Part 1: Product Security Chapter 1: Security requirements Section 2: Further provision about regulations under section 1
This Section makes further provision about how the Secretary of State may exercise the power under Section 1 of the Act. Subsection (1) sets out that a security requirement may relate to, among other things, all the products of a relevant person or a relevant person of a particular description.
	Subsection (3) sets out a non-exhaustive list of what, in addition to a physical device, a security requirement may apply to. This list includes software related to a product which may or may not be installed on the product. The software may or may not be provided by the manufacturer of the product.
	Subsection (4) establishes that the security requirements may be ongoing, requiring a relevant person to act in relation to a relevant connectable product after it has been made available in the United Kingdom.
	Subsection (6) sets out that regulations under Section 1 are subject to the affirmative resolution procedure, unless they only make limited variations as specified in subsection (5), in which case the negative resolution procedure applies.
Example exercise of power: future security requirements
Security requirements will be technical in nature. They will set out details such as the products and other software relevant to each individual security requirement, technical detail and language describing what is required by each security requirement, and may mandate specific conformity assessment procedures in respect of certain products.
The initial security requirements are intended to align with the following intent:
Security Requirement 1 Ban universal default passwords and easily guessable default passwords
Security Requirement 2 Mandate that manufacturers make available information on how to report security vulnerabilities
Security Requirement 3 Mandate that manufacturers provide transparency on for how long, at a minimum, the product will receive security updates.