Information Security Testing

Blue Asia Labs provides information security evaluation for connected products — vulnerability assessment, penetration testing and data protection compliance — aligned with EU RED cybersecurity requirements and industry security baselines.

Capability & Accreditation Scope

Test Object	Reference Standard	Scope & Accreditation
IoT device security	EN 303 645	Consumer IoT security scope
IT products	GB/T 22239 (classified protection)	Security evaluation scope
Security assessments	ISO/IEC 15408 (Common Criteria)	CC-style evaluation support

What is Information Security Testing?

Connected products are now regulated as well as tested. The EU RED delegated acts require network protection and privacy safeguards, while customers increasingly ask for evidence of security testing. Our lab provides both assessment and remediation guidance.

Testing Scope

Item	Details
Vulnerability assessment	Automated and manual scanning of firmware, ports and services
Penetration testing	Simulated attack on device interfaces, cloud APIs and mobile apps
RED cybersecurity readiness	Article 3(3)(d)(e) assessment: no harm to network, privacy protection
Secure boot & update	Secure boot, signed firmware update and key storage evaluation
Data protection	Personal data collection, storage and transmission compliance review
Security hardening	Remediation guidance for identified vulnerabilities

Certification Process

Scope & threat model — Define the attack surface and threat model with your engineering team.
Assessment — Vulnerability scanning and targeted penetration testing.
Risk report — Risk-rated findings with CVSS scoring and remediation priorities.
Re-verification — Fix verification and final compliance statement.

Frequently Asked Questions

Do you support RED Article 3(3) compliance?

Yes. We assess network protection and privacy provisions applicable from August 2025 and provide the compliance evidence package.

What deliverables do we receive?

A risk-rated vulnerability report with reproduction steps, remediation guidance, and a re-verification statement after fixes.

Do you test the cloud side?

Yes. Cloud API and mobile app security testing can be included in the engagement.

How long does an assessment take?

Typical engagements run 2–4 weeks depending on product complexity.

Need a project-specific quotation? Request a free quote and our engineers will respond within one business day.