Cyber Trust Mark: FCC proposes label and renewal rules

Hugues Orgitelloupdated 28 Oct 20267 min read

On 27 October 2026 the FCC's Public Safety and Homeland Security Bureau released Public Notice DA 26-1162 in PS Docket No. 23-239. It seeks comment on the recommendations the first Lead Administrator filed in June 2025 on the design of the FCC IoT Label, the product registry, certification renewal and post-market surveillance, and it attaches proposed rules for 47 CFR part 8. The Bureau proposes to adopt most of the recommendations with changes, including a three-year renewal cycle instead of the five years the stakeholders recommended. These are proposals: the voluntary US Cyber Trust Mark programme still accepts no product applications, and the technical requirements will be put out for comment in a later public notice.

In short:

Label: the FCC IoT Label (Cyber Trust Mark plus QR code) would be at least 1 inch by 2 inches, printed on the packaging or applied as an adhesive label, and also included in the online and physical product documentation.
Cyber nutrition label: the information behind the QR code would be in English and Spanish and would disclose camera/video, audio and location capability. Whether an HBOM or SBOM is maintained would stay on the first layer.
Renewal: every three years, with the application filed at least 90 calendar days before expiry and the CLA deciding within 90 calendar days.
Surveillance: each CLA would sample at least 3% of the products it certified or renewed in the prior calendar year, and grantees would have to supply samples within 30 days of a request.
Dates: comments are due 30 days, and reply comments 45 days, after publication in the Federal Register, which had not happened on 28 October 2026.

Where the programme stands

FCC 24-26 (March 2024) tasked the Lead Administrator with recommending, among other things, the technical requirements for at least one class of products, the renewal frequency, post-market surveillance procedures, registry updates and the label design (47 CFR 8.221(a)(4)). The notice records that UL Solutions, then Lead Administrator, filed those recommendations in June 2025 before withdrawing, and that the Bureau selected the ioXt Alliance as the new Lead Administrator in April 2026. DA 26-1162 puts out for comment the label, renewal and surveillance recommendations from June 2025. The notice adds that ioXt submitted additional technical recommendations on 26 October 2026 (a "2026 National Label Profile, version 3.0") and that the Bureau will seek comment on both sets of technical requirements in a subsequent public notice.

The proposed label

Topic	Proposal in DA 26-1162
Placement	On the packaging, printed or as an adhesive label (proposed § 8.223(a)); a hang tag or placard could be used where products are displayed without packaging
Minimum size	1 inch by 2 inches for the Cyber Trust Mark and QR code (proposed § 8.223(b))
Layout	Horizontal or vertical layout as specified in CTA-2120, with a "Bounding Box"
Minimum font size	4 point proposed; comment sought on 5 point, the figure in CTA-2120
QR code	ISO/IEC 18004, 21 x 21 to 177 x 177 modules (no micro QR), modules of at least 0.254 mm, a four-module quiet zone; print quality per ISO/IEC 15415
Documentation	Label also in the online and physical documentation, for example the user guide (proposed § 8.223(e))
Marketing	Use of the Cyber Trust Mark in marketing and advertising allowed; comment sought on whether the QR code must then appear too

The Label Standard proposes three smaller options for products that cannot fit 1 by 2 inches: a 1 by 1 inch label with the shield logo but no "U.S. Cyber Trust Mark" text, a ⅝ by ⅝ inch label with the logo inside a QR code frame, or only the logo and a URL where no single flat surface exists. The Bureau does not propose them as such. It notes that FCC 24-26 requires products bearing the FCC IoT Label to carry the corresponding QR code, and asks whether options without a QR code conflict with the rules, or whether small products should instead show the full label on display collateral. It also asks whether a printed URL alongside the QR code is compatible with FCC 24-26. The Bureau does not propose to incorporate CTA-2120 by reference in its entirety.

The cyber nutrition label and the registry

The QR code leads to a two-layer page modelled on CTA-2120: layer 1 for consumers, layer 2 for technical readers. The Bureau proposes:

Languages: English and Spanish (proposed § 8.222(a) and § 8.223(d)), including translated text on any manufacturer website the label links to, with accessibility best practices and text-to-speech support.
Sensors: a new registry element disclosing camera/video capability, audio capability and location determination (proposed § 8.222(b)(11)). Comment is sought on adding physiological and biometric data.
HBOM and SBOM: CTA-2120 places the disclosure on layer 2; the Bureau proposes to keep it on layer 1, with the other required elements.
Support period: the "Security Updates" heading would become "Support Period", showing the end date as "At least until" a given date.
External links: none, except where needed to explain how to configure the device securely.
Lapsed certification: the page would be replaced by a notice that the product "does not have a valid U.S. Cyber Trust Mark certification", with the reason (failure to renew, withdrawal, inclusion on the Covered List).

Renewal

The stakeholders recommended renewal every five years, while noting that three years is typical of many cybersecurity certification programmes in use worldwide. The Bureau is concerned that five years does not keep pace with IoT threats and proposes three (proposed § 8.224(a)). It asks whether some products or product classes warrant a different period.

Step	Recommendation (June 2025)	Bureau proposal
Cycle	5 years	3 years
Filing	At least 6 months before expiry, plus a 6-month grace period	At least 90 calendar days before expiry; CLA decides within 90 calendar days
Re-evaluation by the CLA	All new or revised requirements, plus at least 50% of all applicable requirements	All new or revised requirements, plus at least 70% of the others, 100% if one non-compliance is found

The Bureau also proposes that the grantee file, with the renewal, a CyberLAB test report covering the new or revised requirements and 70% of the others, and that a certification terminate automatically on its expiry date if renewal was not filed in time. The renewal application would include the dates of each earlier authorisation, the authorising CLA, a description of changes since the last evaluation and all prior documents, CyberLAB reports included. The CLA would track due dates and remind grantees, but a missed reminder would not excuse a late filing.

The Bureau also proposes to adopt the recommended "USCTM Qualified Professional": a person each grantee designates, who completes an approved course and exam, repeats them every three years and identifies product changes that may affect compliance. If that person leaves, the grantee notifies the CLA; the recommendation gives six months to fill the role, and the Bureau asks what the period should be.

Post-market surveillance

CLAs would run surveillance under ISO/IEC 17065 on the basis of a written Sample Test Plan, which the Bureau proposes be submitted each September to the Lead Administrator for approval. The main points, from the recommendations and the Bureau's changes to them:

at least 3% of the products a CLA certified or renewed in the previous calendar year, selected from the current and previous two calendar years, each product audited at most once per three-year cycle unless the Bureau asks;
grantees keep production samples available until the end of the support period shown in the registry or at least one year after the last production date, whichever is later;
failure to provide a sample within 30 days may lead to withdrawal of the authorisation to use the Mark, and a statement that the product is no longer made or sold in the US is not a valid excuse;
the sample comes from the latest production, and testing is done in a CLA-run lab or a recognised CyberLAB, never in the manufacturer's in-house lab;
ad-hoc surveillance after a "large cyber event", which the Bureau could initiate.

What happens next

The comment and reply deadlines run from publication in the Federal Register. After the comment cycle the Bureau may adopt rules, with or without changes; FCC 24-26 delegated that authority to it, subject to the required notice and comment. Separately, CLAs can only start authorising use of the label once they meet the conditions for full approval, including the Trademark Use Agreement, and the technical requirements themselves have not yet been put out for comment.

What to do

Leave packaging space for a 1 by 2 inch label in designs for products that may go for the Cyber Trust Mark, and do not count on the smaller options, which the Bureau questions.
Plan for the label in the user guide and in the online documentation, not only on the box.
Collect the registry facts now: sensor capabilities (camera, audio, location), the support period end date, how updates are delivered, how to change the default password, and whether an HBOM or SBOM is maintained.
Budget for renewal every three years with a CyberLAB report, and keep production samples for the support period.
Comment in PS Docket No. 23-239 if a point affects your products, for example the size of small products or the 4 or 5 point font, once the Federal Register dates are known.

Going further

US Cyber Trust Mark: still closed to applications: administrators, accreditation and the NIST IR 8425 baseline
NIST IR 8425, IoT device security: the ten baseline capabilities
Multi-marking layouts: fitting several regulatory marks on one product
EU and US dual certification: one evidence pack for both markets

Sources & references

Public Notice DA 26-1162 of 27 October 2026, comment on label design, certification renewal and post-market surveillance, PS Docket No. 23-239, Federal Communications Commission docs.fcc.gov/public/attachments/DA-26-1162A1.pdf
FCC 24-26, Cybersecurity Labeling for Internet of Things, Report and Order and Further Notice of Proposed Rulemaking, PS Docket No. 23-239, Federal Communications Commission docs.fcc.gov/public/attachments/FCC-24-26A1.pdf
Public Notice DA 26-354 of 13 April 2026, selection of ioXt Alliance as new Lead Administrator, Federal Communications Commission docs.fcc.gov/public/attachments/DA-26-354A1.txt