Law / United States / 
Oregon
Security requirements for Internet-connected devices
ORS 646A.813 (added by 2019 c.193 (H.B. 2395-A) sec. 1; amending ORS 646.607)
In force since .
A product security requirements rule binding private bodies.
- Obligation class
- Security
What it requires
- This binds a manufacturer, a person that makes a connected device and sells or offers to sell it in Oregon; a connected device is a physical object, used primarily for personal, family or household purposes, that connects directly or indirectly to the Internet or is assigned an address for making a short-range wireless connection. It does not by itself reach a developer who ships only software or an app with no connected device of its own, and it imposes no duty on the manufacturer for software, firmware or peripheral devices that another manufacturer makes and a consumer later installs on the device.
- Equip the connected device with reasonable security features appropriate to its nature, function and the information it may collect, store or transmit, satisfied by giving each device a unique preprogrammed authentication credential or by requiring the user to generate new credentials before first use, or by complying with an applicable federal security requirement for connected devices.
- The duty does not apply where a consumer installs unapproved software or devices that disable or modify the device's own security features, to a Health Insurance Portability and Accountability Act (HIPAA)-covered entity or business associate as to an activity HIPAA regulates, or to a device whose functions already comply with Food and Drug Administration medical-device requirements.
- A violation is an unlawful trade practice under ORS 646.607, enforceable by the Attorney General or a district attorney by injunction, carrying a civil penalty of up to $25,000 for a willful violation; Oregon's private right of action for unlawful trade practices reaches only a practice declared unlawful under the separate ORS 646.608, so this duty carries no private remedy of its own.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
The $25,000-per-violation civil penalty is ORS 646.642(3), the Unlawful Trade Practices Act's general civil-penalty provision, not an amount stated in ORS 646A.813 itself, and requires a court finding that the violation was willful; it is recoverable only by the Attorney General or a district attorney petitioning the court in a suit brought under ORS 646.632.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
Who enforces it
Enforcement body
The Attorney General or a district attorney (Oregon's “prosecuting attorney”) may sue to enjoin a violation under ORS 646.632; the section names no dedicated regulator of its own and creates no private right of action.
What this law does
A manufacturer, a person that makes a connected device and sells or offers to sell it in Oregon, must equip the device with reasonable security features: a preprogrammed authentication credential unique to each unit, or a requirement that the user generate new credentials before first use, or compliance with an applicable federal security requirement for connected devices.
A connected device is limited, under the section's own definition, to a physical object used primarily for personal, family or household purposes that connects to the Internet or is assigned an address for a short-range wireless connection.
The section expressly imposes no duty on the manufacturer for software, firmware or peripheral devices that another manufacturer makes and a consumer later installs or adds, so it does not by itself reach a developer who ships only software or an app with no connected device of its own. It also exempts a device already regulated as to the relevant activity under Health Insurance Portability and Accountability Act (HIPAA), or already subject to Food and Drug Administration medical-device requirements.
It imposes no verification duty on an app store or marketplace. A violation is declared an unlawful trade practice under ORS 646.607, enforceable only by the Attorney General or a district attorney by injunction and a civil penalty of up to $25,000 per willful violation. Oregon's general private right of action for unlawful trade practices, ORS 646.638, reaches only a practice declared unlawful under the separate ORS 646.608, so a violation of this section carries no private remedy of its own. The enacting 2019 Act, chapter 193, carries its own printed effective date of .
When LexLint raises it
When your app profile says your app distributes a software product.
Back to the example · Lint your app
Page updated .