Meet SB-327 connected device security duties with confidence

SB-327 is California's connected device security law, signed in September 2018 and operative since 1 January 2020. It requires manufacturers to equip internet-connected devices with reasonable security features appropriate to the device's nature and function and the information it handles. It is codified in the California Civil Code at sections 1798.91.04 to 1798.91.06 and was the first US state law aimed specifically at Internet of Things security.

Manufacturers of connected devices sold or offered for sale in California must comply. A connected device is any device or physical object capable of connecting to the internet, directly or indirectly, that has an IP address or Bluetooth address. Manufacturer includes companies that contract others to make devices on their behalf. Devices already subject to federal security requirements are excluded, as are certain activities regulated by health privacy laws.

SB-327 requires a reasonable security feature or features that are appropriate to the device's nature and function, appropriate to the information it collects, contains or transmits, and designed to protect the device and its information from unauthorised access, destruction, use, modification or disclosure. If a device can be authenticated from outside a local area network, the security is deemed reasonable if it has a unique preprogrammed password or makes the user set new credentials before first access.

In effect, yes, for devices that can be authenticated from outside a local area network. Such devices are deemed to have reasonable security if each one ships with a unique preprogrammed password, or if the user must generate a new means of authentication before access is granted for the first time. Shared factory default credentials such as admin and password across every unit do not meet either option.

SB-327 does not set its own penalty amounts and creates no private right of action. Enforcement rests exclusively with the California Attorney General, city attorneys, county counsel and district attorneys. Manufacturers with weak device security may also face action under other consumer protection laws, so documented, reasonable security is the safest position.

SB-327 is a product security law, while ISO 27001 and SOC 2 cover an organisation's information security management and controls. They overlap where secure development, configuration management and authentication controls apply to the devices you build. Mapping SB-327 to your existing ISO 27001 or SOC 2 controls lets you reuse evidence, but neither certification on its own proves your devices meet the law.

No. The law does not impose duties on manufacturers for unaffiliated third-party software or applications that a user chooses to add to a device. It also places no duty on app store or software marketplace providers to review or enforce compliance, and does not require manufacturers to stop users from having full control over their own devices, including modifying software or firmware.

SB-327 is mapped in OneClickComply's control library and available on request. We map its security feature and default authenticator duties to controls you may already operate for ISO 27001 or SOC 2, collect supporting evidence from connected tools and provide expert guidance from our in-house audit team. OneClickComply does not certify devices or guarantee compliance, but helps you document reasonable security.