Guide to the EN18031 Testing Standard

What is the EN18031 Standard?

If you imagine an IoT device as a house, the EN18031 standard is its security guide, teaching you how to equip it with protective gear like door locks, security windows, and alarms.

Why is EN18031 called the "security shield" for devices?

It is divided into three parts, acting like a three-layer protection net that guards the device from the foundation to the core:

• EN18031-1: General Security Requirements (Basic Protection Layer)
  The entry-level "Security Lock" covering access control, identity authentication, and secure communication. Applicable to all categories of networked devices (e.g., smartwatches, smart speakers, cameras).

• EN18031-2: Privacy Protection Requirements (Data Protection Layer)
  The data "Safe" covering data protection, log management, and user notifications. Applicable to devices processing personal data (e.g., health monitoring devices, children's toys).

• EN18031-3: Financial Security Requirements (Payment Protection Layer)
  The payment "Security Door" covering payment security guarantees and full-lifecycle key management. Applicable to devices with payment functions (e.g., smart payment watches, NFC devices).

2. EN18031 Standard Applicability

Not sure which part of EN18031 applies to your IoT device? Follow this simple judgment process to easily figure it out:

Device Analysis Flow:

1. Does the device have wireless functions? (e.g., Wi-Fi or Bluetooth)

2. Does it connect to the internet?

• Yes → Apply EN18031-1 (Equip basic security lock).

1. Does it store personal information? (e.g., health data, location)

• Yes → Apply EN18031-2 (Add privacy safe).

1. Can it make direct payments? (e.g., NFC subway rides, online shopping)

• Yes → Apply EN18031-3 (Install financial security door).

Practical Case Analysis

• Case 1: Smartwatch

• Has Wi-Fi/Bluetooth → Connects to the internet → Must follow EN18031-1.

• Collects heart rate/steps → Processes personal data → Must follow EN18031-2.

• Supports NFC payments → Makes financial transactions → Must follow EN18031-3.

• Conclusion: This watch must comply with all three standard levels!

• Case 2: Smart Speaker

• Has Wi-Fi → Connects to the internet → Must follow EN18031-1.

• Listens to speech → Processes voice data → Must follow EN18031-2.

• Cannot make payments → Does not need to follow EN18031-3.

• Conclusion: The speaker only needs to pass the first two standards!

Brief Summary

If a device can directly or indirectly connect to the internet, it is likely within the testing scope!

• Direct Access: Devices with built-in Wi-Fi, Ethernet, 4G/5G, or Zigbee that can connect to the internet independently.

• Indirect Access: Wearables with only Bluetooth that rely on connecting to a mobile phone first to access the network.

Determine Which Functions Need Testing

A practical tip: Closely evaluate the "networking components" in your communication hardware, such as network cards, Bluetooth modules, and RF transceivers (like remote controls). These all must be assessed for testing requirements.

For reference, look at the frequency coverage rules of the red directive. It regulates all radio equipment below 3000 GHz. Whether it is short-range communication, broadband devices, mobile phones, FM radios, or televisions, they all fall completely within its scope.

Examples of covered devices:

• 27.145 MHz wireless remote control toys

• 433.92 MHz home appliance remote controls

• 2.4 GHz Bluetooth ovens

• 2.4 GHz / 5 GHz Wi-Fi air conditioners

• Everyday mobile phones