Senate Bill No. 327, signed September 28 by California Governor
Jerry Brown, will go into effect January 1, 2020. While the law
might be a great first step in the right direction to regulate a
rapidly growing industry and improve the security of IoT, it is
short on details as to the type of security features that are
expected.
The law will require manufacturers of connected devices (defined
as "any device, or other physical object that is capable of
connecting to the Internet, directly or indirectly, and that is
assigned an Internet Protocol address or Bluetooth address")
to equip such devices with a "reasonable" security
feature(s) that is appropriate to the nature and function of such
device and the information that it may collect, contain or
transmit. The security feature(s) must protect the device and any
personal information it contains from unauthorized access,
destruction, use, modification or disclosure. The law will apply to
manufacturers of connected
