Signal path
One product, a fixed catalogue, and a report that separates what was observed from what the lab is willing to recommend. The work is independent product assurance. It is not official certification and it is not a Cyber Resilience Act conformity assessment.
On the bench
The hardware sits on the bench. Traffic is captured at the router. The catalogue is then applied, and the report is what leaves the lab.
Sequence
Scoping is part of the work, not a formality. The recommendation is only as wide as the decision you named and the unit the lab had.
You describe the product, the ecosystem around it, and the decision the report must serve: ship, source, or deploy. The lab confirms what is in the box and what will not be tested.
One unit, the companion app, a hub if the product needs one, a test account you control, and any supplier documents you already have.
The 22 cases. A case is marked N/A only when the architecture makes it inapplicable. Observations are kept with the evidence that supports them.
A 2-page decision summary, a 10–15 page technical report, and machine-readable results. The recommendation is one of the four statements below.
After you remediate, a shorter pass over the cases that failed or were inconclusive, and an updated summary.
From you
Not this engagement
Specimen
This is the structure of the documents, not a result. There is no client, no product, and no verdict in the example beyond the stamp, which shows where a recommendation sits. Bracketed text is a slot the real report fills.
Example — not a completed assessment
iottest.nu · decision summary
Proceed with conditions
The stamp is the shape of a recommendation. This page is not a result, and it is not official certification.
One record per case. JSON is the default file. The record does not include a combined score, because the lab does not produce one.
{
"product": "[name supplied by the client]",
"decision": "ship | source | deploy",
"recommendation": "Proceed | Proceed with conditions | Do not proceed pending remediation | Insufficient evidence",
"cases": [
{
"id": "SEC-01",
"title": "Network exposure",
"verdict": "Pass | Fail | N/A | Not Tested | Inconclusive",
"observation": "[what was seen]",
"evidence": ["[reference]"],
"limitations": ["[what bounds this result]"]
}
]
}Vocabulary
Decision summary, Technical report, Machine-readable results — and the lists below. A Proceed recommendation covers this catalogue, the decision in the scope, and the unit tested. It is not a statement that the product is secure in general.