FCC's New Cyber Trust Mark Aims to Improve Smart Home Security by 2027

Olivia Trusty argues that the Federal Communications Commission's U.S. Cyber Trust Mark will help make security a standard feature of connected homes by next year. Trusty says consumers currently lack a simple way to assess whether connected cameras, baby monitors and door locks were designed to resist hackers. Trusty describes the voluntary labeling program as a way to help buyers recognize products that satisfy established cybersecurity requirements.

Trusty says qualifying products must protect consumer data, restrict access to authorized users and support secure software updates. Trusty says qualifying devices will also disclose manufacturer support information so consumers can protect themselves without specialist knowledge. Trusty writes that approved products will eventually carry a shield-shaped label indicating compliance with baseline cybersecurity requirements. Trusty says an accompanying QR code will direct buyers to understandable, current security information. Trusty says buyers will be able to find instructions for changing default passwords, locating security updates and checking the manufacturer's promised support period.

Trusty says the FCC is working toward retail availability by next year. Trusty writes that growing cyberattacks and increasingly connected homes have made the program more urgent. Trusty says a typical U.S. household contains approximately 20 to 25 connected devices, all vulnerable to hacking. Trusty puts the daily number of Internet-of-Things-related cyberattacks at close to 1 million.

Trusty says the ioXt Alliance was chosen earlier this year to oversee daily program operations under the commission's 2027 implementation schedule. Trusty describes the alliance as an organization with extensive security experience. Trusty says the FCC will request public comments in the coming months on the label's appearance and use. Trusty says the consultation will also cover technical standards and testing procedures for product eligibility. Trusty says proposed post-market surveillance rules will seek to maintain the label's integrity throughout each qualifying product's life. Trusty welcomes input from manufacturers, retailers, cybersecurity researchers, consumer advocates and other interested parties to refine the program. Trusty says the FCC also aims to achieve the greatest possible participation among manufacturers.

Trusty argues that participating manufacturers will gain a visible way to demonstrate investment in security and distinguish certified products from uncertified competitors. Trusty says retailers and online marketplaces will gain an opportunity to promote certified products. Trusty predicts that the program will create financial incentives to incorporate security during product design rather than after vulnerabilities emerge. However, Trusty cautions that a label cannot guarantee that a product will never be hacked.

Trusty presents the labeling program as one element of the FCC's wider cybersecurity work. Trusty says other FCC initiatives include taking untrustworthy equipment out of U.S. communications networks and strengthening the equipment authorization process. Trusty says the FCC is also increasing transparency about foreign ownership and control of entities operating critical communications systems nationwide. Trusty argues that secure networks depend on trusted equipment sources, resilient infrastructure depends on responsible operators, and connected homes depend on security-conscious product design.

Trusty says the program is not intended to assign cybersecurity responsibility entirely to consumers. Trusty argues that labeling should complement strong passwords, multifactor authentication and security upgrades. Trusty says manufacturers remain expected to follow reasonable cybersecurity practices regardless of participation. Trusty concludes that the program will inform consumers, reward companies that invest in security and increase security expectations throughout the connected-device market.