UL 2900-1

Why does it matter?

UL 2900-1 is the evaluation standard a laboratory applies to the software of a connected product, so it determines what a manufacturer must be able to show before a test program starts: a documented risk management process for the product (clause 1.2(a)), a product that can be tested for vulnerabilities, software weaknesses and malware (clause 1.2(b)) and security risk controls present in the architecture and design (clause 1.2(c)). Because clause 1.3 excludes functional testing and clause 1.4 excludes hardware, the standard concentrates on software and on the vendor's process, which is where most product cybersecurity findings originate. Part 2 standards for healthcare and for security and life safety signaling build on it.

Key benefits include:

• A fixed scope

Clause 1.1 names the subject: network-connectable products that shall be evaluated and tested for vulnerabilities, software weaknesses and malware.

• Process and product together

Clause 1.2 pairs requirements on the vendor's risk management process with test methods for the product and controls in its design.

• Supply chain included

Clause 1.2(a) applies to the software developer whether it is the vendor or another supply chain member, so component suppliers are inside the standard.

• Clear exclusions

Clauses 1.3 and 1.4 keep functional testing and hardware out, which lets a cybersecurity evaluation run beside, not instead of, safety testing.

• A maintained binational standard

Edition 2 of December 13, 2023 carries a June 29, 2026 revision approved by ANSI and SCC on the same date, with a further CSDS proposal open since March 13, 2026.

How does it work?

The standard describes three subjects (clause 1.2). The first is the software developer's risk management process for the product: the vendor, or another supply chain member that develops the software, documents how it identifies, assesses and treats the security risks of the product. The second is the evaluation and testing of the product for the presence of vulnerabilities, software weaknesses and malware, the work a testing laboratory performs against the product as delivered. The third is the presence of security risk controls in the architecture and design of the product, which the evaluation checks for rather than designs. Clause 1.1 ties all three to network-connectable products.

ULSE maintains the standard under continuous maintenance, which means new work may already be in progress when a revision is published. Edition 1 is archived. Edition 2 was published on December 13, 2023; its revision dated June 29, 2026 incorporated inclusive language and amended definitions 3.22 and 3.28, and was approved by ANSI and by the Standards Council of Canada on June 29, 2026, hence the ANSI/CAN/UL designation. The catalog page shows a Collaborative Standards Development System (CSDS) proposal dated March 13, 2026, redline editions of the revision, and the standard available in English and French at a list price of $402.00 to $998.00.

Part 1 supplies the general requirements and the Part 2 standards add particular requirements for a product family. UL 2900-2-1 (published September 1, 2017, last revised September 21, 2023) applies to the testing of network connectable components of healthcare systems; UL 2900-2-3 (published January 31, 2020, last revised September 21, 2023) applies to the evaluation of security and life safety signaling system components and, in its clause 1.3, adds a list of security controls the product or vendor shall meet unless the vendor's risk assessment shows the omission is acceptable. ULSE writes the standards; UL Solutions, a separate company, offers testing and certification services based on the UL 2900 series.

Key Elements

• Scope (clause 1.1)

Network-connectable products that shall be evaluated and tested for vulnerabilities, software weaknesses and malware.

• Vendor risk management process (clause 1.2(a))

Requirements regarding the software developer's risk management process for the product, whether the developer is the vendor or another supply chain member.

• Evaluation and test methods (clause 1.2(b))

Methods by which a product shall be evaluated and tested for the presence of vulnerabilities, software weaknesses and malware.

• Security risk controls in design (clause 1.2(c))

Requirements regarding the presence of security risk controls in the architecture and design of a product.

• Exclusions (clauses 1.3 and 1.4)

No requirements regarding functional testing of a product, and no requirements regarding the hardware contained in a product.

• Edition and designation

ANSI/CAN/UL 2900-1, Edition 2, published December 13, 2023, revised June 29, 2026 (inclusive language; definitions 3.22 and 3.28), ANSI and SCC approved June 29, 2026.

What does it cover?

UL 2900-1 applies to network-connectable products that are to be evaluated and tested for vulnerabilities, software weaknesses and malware (clause 1.1), and to the software developer's risk management process for such a product (clause 1.2(a)). It does not contain requirements regarding functional testing (clause 1.3) or the hardware contained in a product (clause 1.4). ULSE's catalog records it as referenced by UL 2900-2-3, UL 2800-1-1, UL 338, UL 1699 and UL 1400-1, and the Part 2 standards (UL 2900-2-1 for healthcare and wellness components; UL 2900-2-3 for security and life safety signaling systems) add the particular requirements. The standard is published in the United States and Canada and sold under a paid ULSE license.

What are its objectives?

The scope clauses set the outcomes the standard exists to produce.

Products that have been evaluated and tested for vulnerabilities, software weaknesses and malware before they reach the network (clause 1.1).

A documented risk management process on the vendor's side, extending to any other supply chain member that develops the software (clause 1.2(a)).

Repeatable methods for evaluating and testing a product for the presence of vulnerabilities, software weaknesses and malware (clause 1.2(b)).

Security risk controls that are present in the architecture and design of the product, not added after the fact (clause 1.2(c)).

A clear boundary with functional and hardware testing (clauses 1.3 and 1.4), so a cybersecurity evaluation complements safety evaluation.

Framework in Context

UL 2900-1 is a product-evaluation standard rather than a management-system standard, so it is usually paired with an organization-level framework for the information security program (ISO/IEC 27001 or the NIST Cybersecurity Framework in the mapping list below) and with sector standards for the product family: the IEC 62443 series for industrial automation and control system components, and the UL 2900 Part 2 standards for healthcare components and for security and life safety signaling systems. The vendor risk management process in clause 1.2(a) is where those organization-level controls meet the product, and the test methods in clause 1.2(b) supply the evidence that product-security regulators and buyers ask for. ULSE publishes the standard; UL Solutions and other laboratories perform the evaluations.

Common Framework Mappings

Organizations map UL 2900-1's process, test and design requirements to the frameworks below so that one risk register and one body of test evidence serve the product evaluation, the information security program and customer assessments.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

GDPR

IEC 62443

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2