Key takeaways
- Product Security 1.1, released by CSA on 17 June 2026 alongside Matter 1.6, is the latest version of the Alliance's separate certification program for product security (distinct from Matter protocol conformance itself).
- Decide which Product Security level you actually need, not just which is cheaper.
Matter certification tells a buyer a device passed the Connectivity Standards Alliance's security assessment at the level the manufacturer chose — self-assessment or independent testing — not that the device satisfies any government's product-security law. Matter, the smart-home connectivity standard governed by the CSA with Amazon, Apple, Google and hundreds of other member companies, was built with Public Key Infrastructure-based authentication and encryption as a core design choice rather than an afterthought, and the Alliance's companion Product Security program has just been extended, in its June 2026 1.1 release, to certify whole IoT systems instead of individual devices alone. None of that makes Matter certification equivalent to a legal compliance finding under the CRA, PSTI or the US Cyber Trust Mark.
What security does the Matter protocol actually build in?
Per CSA's own published description of the protocol, every Matter device commissions onto a network using Bluetooth Low Energy — or, as of Matter 1.6, NFC, which lets a device be configured before it is even powered on — and holds a device certificate used for mutual authentication as part of that process. All operational communication has message security enabled; a Secure Channel Protocol governs the control plane for establishing that secure session; and a device proves it is genuinely certified Matter hardware, not merely claiming to be, through a Certification Declaration backed by a Distributed Compliance Ledger. This PKI-centered design is a deliberate architectural choice CSA made early, inviting security experts alongside its founding member companies to select PKI specifically because it could provide the full set of security attributes the Alliance wanted for interoperable smart-home devices — a materially different starting point from legacy OT/IoT protocols such as Modbus, whose base specification has no equivalent security objectives at all.
What is Product Security 1.1, and what does it actually require?
Product Security 1.1, released by CSA on 17 June 2026 alongside Matter 1.6, is the latest version of the Alliance's separate certification program for product security (distinct from Matter protocol conformance itself). The headline change in 1.1 is scope: version 1.0 certified individual devices, while 1.1 certifies complete IoT systems — devices, apps, gateways and remote processes together — reflecting how a real smart-home or connected-device deployment rarely consists of just the device on its own. The program now offers two assurance levels:
| Level | What it requires |
|---|---|
| Level 1 | Supplier self-assessment, reviewed by an Authorized Test Laboratory (ATL) |
| Level 2 | Independent assessment and functional testing conducted directly by an ATL |
CSA's own announcement lists the underlying security requirements a certified product (or system) must meet, including: a unique password per device rather than a shared default, brute-force-attack protections, keeping critical security parameters such as cryptographic keys out of source code, use of industry-standard cryptography, a way for a user to erase their data from the device, removal of unnecessary test and debug interfaces, input validation, removal of unneeded code, and secure-boot and verified-update practices. CSA also states the revised specification was built with an eye toward cybersecurity requirements relevant to the EU Radio Equipment Directive's harmonized standards and the Singapore Cybersecurity Labelling Scheme — alignment with those frameworks' technical content, not a claim of legal equivalence to either.
Does Matter or Product Security certification satisfy the CRA, PSTI or the US Cyber Trust Mark?
Not on its own. CSA's framing is that Product Security 1.1 is "designed to help manufacturers navigate increasingly fragmented regulatory landscapes" — a compliance aid, not a substitute for meeting any specific regime directly. The Cyber Resilience Act, the UK's PSTI regime and the voluntary US Cyber Trust Mark (built on NIST IR 8425 and certified through the FCC's own labelling program) each have their own legal scope, enforcing authority, and required evidence, none of which is "holds a Matter Product Security certificate." A manufacturer shipping a Matter-certified product into the EU, UK or US still has to run its own CRA technical documentation, PSTI Schedule 1 compliance statement, or Cyber Trust Mark application separately — Product Security 1.1's overlap with RED harmonized standards and Singapore's labelling scheme can reduce duplicate work, but it does not replace the filing.
What changed in Matter 1.6?
Released the same day as Product Security 1.1, Matter 1.6 added: NFC-based commissioning, letting a device be set up by tapping before it is fully powered on (useful for pre-installation configuration of light fixtures or switches); Joint Fabric, a multi-admin capability letting multiple user-authorized controllers jointly administer one shared Matter network — aimed at scenarios like new-construction handovers or households running more than one smart-home ecosystem — while counting as a single fabric allocation on the device; and partitioned Certificate Revocation Lists, splitting revocation data into smaller, independently updatable chunks rather than one large list, to keep certificate-chain checks scalable as the number of certified Matter devices grows.
What should a device maker building on Matter actually check?
Decide which Product Security level you actually need, not just which is cheaper. Level 1 self-assessment with ATL review may satisfy a baseline retailer requirement; a buyer or regulator asking for independent evidence will want Level 2's direct ATL testing. Don't stop at protocol certificationA Matter or Product Security certificate covers what CSA's program tests — it says nothing about vulnerabilities in the rest of your firmware image, the open-source Matter SDK version you built against, or components unrelated to the Matter stack itself. Track the open-source components your Matter implementation is built on, the same way you would for any other firmware dependency — most commercial and hobbyist Matter devices are built on the open-source connectedhomeip SDK or a vendor fork of it, and that code has its own version history and disclosed issues to track in your SBOM. Map certification evidence to the specific legal regime you're selling into, rather than assuming one certificate travels across CRA, PSTI, Cyber Trust Mark and RED/EN 18031 filings interchangeably.
SoftWSP's device firmware security work unpacks the full firmware image — including a device's Matter/connectedhomeip stack and any other open-source components — builds a software bill of materials, matches it against published vulnerabilities, and lists any embedded AI models, inference runtimes or API keys separately in an AI-BOM: see Device & Firmware Security for what that scan actually covers.
Dates, requirement details and quotations above are drawn directly from the Connectivity Standards Alliance's own 17 June 2026 Product Security 1.1 and Matter 1.6 newsroom pages and its Matter protocol overview page. This guide is general information, not a substitute for the CSA's own certification program documentation or a specific national regulator's current requirements.
Sources
- Connectivity Standards Alliance: Product Security 1.1 — The Next Level of IoT Trust (17 June 2026)
- Connectivity Standards Alliance: Matter 1.6 Enables More Intuitive Setup, Multi-Ecosystem Experiences and Context-Driven Control (17 June 2026)
- Connectivity Standards Alliance: Build With Matter (protocol overview)
Frequently asked questions
Does the Matter protocol have security built in, or is it added on top?
Built in, by design. Matter is governed by the Connectivity Standards Alliance (CSA), and when CSA developed the protocol with Amazon, Apple, Google and other members, it selected Public Key Infrastructure as the mechanism for device identity, commissioning and message security rather than treating encryption as an optional add-on. Devices commission onto a Matter network over Bluetooth Low Energy (or, since Matter 1.6, NFC before the device is even powered on), each device holds a certificate used for mutual authentication, all operational communication has message security enabled by default, and a Distributed Compliance Ledger backs the certification attestation a device presents to prove it is genuinely Matter-certified hardware, not a device merely claiming to be.
What is Product Security 1.1, and how is it different from version 1.0?
Product Security 1.0 certified individual Matter devices against a baseline set of security requirements. Product Security 1.1, released by the Connectivity Standards Alliance on 17 June 2026 alongside Matter 1.6, expands the program to certify complete IoT systems — covering IoT Devices, IoT Apps, IoT Remote Processes and IoT Gateways together, not just the device on its own — and introduces two certification levels: Level 1, a supplier self-assessment reviewed by an Authorized Test Laboratory (ATL), and Level 2, an independent assessment and functional testing conducted directly by an ATL.
What does Product Security 1.1 actually require of a certified product?
Per CSA's own announcement, requirements include a unique password per device (not a shared default), brute-force-attack protections, keeping critical security parameters such as keys out of source code, use of industry-standard (not proprietary or deprecated) cryptography, a way to remove user data from the device, elimination of unnecessary test/debug interfaces, input validation, removal of unneeded code, and secure-boot and verified-update recommendations. CSA states the updated specification was also built to address cybersecurity requirements relevant to the EU Radio Equipment Directive's harmonized standards and the Singapore Cybersecurity Labelling Scheme.
Does Matter or Product Security certification mean a device meets the CRA, PSTI or the US Cyber Trust Mark?
No — certification is evidence a manufacturer can use toward those regimes, not a substitute for meeting them directly. CSA describes Product Security 1.1 as designed to help manufacturers navigate requirements that overlap with the EU RED's harmonized standards and Singapore's labelling scheme, but the Cyber Resilience Act, the UK's PSTI regime and the US Cyber Trust Mark are each a separate legal or certification framework with their own scope, authority and evidence requirements — see this site's guides to the [Cyber Resilience Act](/guides/cyber-resilience-act/), [EN 18031](/guides/en-18031/) and [UK PSTI and the US Cyber Trust Mark](/guides/psti-cyber-trust-mark/). A manufacturer shipping a Matter-certified device into any of those markets still has to confirm its own compliance against that regime's actual legal text, not assume Matter certification already covers it.
What changed in Matter 1.6, released alongside Product Security 1.1?
Matter 1.6, published 17 June 2026, added NFC-based commissioning that lets a device be configured before it is fully powered on; Joint Fabric, a multi-admin feature letting multiple user-authorized controllers co-administer a single shared Matter network (aimed at scenarios like new-construction handovers or households running more than one smart-home platform); and partitioned Certificate Revocation Lists, which split certificate-revocation data into smaller, independently updatable chunks instead of one large list, intended to keep certificate-infrastructure checks scalable as the number of certified devices grows.
In this cluster
