UL 2900-1 (2017)

UL 2900-1:2017 is the general part of the UL 2900 series of cybersecurity standards published by UL (now UL Solutions). It sets out general cybersecurity requirements for network-connectable products, defining methods for testing software weaknesses, assessing known vulnerabilities and evaluating the presence of security controls and risk management measures.

The standard combines structured testing (including software weakness analysis, known vulnerability scanning and fuzz or malformed input testing) with requirements for security controls and documentation. It serves as the foundation for product specific parts of the series, such as those addressing medical devices and industrial control systems, and underpins UL's Cybersecurity Assurance Program.