FCC commissioner hopes Cyber Trust Mark products reach shoppers within a year

FCC Commissioner Olivia Trusty said Wednesday she hopes consumers will begin seeing products bearing the U.S. Cyber Trust Mark within the next year, offering a new outlook for the device-security labeling program as officials work to finalize requirements for its rollout.

Speaking at a Consumer Technology Association event, Trusty said the Federal Communications Commission expects to seek public comment on technical requirements and testing procedures in the coming months. The agency on Tuesday opened a separate proceeding covering label design, certification renewal and checks on products after they enter the market.

FCC Chairman Brendan Carr assigned Trusty to oversee implementation of the voluntary program, which is intended to help shoppers compare the cybersecurity protections of connected household products such as cameras, appliances and baby monitors. 

The update is the first in several months to address the program’s status. First envisioned during the Biden administration, the mark is akin to the Energy Star label that helps shoppers identify energy-efficient products.

The timeline for the rollout has seen significant delays. In January 2025, then-White House cyber official Anne Neuberger said officials expected labeled products on shelves that year. But the initiative has also undergone major changes in the second Trump administration. The FCC selected ioXt Alliance as lead administrator in April, after UL Solutions withdrew following an FCC national security review under Carr of its alleged ties to China. 

The label is designed to make security easier to assess before buying a device. A shopper can readily compare a camera’s price and picture quality, Trusty said, but may struggle to determine how well it is protected or how long its manufacturer will provide security updates.

A parent should not have to “become a cybersecurity expert before selecting a baby monitor,” she added.

Products qualifying for the mark would carry a label accompanied by a QR code directing shoppers to security information, including the manufacturer’s support commitment and instructions for securely configuring the device. 

The label can’t guarantee a product will never face a cybersecurity threat, Trusty noted.

Several steps still stand between the program and labeled products reaching store shelves. The FCC must finish its technical requirements and testing procedures, then move ahead with accreditation for the organizations that will test and certify devices, Renee Roland of the agency’s Public Safety and Homeland Security Bureau said on a panel following Trusty’s speech.

Manufacturers can begin preparing now, said Peter Thermos of Palindrome Technologies, a cybersecurity testing company participating in the program. That includes identifying weaknesses in their products and establishing how they will deliver security updates to customers.

Earning the label would bring continuing responsibilities to address vulnerabilities and support those devices, Thermos said, adding "that’s where the responsibility starts."

Grace Burkard, who leads ioXt’s work as administrator, said technical recommendations have recently been published, but the product registry and consumer education effort remain works in progress. Additional working groups are expected in the coming months.

Officials also want shoppers to understand the label’s limits. Certification would not eliminate the need to configure a device securely, Roland said, and the FCC is seeking feedback on how to handle complaints and check that products continue meeting requirements after they go on sale.