Chapter 3: Enforcement Section 31: Power to vary or revoke enforcement notices
This Section provides the Secretary of State with power to vary or revoke an enforcement notice, as long as the changes do not make the notice more onerous than the original notice.
Example of varying a stop notice
The enforcement authority identifies that a popular baby monitor comes with a universal default password. The enforcement authority issues a compliance notice to the manufacturer, requiring that they ensure the product complies with all technical aspects of a security requirement within 14 days or stop making it available. The manufacturer has identified a solution to the problem and requests the Secretary of State allows the manufacturer 28 days to comply with the notice instead. The additional time is requested because another manufacturer supplies a key component part within the product and the primary manufacturer needs to work with its supplier to achieve compliance.
The Secretary of State is satisfied that the manufacturer is taking reasonable steps to comply, the additional time is genuinely needed, and that the extension does not materially expose citizens, networks and infrastructure to additional harm. The Secretary of State decides to vary the notice so that compliance is required within 28 days.
Example of revoking a stop notice
The Secretary of State issues a stop notice requiring a distributor to stop selling a non-compliant smart television within 60 days. The distributor works with the manufacturer to resolve the compliance failure and within 15 days the product complies with the security requirements. The Secretary of State is satisfied that the product complies, and decides to revoke the notice so the distributor can continue to make it available.