The test includes:

1. Protected Privacy IoT Service

   TÜV Rheinland evaluates IoT services to determine whether they comply with good practices regarding personal data protection. The IoT service being evaluated refers to back-end services that support client products.

   For the tests, TÜV Rheinland has defined a catalogue of requirements. During the audit, TÜV Rheinland checks if the service provider complies with these requirements. The catalogue of requirements is based on security experience and best practices, including legal compliance assessment for  Mainland China, technical verification, and management assessment. Meanwhile, the catalogue of requirements refers to relevant regulations and standards.

   The requirements span across different topics. This includes among others the network architecture of the service, data processing of personal information, incident management, and access management.

   The service is tested with help of on-site audits and document reviews. In addition, TÜV Rheinland performs a penetration test with a focus on the external facing components of the service. The execution of a penetration test does not necessarily imply that the service is 100% secure. It only reduces the probability that a service contains exploitable vulnerabilities.

   The use of the keyword "Protected Privacy IoT Service" confirms that the service satisfies TÜV Rheinland's requirements.