Cybersecurity Policy Report, FCC Establishes U.S. Cyber Trust Mark Program, (Mar 15, 2024)

By Lynn Stanton

The FCC yesterday unanimously established a voluntary cybersecurity labeling program for wireless smart devices, aimed at helping consumers make informed purchasing decisions and creating incentives for manufacturers to offer secure products.

The program will initially be for wireless consumer Internet of things (IoT) products, such as “home security cameras, voice-activated shopping devices, internet-connected appliances, fitness trackers, garage door openers, and baby monitors,” the FCC said in a news release.

While participation in the program is voluntary, devices must meet program standards, which will be based on the National Institute of Standards and Technology’s Profile of the IoT Core Baseline for Consumer Products (NISTIR 8425), if they want to put the U.S. Cyber Trust Mark on their products.

Manufacturers will have to file an application to use the U.S. Cyber Trust Mark, “supported by testing report from an accredited and recognized testing lab,” Tara Shostek, an attorney adviser in the Cybersecurity and Communications Reliability Division of the Public Safety and Homeland Security Bureau, said while presenting the item at the FCC’s meeting.

Along with the trust mark, devices will carry a QR code that consumers can scan to get information about the device’s cybersecurity features and compliance, such as how long it will be supported by security updates and whether updates will be automatically delivered.

Along with the report and order adopted in PS docket 23-239, the Commission adopted a further notice of proposed rulemaking seeking comment on whether to require disclosure by the manufacturer of “whether the software or firmware is developed or deployed by a company located in a high-risk country and whether to require manufacturers to disclose whether data collected by the product would be sent to servers located in high-risk countries,” Ms. Shostek said.

Commissioner Brendan Carr thanked Chairwoman Jessica Rosenworcel “for all her work in getting this across the finish line” and Commissioner Nathan Simington “for his thought leadership.”

Commissioner Geoffrey Starks said, “I strongly support the Order we adopt today, and believe the item strikes an appropriate balance between a voluntary program that entices manufacturers and retailers to participate with teeth to protect consumers. I particularly would like to thank Chairwoman Rosenworcel for her leadership and for supporting my ideas to properly scope the Cyber Trust Mark. As I signaled when we considered the Notice, I believed then that the proper scope for the Cyber Trust Mark needed to be ‘products,’ not ‘devices.’ The Order we adopt today adhered to that policy cut, and I believe gets it right that the best frame for the Cyber Trust Mark is IoT products.”

He continued, “Second, I maintain that it is imperative that we do not place our stamp of approval on devices from products that any branch of the United States government and our allies have identified as part of a national security review. I’m very happy that the Order keeps that policy as well, excluding from the Cyber Trust Mark equipment produced by any entity on our Covered List, the Department of Commerce’s Entity List, and the Department of Defense’s List of Chinese Military Companies. I’m also very happy that this prohibition applies to Cybersecurity Label Administrators and CyberLABs participating in the Cyber Trust Mark.”

Commissioner Starks added, “I thank the Chairwoman for agreeing to language in the Order to make clear that the Lead Administrator should ensure that the Cyber Trust Mark standards are dynamic and updated when NIST adopts additional recommendations for routers, cloud, and other aspects of the IoT ecosystem that it is currently considering. Making it clear that our standards are not stagnant will ensure that consumers are protected as technology and manufacturers innovate.”

Commissioner Simington said, “Importantly this program is optional. The IoT market is incredibly dynamic and young. The risk of inadvertently stifling it with overregulation is real, so instead of imposing mandatory rules we are setting a high mark for products to earn the right to use the cyber trust mark.” He added, “I hope consumers and businesses and their insurers begin to insist products they buy bear this mark.”

Commissioner Anna Gomez said, “This order establishes a great program for consumers, and I believe in empowering consumers with information, so I am happy to support it. I also think that making this a voluntary program strikes the right balance to encourage industry and manufacturer participation, which is critical for its success. This is a great example of a public-private partnership in service of the greater public good.”

She thanked the Chairwoman “for incorporating our edits about the program also being accessible in multiple languages and for your visionary leadership in launching it.”

Chairwoman Rosenworcel said, “We are building the Cyber Trust Mark program on the well-known cybersecurity criteria developed by NIST. We are also building this effort on the existing model we have at this agency for authorization of devices using radio frequency. So we have both a framework for standards and a framework for execution. Now to get it done, we are going to need expert partners. We will select third-party administrators, including a Lead Administrator, through a rigorous selection process that will work with us on the day-to-day details of the program. The administrators selected will be responsible for receiving and reviewing applications from manufacturers to use the Cyber Trust Mark.”

In a joint statement, the Association of Home Appliance Manufacturers, the Connectivity Standards Alliance, the Consumer Technology Association, CTIA, the National Electrical Manufacturers Association, and USTelecom said, “We congratulate the Chairwoman and the FCC on today’s action to initiate a voluntary cybersecurity labeling program for ‘wireless-enabled consumer IoT devices.’ Enhancing cybersecurity is a shared goal between the public and private sectors, and empowering consumers with knowledge can play a vital role. We look forward to our continued collaboration with the Commission to enable consumers to make informed purchasing decisions.”

News: FederalLegislation DataSecurity DataPrivacy