UL Standards & Engagement Software Cybersecurity for Network-Connectable Products, Part 2-3: Particular Requirements for Security and Life Safety Signaling Systems UL 2900-2-3

1.1 This security evaluation standard applies to the evaluation of security and life safety signaling system components. It applies to, but is not limited to, the following products:

1. a) Alarm Control Units;
2. b) Network-Based Intrusion Detection System;
3. c) General Purpose Signaling Units;
4. d) Digital Video Equipment and Systems;
5. e) Mass Notification and Emergency Communication / Evacuation Equipment and Systems;
6. f) Control servers;
7. g) Alarm Automation System Software;
8. h) Alarm Receiving Equipment;
9. i) Anti-Theft Equipment;
10. j) Automated Teller Machines;
11. k) Fire Alarm Control Systems;
12. l) Network Connected Locking Devices;
13. m) Physical Security Information Management (PSIM) Systems;
14. n) Smoke Control Systems;
15. o) Smoke / Gas / CO Detection Devices;
16. p) Audible and Visual Signaling Devices (fire and general signaling);
17. q) Access Control Equipment and Systems; and
18. r) Smart Locks.

1.2 This standard does not contain general requirements that are intended to address functional testing of the product unless expressly specified.

1.3 This standard also describes requirements for the product risk management process carried out by the vendor of the product, including a list of security controls that the product (or the vendor, as applicable) shall comply with unless a risk assessment done by the vendor shows that the risk of not implementing one of these security controls is acceptable.

1.1 This security evaluation standard applies to the evaluation of security and life safety signaling system components. It applies to, but is not limited to, the following products:

1. a) Alarm Control Units;
2. b) Network-Based Intrusion Detection System;
3. c) General Purpose Signaling Units;
4. d) Digital Video Equipment and Systems;
5. e) Mass Notification and Emergency Communication / Evacuation Equipment and Systems;
6. f) Control servers;
7. g) Alarm Automation System Software;
8. h) Alarm Receiving Equipment;
9. i) Anti-Theft Equipment;
10. j) Automated Teller Machines;
11. k) Fire Alarm Control Systems;
12. l) Network Connected Locking Devices;
13. m) Physical Security Information Management (PSIM) Systems;
14. n) Smoke Control Systems;
15. o) Smoke / Gas / CO Detection Devices;
16. p) Audible and Visual Signaling Devices (fire and general signaling);
17. q) Access Control Equipment and Systems; and
18. r) Smart Locks.

1.2 This standard does not contain general requirements that are intended to address functional testing of the product unless expressly specified.

1.3 This standard also describes requirements for the product risk management process carried out by the vendor of the product, including a list of security controls that the product (or the vendor, as applicable) shall comply with unless a risk assessment done by the vendor shows that the risk of not implementing one of these security controls is acceptable.