PSTI Scope Classification

LinkedIn Post 5: PSTI Scope Classification

Does your mechanical thermostat fall under PSTI? What about the legacy BMS system installed in 2020? The sensor that collects only temperature data?

The UK PSTI Act is silent on scope for building-embedded devices.

You need to classify each networked device in your buildings and document whether it falls in or out of PSTI scope:

1. Is it networked?

2. Is it subject to another regulatory regime?

3. Does it process sensitive data?

4. Is it remotely managed or updated?

If the answer is unclear, document the question and consult legal counsel.

When a regulator asks, you need a clear answer for every device. "We're not sure" is not a defensible position.

Create a device inventory. Classify each one. Document your decisions.