US Cyber Trust Mark: IoT Security Labeling Guide
The US Cyber Trust Mark is a voluntary cybersecurity labeling program for consumer Internet of Things (IoT) devices, established by the FCC in partnership with NIST. Similar to the Energy Star label for energy efficiency, the Cyber Trust Mark provides consumers with a recognizable shield logo indicating that a connected device meets baseline cybersecurity standards. The program aims to improve IoT security across the consumer market by creating market incentives for manufacturers to build secure products.
What the Cyber Trust Mark Covers
The program's security requirements are based on NIST's criteria for consumer IoT cybersecurity (NIST IR 8425). Products must demonstrate capabilities across several areas: unique device identification, secure default configuration, software and firmware update capability, strong authentication mechanisms, data protection for both stored and transmitted information, physical and logical access controls, vulnerability and incident logging, and support for vulnerability disclosure.
Products bearing the Cyber Trust Mark include a QR code that consumers can scan to access up-to-date security information about the device, including when the manufacturer will stop providing security updates — bringing unprecedented transparency to consumer IoT security.
Who Should Pursue Cyber Trust Mark
Manufacturers of consumer IoT devices including smart home products (cameras, doorbells, thermostats, speakers), consumer routers, fitness trackers, connected appliances, and other consumer-facing connected devices. While the program is voluntary, major retailers are expected to prioritize Cyber Trust Mark products, creating market pressure for adoption. Products manufactured outside the US can also qualify if they meet the requirements.
Certification Process
Select an FCC-recognized CyberLAB (accredited testing laboratory) to evaluate your product. The lab tests the product against the Cyber Trust Mark criteria and issues a certification report. Submit the certification to the FCC with your application. Upon approval, you receive authorization to display the Cyber Trust Mark shield logo on your product and packaging. Products must be reassessed annually to maintain certification.
Cost Considerations
Certification costs range from $10,000 for simple IoT devices to $75,000 for complex products with multiple communication interfaces and extensive software stacks. Lab testing fees represent the largest cost component. Manufacturers producing multiple product lines should budget per-product certification costs. The business case is driven by retail channel requirements and growing consumer awareness of IoT security risks.