NIST CSF 2.0, ProtectPR.PS-06

Do not manufacture or supply a consumer grade smart device with a universal default password from 4 March 2026 for a product manufactured on or after that date; the device's hardware and any pre-installed or required software must use a password unique to that unit or set by the user, for every state other than the factory default.

Do not ship the device with weak, blank, or identical-across-all-units default credentials, and do not derive an initial password from information easy to obtain by scanning network traffic, such as a MAC address; alternatively, force the user to set a new password meeting the strength rules the first time the device is used or after a factory reset.

Do not hard-code credentials or cryptographic keys in the device's software or firmware source code, encrypt or hash any password, key, or credential you store or transmit, implement inactive-session timeouts, ship with unused communication ports and services disabled, and let the user disable non-essential communication features.

Equip the device with a security feature or features appropriate to its nature, function, and the information it may collect, contain, or transmit, designed to protect the device and that information from unauthorized access, destruction, use, modification, or disclosure.

Meet the mandatory requirements of the applicable national standard for your product or service, and do not embed a malicious program in it.

Construct the equipment so that it does not harm the network, and its operation does not misuse network resources so as to cause an unacceptable degradation of service.

Incorporate safeguards to protect the personal data and privacy of the equipment's users and subscriber, and support features protecting against fraud.

Design, develop, and produce the product, on the basis of your cybersecurity risk assessment and where each requirement applies, so it ships without known exploitable vulnerabilities, with a secure default configuration (unless you agree otherwise with a business user for a tailor-made product), protection against unauthorised access, and protection of the confidentiality of stored, transmitted or otherwise processed data, such as by encrypting relevant data at rest or in transit.

It reaches you if you are the vendor of an application using smart contracts or, in the absence of one, the person whose trade, business or profession involves deploying smart contracts for others, in the context of executing an agreement, or part of one, to make data available (Article 36(1); Article 1(3), point (g)). Make those smart contracts robust and access-controlled: design them to offer access control mechanisms and a very high degree of robustness to avoid functional errors and to withstand manipulation by third parties (Article 36(1), point (a)).

Design and develop your EHR system so that its interoperability, safety and security features uphold the rights of natural persons, and so that, where it is operated together with other products including medical devices, the harmonised software components make interoperability and compatibility reliable and secure (Annex II, points 1.3 and 1.4).

When you assess whether the product is safe, take into account, where required by the nature of the product, the appropriate cybersecurity features necessary to protect it against external influences, including malicious third parties, where such an influence might have an impact on its safety, including the possible loss of interconnection (Article 6(1), point (g)).

Meet that requirement from the dates in note B of Annex II: national authorities refuse EU type-approval to a new type that does not comply from 6 July 2022, and prohibit the registration of vehicles that do not comply, and the placing on the market and entry into service of components and separate technical units that do not comply, from 7 July 2024 (Article 16).

Implement a system development life cycle framework for the secure development, acquisition and maintenance of technology systems, with security risk assessments for acquired software and systems and coding principles that cover the use of third-party and open-source code.

Before you develop a network and information system, including software, lay down rules for secure development and apply them to in-house and outsourced development (point 6.2.1).

Apply a policy for the risks of acquiring software, hardware or services, apply secure-development processes across all development phases where they apply, and apply maintenance processes that cover at least configuration management and change management (Article 11).

The Department says you should restrict and validate inputs before running scripts or processes, confirm that secure programming practices are used, apply additional testing and validation, including human oversight, to AI-generated code before it is deployed in production, and, if you use AI to identify and remediate vulnerabilities, employ secure programming practices to prevent unknown changes in code or configurations.

The Department says you should consider confirming that secure programming practices are used, including validating user inputs and restricting unsafe execution of commands, scripts, processes or generated outputs.

As a 5G supplier, guarantee the security of the telecommunications equipment, hardware, software and ancillary services you provide for 5G networks and services: meet security standards from design to commissioning, strengthen software integrity and manage updates and patches, show product and service certification, audit the security of your equipment, products and services, give information on possible third-party interference in their design and operation, and give operators and corporate users information showing compliance with security standards (Article 13(1) and (2)).

If you are the provider of a high-risk AI system, design and develop it to achieve an appropriate level of accuracy, robustness and cybersecurity, held consistently throughout its lifecycle.

Make your high-risk AI system resilient against attempts by unauthorised third parties to alter its use, outputs or performance by exploiting vulnerabilities, with technical solutions appropriate to the circumstances and the risk.

Adopt technical and administrative security measures suited to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration, communication, or improper processing, from the design of the product or service through its execution.

If you produce equipment or provide network, program, application or IT services, whether from inside or outside Cuba, implement the requirements that guarantee the secure operation of the equipment and services you supply; obtain a Ministry of Communications operating license before offering TIC security services to a third party, a license reserved to a state entity whose staff reside permanently in the country.