Clause Provision CLS Requirements L1 L2 L3 L4 Developer’s Conformance (Yes/No/Not Applicable) Description of how the provision is fulfilled. The following are the 14 provisions from the ETSI EN 303 645. 5.1: No universal default passwords 5.1-1: Where passwords are used and in any state other than the factory default, all consumer IoT device passwords shall be unique per device or defined by the user. MC (1) MC (1) MC (1) MC (1) Supporting evidence shall show how it is ensured that passwords are unique per device. 1. If pre-installed passwords are used, the same universal default values should not be used across devices. 2. The device must require that the user define a new password during initialisation. 5.1-2: Where pre-installed unique per device passwords are MC (2) MC (2) MC (2) MC (2) Please note that there are many mechanisms used for performing authentication, and passwords are not the only mechanism for authenticating a user to a device. If other authentication mechanisms are used, please provide details. Supporting evidence shall describe the following: CLS Publication #2 | Page 21 of 49