1 Scope

1.1 This security evaluation standard applies to the evaluation of security and life safety signaling system components. It applies to, but is not limited to, the following products:

1. a) Alarm Control Units;

2. b) Network-Based Intrusion Detection System;

3. c) General Purpose Signaling Units;

4. d) Digital Video Equipment and Systems;

5. e) Mass Notification and Emergency Communication / Evacuation Equipment and Systems;

6. f) Control servers;

7. g) Alarm Automation System Software;

8. h) Alarm Receiving Equipment;

9. i) Anti-Theft Equipment;

10. j) Automated Teller Machines;

11. k) Fire Alarm Control Systems;

12. l) Network Connected Locking Devices;

13. m) Physical Security Information Management (PSIM) Systems;

14. n) Smoke Control Systems;

15. o) Smoke / Gas / CO Detection Devices;

16. p) Audible and Visual Signaling Devices (fire and general signaling);

17. q) Access Control Equipment and Systems; and

18. r) Smart Locks.

1.2 This standard does not contain general requirements that are intended to address functional testing of the product unless expressly specified.

1.3 This standard also describes requirements for the product risk management process carried out by the vendor of the product, including a list of security controls that the product (or the vendor, as applicable) shall comply with unless a risk assessment done by the vendor shows that the risk of not implementing one of these security controls is acceptable.

Summary of Topics

This revision for ANSI/CAN/UL 2900-2-3 dated, September 21, 2023, includes the following changes in requirements:

– Updates to UL 2900-2-3 Based on Changes to UL 2900-1; Table 5.1 (5.1), Table 8.1 (8.4 and 8.5), Table 13.1 (13.4 and 13.6), Table 14.1, Section 14A, Table 18.1 (Clause 18.3), Table 19.1, Table 20.1 (20.3 – 20.5), and A2