NIST CSF 2.0, ProtectPR.PS-06

Do not manufacture or supply a consumer grade smart device with a universal default password from 4 March 2026 for a product manufactured on or after that date; the device's hardware and any pre-installed or required software must use a password unique to that unit or set by the user, for every state other than the factory default.

Do not ship the device with weak, blank, or identical-across-all-units default credentials, and do not derive an initial password from information easy to obtain by scanning network traffic, such as a MAC address; alternatively, force the user to set a new password meeting the strength rules the first time the device is used or after a factory reset.

Do not hard-code credentials or cryptographic keys in the device's software or firmware source code, encrypt or hash any password, key, or credential you store or transmit, implement inactive-session timeouts, ship with unused communication ports and services disabled, and let the user disable non-essential communication features.

Equip the device with a security feature or features appropriate to its nature, function, and the information it may collect, contain, or transmit, designed to protect the device and that information from unauthorized access, destruction, use, modification, or disclosure.

Where the device authenticates outside a local area network, give each unit a unique preprogrammed password or require the user to generate a new means of authentication before first use; meeting a NIST-conforming Internet of Things cybersecurity labeling scheme's baseline criteria and conformity assessment is an alternative way to satisfy the duty.

Meet the mandatory requirements of the applicable national standard for your product or service, and do not embed a malicious program in it.

Construct the equipment so that it does not harm the network, and its operation does not misuse network resources so as to cause an unacceptable degradation of service.

Incorporate safeguards to protect the personal data and privacy of the equipment's users and subscriber, and support features protecting against fraud.

Once it applies, design, develop, and produce the product so it ships without known exploitable vulnerabilities, with a secure default configuration, protection against unauthorised access, and encryption of data at rest and in transit.

Equip the connected device with reasonable security features appropriate to its nature, function and the information it may collect, store or transmit, satisfied by giving each device a unique preprogrammed authentication credential or by requiring the user to generate new credentials before first use, or by complying with an applicable federal security requirement for connected devices.

Ban universal default passwords and easily guessable passwords across the product's hardware and pre-installed or required software; a password must be unique per unit or set by the user, and must not be built from incremental counters or from publicly derivable identifiers.

Apply this Law's security measures and techniques to any computer program you make available; the text states no separate support period, update or vulnerability-disclosure-channel duty for the program itself (Article 18).

If you produce equipment or provide network, program, application or IT services, whether from inside or outside Cuba, implement the requirements that guarantee the secure operation of the equipment and services you supply; obtain a Ministry of Communications operating license before offering TIC security services to a third party, a license reserved to a state entity whose staff reside permanently in the country.