PSTI Statement of Compliance

Documents to download:

PSTI UK Policy PDF

PSTI Statement of Compliance

Manufacturer: Luceco UK Ltd

Name: Luceco UK Ltd

Smart Brands: BG Electrical, Luceco, Masterplug

Address: Luceco plc, Stafford Park 1, Telford, Shropshire,TF3 3BD, UK

Website: www.masterplug.com/uk/support/PSTI-Policy-uk

We, Luceco hereby declare that under our own responsibility, our devices fully comply with the applicable security requirements in Schedule 1 of The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023.

Schedule 1 specifies security requirements that relate to manufacturers of relevant connectable products which includes the Luceco brand and its subsidiaries. This includes the following:

1. Password is unique per device or defined by the user of the device, and the password which is unique per device is generated by using a security mechanism that reduces the risk of automated attacks against a class or type of device.
2. Users can report vulnerabilities to Luceco via: technical.support@luceco.com

Furthermore, users will receive acknowledgment of the receipt of a security issues report and status updates until the reported security issue is resolved.

3. Luceco will provide security updates for our products during the pre-defined support period. The defined support period will end 3 years after the product’s end-of-life date. Up-to-date information concerning the defined support periods for the entire Luceco product range are listed below.

How to Report Security Issues

Protecting our customers from threats to their security is always an important task for Luceco. As a key player in global Networking and Smart Home markets, we will do our utmost to provide our users with secure stable products and services, and to strictly protect the privacy and security of their data.

We welcome and encourage all reports related to product security or user privacy. We will follow established processes to address them and provide timely feedback.

We strongly encourage organisations and individuals to contact Luceco’s security team to report any potential security issue.

To report a security or privacy vulnerability, please send an email to technical.support@luceco.com  with the product model and software version, describe the detailed security issue to us. Luceco will endeavour to respond to the report within 10 working days.

Luceco will need to obtain detailed information about the reported vulnerability to more accurately and quickly begin the verification process.

Responsible Reporting Guidelines

1. All parties to a vulnerability disclosure should comply with the laws of their country or region.
2. Vulnerability reports should be based on the latest released firmware, and preferably written in English.
3. Report vulnerabilities through the dedicated communication channel. Luceco may receive reports from other channels but does not guarantee that the report will be acknowledged.
4. Adhere to data protection principles at all times and do not violate the privacy and data security of Luceco users, employees, agents, services or systems during the vulnerability discovery process.
5. Maintain communication and cooperation during the disclosure process and avoid disclosing information about the vulnerability prior to the negotiated disclosure date.
6. Luceco is not currently operating a vulnerability bounty program.

How Luceco Deals with Vulnerabilities

Luceco encourages customers, vendors, independent researchers, security organizations, etc. to proactively report any potential vulnerabilities to the security team. At the same time, Luceco will proactively obtain information about vulnerabilities in Luceco products from the community, vulnerability repositories and various security websites. In order to be aware of vulnerabilities as soon as they are discovered.

Luceco will respond to vulnerability reports as soon as possible, usually within 10 business days.

Luceco Security will work with the product team to perform a preliminary analysis and validation of the report to determine the validity, severity, and impact of the vulnerability. We may contact you if we need more information about the reported vulnerability.

Once the vulnerability has been identified, we will develop and implement a remediation plan to provide a solution for all affected customers.

Remediation typically takes up to 90 days and in some cases may take longer.

You can keep up to date with our progress and the completion of any remediation activities.

Luceco will issue a security advisory when one or more of the following conditions are met:

1. The severity of the vulnerability is rated CRITICAL by the Luceco security team and Luceco has completed the vulnerability response process and sufficient mitigation solutions are available to assist customers in eliminating all security risks.
2. If the vulnerability has been actively exploited and is likely to increase the security risk to Luceco customers, or if the vulnerability is likely to increase public concern about the security of Luceco products, Luceco will expedite the release of a security bulletin about the vulnerability, which may or may not include a full firmware patch or emergency fix.

Information on Minimum Security Update Periods

*The non-EOL product’s defined support period may be refreshed to extend specific date.