US Cyber Trust Mark

The U.S. Cyber Trust Mark is the FCC’s voluntary cybersecurity labeling program for wireless consumer IoT products. A compliant product carries the mark plus a QR code linking to a public registry of security facts about the product: support-period end date, patch automation, default-password handling, SBOM/HBOM disclosure. The FCC adopted the framework rules in March 2024 (47 CFR Part 8 Subpart B); the program is built largely on NIST criteria and run through third-party administrators under FCC oversight.¹²

The requirement stack

Two documents do most of the work, and they bind in different ways.

NISTIR 8425, Profile of the IoT Core Baseline for Consumer IoT Products (September 2022) defines what baseline cybersecurity means for consumer IoT: technical device capabilities carried over from the IoT core baseline plus four non-technical supporting capabilities the developer performs — Documentation (create, gather, and store cybersecurity information across the product lifecycle, including expected lifespan and the length and terms of support), Information and Query Reception (receive cybersecurity information and respond to queries), Information Dissemination (broadcast and distribute that information to the product ecosystem), and Product Education and Awareness (customer education).³

47 CFR Part 8 Subpart B turns those expectations into legal machinery. NISTIR 8425 is not incorporated by reference; it binds through the applicant’s compliance declaration and the label administrator’s review of program requirements built on NIST criteria, and the Lead Administrator must recommend standards updates within 45 days of any NIST guideline change (§8.221).⁴

• §8.208 — application. The applicant declares under penalty of perjury that the product meets program requirements, that every reasonable measure was taken to create a securable product, and — the operative commitment — that until the disclosed support-period end date the applicant will diligently identify critical vulnerabilities and promptly issue software updates correcting them. The support-period end date must be disclosed; the rules set no minimum length.
• §8.215 — records. The grantee retains the original design and specifications plus all compliance-affecting changes, the production inspection and testing procedures, and the compliance test results.
• §8.216 — termination. Authorization is terminated for false statements or representations in the application or in the retained records, for a product later found not to conform, or if the grantee becomes listed under §8.204. The enforcement is legal rather than technical: the support-period promise is a sworn declaration, not a measurable control.
• §8.222 — registry. Eleven data elements are published through a common API behind the QR code, among them the minimum support period end date (or an explicit statement that the device is unsupported and the buyer should not rely on security updates), instructions for changing the default password, whether patches are automatic, and HBOM/SBOM disclosure.

Eligibility and governance

§8.204 bars products from entities on the FCC Covered List, the Commerce Entity List, the DoD list of Chinese military companies, and the SAM debarment list — an eligibility gate in the same family as adversary-software-supply-chain-bans, enforced through the perjury-backed declarations of §8.208(c). Administration is layered: a Lead Administrator (ioXt Alliance, effective April 13, 2026, after UL Solutions withdrew in December 2025), Cybersecurity Label Administrators accredited to ISO/IEC 17065 that accept and review applications, CyberLABs accredited to ISO/IEC 17025 that run conformity testing, and accreditation bodies under ISO/IEC 17011. CLA decisions are appealable to the FCC’s Public Safety and Homeland Security Bureau with de novo review, and the Commission is the final arbiter in disputes.⁵⁶

Status (as of November 2026)

The rule layer is stable; the implementation layer is still moving. The CLA filing window opened August 11, 2026; standards and testing procedures are still being recommended and adopted; and no product applications are being accepted — the FCC will announce when the program is ready for them. A compliant documentation packet therefore targets the stable requirements of Part 8 and treats later public-notice details (label design, surveillance procedures) as provisional.⁷

Scope limits

The program covers consumer wireless IoT products only. Medical devices regulated by the FDA, motor vehicles regulated by NHTSA, wired devices, personal computers, smartphones, and routers are excluded, as are products primarily used for manufacturing, industrial control, or enterprise applications.⁸ That carve-out is worth keeping in view: the internet-exposed commercial refrigeration controllers of refrigeration-cyberattacks-2026 fall precisely inside the excluded industrial slice, so the mark’s support-period disclosures address the consumer half of the same end-of-support problem.

For the attestation-regime comparison: pci-compliance-attestation shares the snapshot-not-a-plan character and the reliance on signed declarations, but PCI’s AOC rides on assessor validation and the card brands’ acceptance, while the Cyber Trust Mark is a CLA-issued authorization backed by the applicant’s own sworn statements. The certification-family neighbor for industrial systems is iec-62443 and its ISASecure schemes, which cover the equipment the mark excludes.

Related

• pci-compliance-attestation — the payment-card attestation regime; declarations plus assessor sign-off rather than a label
• iec-62443 — the IACS certification family covering the industrial scope this program excludes
• adversary-software-supply-chain-bans — supply-chain provenance as procurement and eligibility control
• refrigeration-cyberattacks-2026 — end-of-life internet-exposed controllers as the failure mode support-period disclosure exists to surface

Sources

• Michael Fagan, Katerina Megas, Paul Watrobski, Jeffrey Marron, Barbara Cuthill (NIST) 2022 — Profile of the IoT Core Baseline for Consumer IoT Products
• Federal Communications Commission 2024 — 47 CFR Part 8 Subpart B - Cybersecurity Labeling Program for IoT Products
• Federal Communications Commission 2024 — U.S. Cyber Trust Mark

Footnotes

1. Federal Communications Commission 2024 — 47 CFR Part 8 Subpart B - Cybersecurity Labeling Program for IoT Products ↩

2. Federal Communications Commission 2024 — U.S. Cyber Trust Mark ↩

3. Michael Fagan, Katerina Megas, Paul Watrobski, Jeffrey Marron, Barbara Cuthill (NIST) 2022 — Profile of the IoT Core Baseline for Consumer IoT Products ↩

4. Federal Communications Commission 2024 — 47 CFR Part 8 Subpart B - Cybersecurity Labeling Program for IoT Products ↩

5. Federal Communications Commission 2024 — 47 CFR Part 8 Subpart B - Cybersecurity Labeling Program for IoT Products ↩

6. Federal Communications Commission 2024 — U.S. Cyber Trust Mark ↩

7. Federal Communications Commission 2024 — U.S. Cyber Trust Mark ↩

8. Federal Communications Commission 2024 — U.S. Cyber Trust Mark ↩