- Authentication and access control
- Data protection aligned with GDPR
- Vulnerability disclosure procedures
- Documented risk assessment and mitigation
These elements form the basis of compliance with both EN 303 645 and EN 18031, ensuring that each device maintains a consistent cybersecurity profile.
👉 You can access the ETSI EN 303 645 official PDF.
Benefits of the Family of Products Approach
- Lower testing costs: Consolidate test efforts across similar models
- Accelerated CE/UKCA approval: Streamlined regulatory path
- Consistent cybersecurity: Unified protection across your product line
- Simplified documentation: Shared compliance structure
- Increased customer confidence: Demonstrated conformity under recognized EU frameworks
Why Choose 360Compliance
At 360Compliance, we specialize in Family of Products Cybersecurity Compliance aligned with the RED Delegated Act, EN 303 645, and EN 18031.
Our experts help you:
👉 Contact 360Compliance today to secure your IoT and smart devices, simplify regulatory compliance, and align your product families with RED Delegated Act cybersecurity standards.
