NIST IR 8425 and the US Cyber Trust Mark in 2026

Hugues Orgitello updated 7 Oct 2026 18 min read

NIST IR 8425, "Profile of the IoT Core Baseline for Consumer IoT Products", was published in September 2022. It sets six product capabilities and four non-technical supporting capabilities, phrased as outcomes for the whole IoT product: the device plus its companion app, gateway and cloud back end. In March 2024 the FCC adopted it as the basis of the voluntary US Cyber Trust Mark and wrote the programme into 47 CFR Part 8, subpart B. Two and a half years later the rules exist, but no product can carry the label yet: the administrators are only conditionally approved, the Lead Administrator changed from UL Solutions to ioXt Alliance, and accreditation bodies were recognised on 28 September 2026. This guide reads 8425 capability by capability, maps the Part 8 rules section by section, gives the programme status as of 7 October 2026, and separates 8425 from NIST SP 800-213, the Cyber Resilience Act and the UK PSTI Act.

In short:

• NIST IR 8425 (September 2022) defines 6 product capabilities + 4 non-technical capabilities; NIST IR 8425A (September 2024) adds a router profile.
• The US Cyber Trust Mark is voluntary (47 CFR 8.203(k)); FCC 24-26 was adopted on 14 March 2024 and the rules took effect on 29 August 2024.
• Two steps: testing by an accredited, Lead Administrator-recognised lab, then certification by a CLA. No self-attestation.
• Status on 7 October 2026: no CLA is authorised to grant the label; ioXt Alliance is Lead Administrator since 13 April 2026; A2LA and ANAB were recognised as accreditation bodies on 28 September 2026.

Status of the documents and the programme (October 2026)

Date	Event	Source
12 May 2021	Executive Order 14028 asks NIST for consumer IoT labelling criteria	EO 14028, sections 4(s) and 4(t)
February 2022	NIST publishes Recommended Criteria for Cybersecurity Labeling for Consumer IoT Products, first home of the consumer profile	NIST IR 8425, introduction
17 June 2022 / 20 September 2022	NIST IR 8425 draft, then final	NIST publication page, document history
14 March 2024	FCC adopts Report and Order FCC 24-26 (released 15 March 2024), PS Docket 23-239	FCC 24-26
30 July 2024	Final rule published (89 FR 61242), effective 29 August 2024	Federal Register
10 September 2024	NIST IR 8425A, consumer-grade router profile, final	NIST publication page
4 December 2024	UL LLC (UL Solutions) selected as Lead Administrator	DA 24-1214, cited in DA 26-18
11 December 2024	Eleven CLAs conditionally approved	DA 24-1241
6 May 2025	UL Solutions given until 13 June 2025 to file its standards recommendations	DA 25-388
15 August 2025	CTIA Certification LLC withdraws as CLA	DA 26-75
19 December 2025	UL Solutions withdrawal as Lead Administrator takes effect	DA 26-18
7 to 28 January 2026	New Lead Administrator filing window	DA 26-18
13 April 2026	ioXt Alliance selected as Lead Administrator	DA 26-354
11 August 2026	Two more CLAs conditionally approved, CLA window reopened with no closing date	DA 26-834
28 September 2026	A2LA and ANAB recognised to accredit CLAs (ISO/IEC 17065) and CyberLABs (ISO/IEC 17025)	DA 26-1029

DA 26-354 records that the previous Lead Administrator had submitted an initial set of recommendations, "being reviewed by Bureau staff" and to be placed on public notice for comment. Until the Commission adopts standards and testing procedures and a CLA obtains ISO/IEC 17065 accreditation with the FCC scope, no product authorisation can be granted (DA 26-834).

Where NIST IR 8425 comes from

Executive Order 14028 was signed on 12 May 2021. Its sections 4(s) and 4(t) asked NIST to start consumer IoT labelling pilots and to identify IoT cybersecurity criteria for a consumer label. NIST answered in February 2022 with Recommended Criteria for Cybersecurity Labeling for Consumer IoT Products; the consumer profile in that white paper became NIST IR 8425 in September 2022.

8425 is a profile of the core baselines in NISTIR 8259A (device capabilities) and 8259B (non-technical capabilities). Its introduction places it in the 8259 series, alongside NISTIR 8259, which NIST withdrew on 20 April 2026 and replaced with NIST IR 8259 Rev. 1; 8259A and 8259B were not revised (see the SP 800-213 guide).

Its audience, in its own words, is manufacturers of consumer products, retailers, integrators and support firms, and "testing and certification bodies interested in establishing baselines". It targets "IoT products for home or personal use" and adds that it can be a starting point for businesses buying IoT products.

What counts as an IoT product

The key move in 8425 is from device to product. An IoT device is computing equipment with at least one transducer (sensor or actuator) and at least one network interface. An IoT product is the device or devices "and any additional product components that are necessary to use the IoT device beyond basic operational features". 8425 names three kinds of components besides the device:

Component	Example in 8425	Usually
Dedicated networking or gateway hardware (hub)	A hub within the system where the IoT device is used	In the box, or bought separately
Companion application software	A mobile app for communicating with the device	Outside the box
Back ends	A cloud service, or several, that store or process device data	Outside the box

The FCC copied this structure into 47 CFR 8.203(j) and (m), "per NISTIR 8425". In practice it means that a smart plug with an insecure cloud API does not meet the profile, however well its firmware is written.

The six product capabilities, as written

8425 gives each capability a definition, numbered sub-criteria and a "cybersecurity utility". The table summarises the sub-criteria.

Capability	Outcome in 8425	Sub-criteria
Asset Identification	The product is uniquely identifiable and inventories all of its components	1. product uniquely identified by the customer and other authorised entities; 2. each component uniquely identified and an up-to-date inventory of connected components maintained
Product Configuration	Configuration is changeable, a secure default can be restored, changes only by authorised individuals, services and components	1. authorised entities change configuration via one or more components; 2. restore a secure default (uninitialised) configuration; 3. settings applied to applicable components
Data Protection	Data stored on all components and transmitted between components and outside the product is protected from unauthorised access, disclosure and modification	1. each component protects stored data via secure means; 2. ability to delete or render inaccessible data collected from or about the customer, home or family; 3. protections used for data transmission
Interface Access Control	Logical access to local and network interfaces, and their protocols and services, restricted to authorised entities	1. each component uses only necessary interfaces, applies access control to them (for example unique password-based multi-factor authentication, ports inaccessible from outside) and limits privileges; 2. the product validates data shared among components, prevents unauthorised transmissions, and keeps access control during onboarding and reconnection
Software Update	Software of all components updatable only by authorised entities using a secure and configurable mechanism	1. each component can receive, verify and apply verified updates; 2. measures to keep software up to date (automatic updates or consistent customer notification)
Cybersecurity State Awareness	The product supports detection of cybersecurity incidents affecting or affected by its components and data	1. the product securely captures and records state information usable to detect incidents

Two details are often lost. "Software" includes libraries, support packs and non-executable software data (footnote 13). And Cybersecurity State Awareness is about capturing state information to detect incidents, not a consumer-facing security dashboard.

The four non-technical capabilities

Capability	What the developer does	Notable sub-criteria
Documentation	Creates, gathers and stores cybersecurity information before purchase and throughout the lifecycle	Assumptions (expected customers and use cases, applicable laws, expected lifespan and "length and terms of support"); list of all components; how each baseline criterion is met or why not; all hardware and software components from all sources; secure development and supply chain practices; vulnerability management policies
Information and Query Reception	Receives cybersecurity information and responds to queries	A point of contact for maintenance and vulnerability information (bug reporting, bug bounty); ability to receive and answer queries
Information Dissemination	Broadcasts and distributes cybersecurity information	At minimum: updated terms of support and update availability, end of support, needed maintenance, new vulnerabilities and mitigations, breach discovery
Product Education and Awareness	Educates customers and others	How to change settings, use access control, apply updates, manage and delete data; maintenance including after the support period; secure re-provisioning or disposal; information on the duration and scope of support to inform purchase

8425 adds that documentation is controlled by the developer and "not intended, in all cases, to be shared directly with consumers" (footnote 15). The audience for most of it is assessors, not buyers.

What 8425 does not say

• No numbered test cases. 8425 states outcomes; the FCC rules leave the "technical standards and testing procedures" to Lead Administrator recommendations (47 CFR 8.221(a)(4)).
• No minimum support period. Support appears inside Documentation, Information Dissemination and Education; the disclosure obligation comes from FCC rules.
• No ETSI references. The text of 8425 does not cite ETSI EN 303 645. The two documents cover similar ground, but no official mapping table links them.
• No sector profiles numbered 8425-1, 8425-2. The only companion so far is NIST IR 8425A (September 2024), a profile for consumer-grade routers, a product class the FCC excludes from the IoT device definition.

From NIST profile to FCC rules: 47 CFR Part 8, subpart B

FCC 24-26 inserts sections 8.201 to 8.222 into 47 CFR Part 8. At paragraph 99 the Commission "adopt[s] NISTIR 8425 as the basis" for the programme.

Section	What it says
8.201	Incorporates ISO/IEC 17011:2017, ISO/IEC 17025:2017 and ISO/IEC 17065:2012 by reference
8.203(b)	Consumer IoT products: primarily consumer rather than enterprise or industrial use; FDA-regulated medical devices and NHTSA-regulated motor vehicles and equipment excluded
8.203(i)	IoT device: internet-connected, capable of intentionally emitting RF energy, at least one transducer and at least one network interface (wired-only devices are therefore out)
8.203(f)	FCC IoT Label: the Cyber Trust Mark plus a scannable QR code that leads to the registry
8.203(k)	The labeling program is voluntary
8.204	No label for products from the Covered List, the Commerce Entity List, the DoD list of Chinese military companies, or suspended or debarred entities
8.208	Application to a CLA, with declarations under penalty of perjury, including the commitment to update through the support period end date
8.209	No use of the mark is effective until the CLA grants the application
8.212	Review: first by the CLA (request within 60 days), then by the Commission
8.215	Grantee keeps design, production and test records for two years after marketing ends
8.217	CyberLABs: ISO/IEC 17025 accreditation from a Bureau-recognised body, reassessment at least every two years; the Lead Administrator keeps the public list
8.220	CLAs: ISO/IEC 17065 type testing; conditional approval pending accreditation within six months of the adoption of standards; CLAs may not make policy, grant waivers or take enforcement action
8.221	Lead Administrator: within 90 days of selection, recommend standards and testing procedures, renewal frequency, post-market surveillance, registry updates and label design; within 45 days of a NIST guideline change, recommend alignment
8.222	Registry: dynamic, decentralised, publicly accessible, common API secure by design, eleven data elements

The actors

Actor	Role in the rules	Who, as of October 2026
FCC (Public Safety and Homeland Security Bureau)	Programme owner, recognises CLAs and accreditation bodies, reviews CLA decisions, enforcement
Lead Administrator	A CLA with extra duties: standards recommendations, lab recognition, liaison with the FCC, consumer education	ioXt Alliance (DA 26-354)
CLA	Grants or denies authorisation to use the label, post-market surveillance	Conditionally approved only (DA 24-1241, DA 26-834)
Lab (CyberLAB, CLA lab or in-house lab)	Conformity testing, accredited to ISO/IEC 17025 and recognised by the Lead Administrator	None recognised yet
Accreditation bodies	Accredit CLAs to ISO/IEC 17065 and labs to ISO/IEC 17025	A2LA and ANAB (DA 26-1029)
Manufacturer (grantee)	Applies, declares, publishes registry data, keeps records

The eleven CLAs conditionally approved on 11 December 2024 were CSA America Testing & Certification, SGS North America, CTIA Certification, Telecommunications Industry Association, DEKRA Certification, TÜV Rheinland of N.A., Intertek Testing Services NA, TÜV SÜD America, ioXt Alliance, UL LLC and Palindrome Technologies (DA 24-1241). CTIA Certification withdrew effective 15 August 2025 (DA 26-75). DA 26-834 added IIA Lab Services and Element Materials Technology Portland - Evergreen. Under 8.220(e)(1) the Commission approves CLAs located in the United States.

The two-step process

FCC 24-26 (paragraph 81) adopts "a two-step process": product testing by an accredited and Lead Administrator-recognised lab, then label certification by a CLA. The lab may be a CyberLAB, a lab run by a CLA, or the manufacturer's own in-house lab if it meets the same requirements (paragraphs 72 and 73). What is excluded is self-attestation: the Commission found it "not appropriate at this time" (paragraph 86).

The label and the registry

The FCC IoT Label is the Cyber Trust Mark plus a QR code (8.203(f)). The registry it points to is not a single FCC database: under 8.222(a) each grantee supplies data to "a dynamic, decentralized, publicly accessible registry" through a common API. 8.222(b) lists what must be published.

#	Registry element (47 CFR 8.222(b))
1	Product name
2	Manufacturer name
3	Date of authorisation to affix the label and current status
4	Name and contact information of the authorising CLA
5	Name of the lab that conducted the conformity testing
6	How to change the default password, or a statement that it cannot be changed
7	Information or a link on configuring the device securely
8	Whether updates and patches are automatic, and how to get them if not
9	The end date of the minimum support period, or a statement that the device is unsupported
10	Whether the manufacturer maintains an HBOM and/or an SBOM
11	Additional elements the Bureau deems necessary

The label design is not fixed yet. 8.221(a)(4)(v) asks the Lead Administrator to recommend design and placement (size, white space, packaging) and whether to show the support end date on the label. FCC 24-26 also states that the e-labelling rule of 47 CFR 2.935 does not apply to the FCC IoT Label, so the mark cannot be shown only on a screen the way an FCC ID can. Renewal of the authorisation is required, but its frequency per product class is again a Lead Administrator recommendation (paragraphs 122 to 124).

The support period

The support period is where 8425 and the FCC rules differ most. 8425 asks the developer to document the "length and terms of support" and to tell customers the duration and scope of support. The FCC turns this into commitments:

• Declaration. Under 8.208(c)(7) the applicant declares, under penalty of perjury, that until the support period end date disclosed in the registry it will "diligently identify critical vulnerabilities" and "promptly issue software updates correcting them", unless not reasonably needed. 8.208(f) requires the end date to be disclosed.
• Registry. 8.222(b)(9) publishes that date, or alternatively "a statement that the device is unsupported".
• No expiry date, no minimum. FCC 24-26 concludes that "an expiration date is not warranted" on the label, and Part 8 sets no minimum support duration.

The CRA is stricter on this point: Article 13(8) of Regulation (EU) 2024/2847 sets a support period of at least five years unless the product is expected to be in use for less.

Enforcement

FCC 24-26 relies on administrative remedies under the Communications Act and civil litigation, such as trademark infringement or breach of contract (paragraph 131), with post-market surveillance by CLAs as a principal mechanism (paragraph 127). Under 8.216 the authorisation terminates for false statements, non-conformity, or listing under 8.204. The Commission declined to pre-empt state law but found that approval to use the mark is "an indicator of reasonableness" (paragraph 132).

Comparison with the EU and UK regimes

Dimension	US Cyber Trust Mark	EU Cyber Resilience Act	UK PSTI regime
Status	Voluntary (8.203(k))	Mandatory	Mandatory
Scope	Consumer wireless IoT products	Products with digital elements	Relevant connectable products
Technical basis	NIST IR 8425, standards still to be adopted	Annex I essential requirements, harmonised standards in preparation	Schedule 1 of the 2023 Regulations: passwords, vulnerability reporting information, minimum security update period
Support period	End date disclosed, no minimum	At least five years unless shorter expected use (Article 13(8))	Minimum security update period published
Dates	Rules effective 29 August 2024; no product authorised yet	Reporting obligations since 11 September 2026; full application 11 December 2027	In force since 29 April 2024
Maximum penalty	Label termination, Communications Act remedies, civil litigation	EUR 15 million or 2.5% of worldwide annual turnover for essential requirements (Article 64(2))	The greater of GBP 10 million or 4% of qualifying worldwide revenue (PSTI Act, section 38)

In the EU, internet-connected radio equipment is already covered by the RED Article 3(3)(d)(e)(f) delegated act, applicable since 1 August 2025 with EN 18031-1/-2/-3 cited with restrictions (Decision (EU) 2025/138).

International recognition

FCC 24-26 cites other national labels in the record: Singapore (Cybersecurity Labelling Scheme, which takes reference from ETSI EN 303 645), Finland and Germany (paragraph 134). It notes that on 30 January 2024 the US and the EU entered into a Joint CyberSafe Products Action Plan aimed at technical cooperation in support of mutual recognition. It also records that "no international agreements are yet in place" (paragraph 61), and delegates the work on recognition to the Bureau and the Office of International Affairs (paragraph 136). No recognition agreement has been announced since. EN 303 645 or EN 18031 conformity therefore gives no right to the Cyber Trust Mark, and the reverse is also true.

Distinction from NIST SP 800-213

Criterion	NIST IR 8425	NIST SP 800-213 / 800-213A
Published	September 2022	November 2021
Audience	Consumer IoT products (home or personal use)	Organisations integrating IoT devices, chiefly federal agencies
Origin	Executive Order 14028, sections 4(s) and 4(t)	IoT Cybersecurity Improvement Act of 2020, section 4
Legal weight	None by itself; basis of the voluntary FCC label	Section 7 of the Act: agencies may not procure or use a device that prevents compliance, unless waived
Unit	IoT product (device plus components)	IoT device as a system element
Content	10 capabilities as outcomes	Process (SP 800-213) and catalogue of 11 families with a federal profile (SP 800-213A)
Verification	Accredited lab plus CLA, once the programme opens	The acquiring organisation

For details on 8259A, 8259B and SP 800-213, see the NIST SP 800-213 guide.

Claims the texts contradict

Common claim (several made by earlier versions of this page)	What the text says
NISTIR 8425 requires a declared support period as a cross-cutting capability	8425 has ten capabilities; support appears in Documentation, Dissemination and Education. The disclosure duty comes from 47 CFR 8.208 and 8.222
The label becomes void for new buyers when support ends	No such rule. The registry shows the support end date; FCC 24-26 rejected an expiration date
Cybersecurity State Awareness means showing users their security posture	It means securely capturing state information to detect incidents
Software Update requires signed updates during the declared support period	8425 asks that components "receive, verify, and apply verified software updates"; signatures and the support period are not named in the capability
The CLA mandates a CyberLAB and publishes the registry record	The manufacturer has the product tested by a recognised lab (CyberLAB, CLA lab or in-house), then applies to a CLA; the grantee publishes registry data through a common API
CyberLABs need an "extended ISO/IEC 17025" accreditation from A2LA or NVLAP	ISO/IEC 17025 with the FCC scope, from a Bureau-recognised body; the bodies recognised on 28 September 2026 are A2LA and ANAB
UL Solutions, TÜV and Intertek announced their candidacy and are accredited	Eleven CLAs were conditionally approved on 11 December 2024; none is authorised to grant the label (DA 26-834). UL Solutions withdrew as Lead Administrator effective 19 December 2025; ioXt Alliance was selected on 13 April 2026
The label graphic has a precise specification of height, contrast and placement	Design and placement are still to be recommended by the Lead Administrator (8.221(a)(4)(v))
NIST has preparatory sector profiles numbered 8425-1, 8425-2	The only companion document is NIST IR 8425A (September 2024), for consumer-grade routers
NISTIR 8425 aligns with and cites EN 303 645	8425 does not cite ETSI; FCC 24-26 mentions EN 303 645 only through commenters and the Singapore scheme
FCC-EU mutual recognition talks are under way	FCC 24-26 states that no international agreements are in place; the January 2024 Joint CyberSafe Products Action Plan is a cooperation plan
Scope covers all connected consumer products, wired or wireless	Wired-only products are excluded; so are FDA medical devices, NHTSA vehicles, general-purpose computers, smartphones and routers
Executive Order 14028 reacted to SolarWinds, Kaseya and Colonial Pipeline	The Kaseya attack was in July 2021, after the order of 12 May 2021

For a manufacturer: a practical approach

1. Scope the product. List the device, the companion app, any hub and every back end: under 8.203(j) and (m), all of them are the product. Check 8.204 eligibility early: a component from a listed entity closes the label regardless of security.

2. Design against the ten capabilities. Use the 8425 sub-criteria as a requirements list: inventory of components, restorable secure default, data deletion, interface minimisation, verified updates on every component, incident-relevant state logging.

3. Build the registry data during development. The eleven 8.222(b) elements are product facts (default password procedure, update method, support end date, SBOM/HBOM status) that are cheaper to define early.

4. Keep the label out of launch milestones. No date for accepting applications has been announced. When a CLA reaches full approval, the FCC will release a public notice (DA 26-834).

5. Reuse the work for Europe. Much of the evidence (component inventory, update mechanism, vulnerability handling) also serves EN 303 645, EN 18031 and the CRA, but it has to be mapped to each text explicitly.

See also

• Product cybersecurity: obligation, evaluation, label
• Certifying a smart lock: the full stack
• NIST SP 800-213 and 8259A: US baseline for IoT cybersecurity
• Common Criteria (ISO/IEC 15408): IT security eval
• FIPS 140-3: cryptographic module validation
• CSPN and ANSSI Visa: French cybersec certification
• EU and US dual certification

Working on preparing a US Cyber Trust Mark filing or mapping an IoT product to the NISTIR 8425 baseline for a real product? AESTECHNO can audit your design and certification plan. Get in touch

Common pitfalls

Treating the label as a market-access requirement. It is voluntary. Selling a wireless product in the US still requires FCC equipment authorisation under Part 15 (and Part 18 where relevant); the Cyber Trust Mark is a separate programme under Part 8, and one does not imply the other.

Evaluating only the firmware. The profile and the rules apply to the IoT product. A cloud API or a mobile app left out of the analysis is a gap, not an out-of-scope item.

Promising a support end date the budget cannot keep. The 8.208 declaration is made under penalty of perjury, and false statements terminate the authorisation (8.216). A short period that is honoured is safer than a long one that is not.

Quoting the programme as running. Product authorisations require fully approved CLAs and adopted standards; neither exists as of 7 October 2026.

What to watch

• Standards and testing procedures. The Bureau is to put the Lead Administrator recommendations out for public comment (DA 26-354), then incorporate them by reference into Part 8 (8.221(a)(4)(i)).
• Full approval of CLAs. With A2LA and ANAB recognised, the six-month accreditation clock in 8.220(c)(6) starts once standards are adopted.
• NIST updates. Under 8.221(a)(5) the Lead Administrator has 45 days after a NIST guideline change to recommend matching changes; IR 8259 Rev. 1 (April 2026) is such a change upstream of 8425.

A 30-minute audit with AESTECHNO engineers.

AESTECHNO is the electronics design house that edits spilma. We help product teams scope their certification effort and avoid the common mistakes.

Book a free audit

Further reading

• US Cyber Trust Mark status note: DA 26-834 and the rollout in detail
• ETSI EN 303 645: the European consumer IoT baseline
• NIST SP 800-213: the federal baseline and the 8259 series
• Cyber Resilience Act: mandatory EU regime, full application 11 December 2027
• FCC certification: equipment authorisation, distinct from the Cyber Trust Mark
• Glossary: definitions of FCC, NIST, CLA and CyberLAB terms

Sources & references

1. NIST IR 8425, Profile of the IoT Core Baseline for Consumer IoT Products (September 2022), NIST csrc.nist.gov/pubs/ir/8425/final
2. NIST IR 8425 (PDF), NIST nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf
3. NIST IR 8425A, Recommended Cybersecurity Requirements for Consumer-Grade Router Products (September 2024), NIST csrc.nist.gov/pubs/ir/8425/a/final
4. NIST Cybersecurity for IoT Program, NIST www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-program
5. NIST SP 800-213, IoT Device Cybersecurity Guidance for the Federal Government, NIST csrc.nist.gov/pubs/sp/800/213/final
6. FCC 24-26, Cybersecurity Labeling for Internet of Things, Report and Order and FNPRM (adopted 14 March 2024), Federal Communications Commission docs.fcc.gov/public/attachments/FCC-24-26A1.pdf
7. Cybersecurity Labeling for Internet of Things, final rule (89 FR 61242, 30 July 2024), Federal Register www.federalregister.gov/documents/2024/07/30/2024-14148/cybersecurity-labeling-for-internet-of-things
8. 47 CFR Part 8, Subpart B, Cybersecurity Labeling Program for IoT Products, eCFR www.ecfr.gov/current/title-47/chapter-I/subchapter-A/part-8/subpart-B
9. DA 24-1241 (11 December 2024), conditionally approved Cybersecurity Label Administrators, Federal Communications Commission docs.fcc.gov/public/attachments/DA-24-1241A1.txt
10. DA 25-388 (6 May 2025), extension of time for the Lead Administrator recommendations, Federal Communications Commission docs.fcc.gov/public/attachments/DA-25-388A1.pdf
11. DA 26-18 (6 January 2026), Lead Administrator filing window after UL Solutions withdrawal, Federal Communications Commission docs.fcc.gov/public/attachments/DA-26-18A1.pdf
12. DA 26-75 (26 January 2026), CLA filing window, Federal Communications Commission docs.fcc.gov/public/attachments/DA-26-75A1.txt
13. DA 26-354 (13 April 2026), ioXt Alliance selected as Lead Administrator, Federal Communications Commission docs.fcc.gov/public/attachments/DA-26-354A1.txt
14. FCC selects new Lead Administrator for U.S. Cyber Trust Mark Program (13 April 2026), Federal Communications Commission docs.fcc.gov/public/attachments/DOC-420764A1.pdf
15. DA 26-834 (11 August 2026), two more conditionally approved CLAs and new filing window, Federal Communications Commission docs.fcc.gov/public/attachments/DA-26-834A1.txt
16. DA 26-1029 (28 September 2026), accreditation bodies recognised for the Cyber Trust Mark, Federal Communications Commission docs.fcc.gov/public/attachments/DA-26-1029A1.txt
17. Executive Order 14028, Improving the Nation's Cybersecurity, White House bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/
18. IoT Cybersecurity Improvement Act of 2020 (Public Law 116-207), US Congress www.congress.gov/bill/116th-congress/house-bill/1668
19. Regulation (EU) 2024/2847, Cyber Resilience Act, EUR-Lex eur-lex.europa.eu/eli/reg/2024/2847/oj
20. Product Security and Telecommunications Infrastructure Act 2022, Part 1, legislation.gov.uk www.legislation.gov.uk/ukpga/2022/46/part/1
21. PSTI (Security Requirements for Relevant Connectable Products) Regulations 2023, legislation.gov.uk www.legislation.gov.uk/uksi/2023/1007