Prepare your connected product for UL 2900-1 testing with confidence

UL 2900-1 is a voluntary standard titled Software Cybersecurity for Network-Connectable Products, Part 1: General Requirements. Published by UL as ANSI/CAN/UL 2900-1, it sets testable requirements for a vendor's product risk management process, security risk controls in product design, and testing for known vulnerabilities, malware and software weaknesses. It is the base part of the UL 2900 series, which industry-specific parts build on.

UL 2900-1 is used by manufacturers and software developers of network-connectable products, such as IoT devices, smart building systems, connected medical devices and industrial equipment. No law requires it in general, but buyers, insurers and procurement teams often ask for a UL 2900 certificate as evidence that a product has been independently tested against known cyber attacks.

UL 2900-1 contains the general requirements that apply to any network-connectable product. UL 2900-2-2 is a separate part with particular requirements for industrial control systems, and it is used together with UL 2900-1. Other parts follow the same pattern, such as UL 2900-2-1 for healthcare and wellness systems and UL 2900-2-3 for security and life safety signalling systems.

UL 2900-1 tests a product for known vulnerabilities, malware, malformed input handling through fuzz testing, and exploitable flaws through structured penetration testing. It also requires software weakness analysis, static source code analysis and static binary and bytecode analysis. Beyond testing, it checks product documentation, access control and authentication, remote communication, sensitive data protection, product management and the vendor's risk management process.

Yes. The US Food and Drug Administration recognised UL 2900-1 as a consensus standard for medical device cybersecurity in 2017, alongside the healthcare-specific UL 2900-2-1. Medical device manufacturers can cite recognised standards in premarket submissions. Check the FDA Recognized Consensus Standards database for the current recognition status and edition before relying on it.

The current edition of UL 2900-1 is Edition 2, dated 13 December 2023. Edition 1 was first published on 5 July 2017 and revised on 14 April 2023, and is now archived. Products may still hold certificates issued against the 2017 edition, so check which edition a customer or test laboratory expects before you start preparing.

UL 2900-1 tests the security of a specific product, while ISO 27001 certifies an organisation's information security management system. They complement each other: ISO 27001 controls on secure development, vulnerability management and supplier risk support the vendor processes that UL 2900-1 expects. Many controls can share the same evidence when mapped across both.

UL 2900-1 is mapped in OneClickComply's control library and available on request. OneClickComply helps you manage the organisational side, including policies, risk management, patching and evidence, and offers penetration testing and auditor guidance to help you prepare. Product testing and certification itself is carried out by an accredited laboratory, not by OneClickComply.