Look for the label: White House rolls out ‘Cyber Trust Mark’ for smart devices

Beware the IoT that doesn’t get a security tag

The White House this week introduced a voluntary cybersecurity labeling program for technology products so that consumers can have some assurance their smart devices aren’t spying on them.

“The White House launched this bipartisan effort to educate American consumers and give them an easy way to assess the cybersecurity of such products, as well as incentivize companies to produce more cybersecure devices, much as EnergyStar labels did for energy efficiency,” the White House said.

The program is overseen by the US Federal Communications Commission. It will be administered by 11 different companies [PDF], with UL Solutions as the lead administrator. Makers of wireless consumer Internet of Things (IoT) devices will be able to submit their products for a security compliance review at an accredited laboratory.

And products that meet the NIST-defined testing criteria [PDF] – which cover secure software development and supply chain requirements, security lifecycle policies, vulnerability management policies, and the like – will be able to display the US Cyber Trust Mark and a QR code that device owners can use to look up online product information related to password resets, security, and updates.

Vendors such as Best Buy and Amazon have said they’ll highlight products bearing the mark, so there’s a marketing incentive to participate in the program.

Image of different versions of the US Cyber Trust Mark

Image of different versions of the US Cyber Trust Mark – Click to enlarge

The US Cyber Trust Mark, available in several attractive color schemes, is focused on IoT home security cameras, voice-activated shopping devices, smart appliances, fitness trackers, garage door openers and baby monitors. It’s not intended for medical devices regulated by the US Food and Drug Administration, wired products, automotive products, industrial or enterprise products, or equipment that falls under other network security regulations like the FCC Covered List.

The program originated in 2021 when the White House issued an executive order to improve cybersecurity in response to high-profile attacks like those targeting Colonial Pipeline and SolarWinds. The order, among other things, directed government officials to develop IoT cybersecurity criteria for a consumer labeling program.

In a statement, Amazon VP Steve Downer said Amazon looks forward to collaborating with industry partners and government officials to implement this program.

“Amazon supports the US Cyber Trust Mark’s goal to strengthen consumer trust in connected devices,” said Downer. “We believe consumers will value seeing the US Cyber Trust Mark both on product packaging and while shopping online.”

The US Cyber Trust Mark program “is not going to solve every problem that comes with the amount of connected devices a lot of us have in our homes, but it’s definitely not going to hurt,” RJ Cross, director of US PIRG’s Consumer Privacy Program, told The Register.

“The whole model is to incentivize companies to take security more seriously and prioritize transparency with the public. I’d say that we’re at the point that there are so many dang breaches and hacks that most folks are aware of cyber security as an issue. So giving people more info about the security of the devices they let in their lives is going to give them more control than they’ve had to date and that’s a good thing.”

Asked whether the certification program will shift the burden of security away from consumers to product makers, Cross said that’s the real question.

“The devil is in the details,” said Cross. “Any program worth its salt is going to have to be comprehensive. It needs to look not only how secure is the hardware of your smart washing machine, but also how secure is the cloud where the company is storing the data that’s collected through your washing machine.” ®

read more

White House Plan to Secure Smart Devices Highlights Connected Economy Vulnerabilities

   |  January 9, 2025

Digital transformation is a double-edged sword.

From cloud computing and Internet of Things (IoT) to artificial intelligence-driven analytics and real-time payment systems, the connectivity ushered in by technological advances has unlocked opportunities for innovation and growth.

The more connected the economy becomes, however, the more vulnerabilities there are for fraudsters to exploit.

This makes cybersecurity increasingly crucial, as evidenced by the White House deploying a Cyber Trust Mark for connected consumer devices Tuesday (Jan. 7). The initiative has been supported by major manufacturers and retailers, including Amazon, Google, Best Buy, Samsung and LG Electronics. It’s set to be administered by the Federal Communications Commission and is based on security features and criteria approved by the U.S. National Institute of Standards and Technology.

The interconnected nature of consumer and business technologies means that a breach in one area can have cascading effects across an organization or household.

“The White House launched this bipartisan effort to educate American consumers and give them an easy way to assess the cybersecurity of such products, as well as incentivize companies to produce more cybersecure devise, much as Energy Star labels did for energy efficiency,” the U.S. executive branch said in a statement.

Read also: What 2024’s Worst Cyberattacks Say About Security in 2025

Cyber Threats in a Hyperconnected World

The economy’s connective tissue is increasingly digital, so the question is not whether vulnerabilities will arise but how prepared organizations will be to address them.

The PYMNTS Intelligence report “Multitasking Consumers Want to Shop — and Work — at the Same Time” found that the average consumer now owns six connected devices, a number that climbs to seven among millennials and bridge millennials.

To comply with the new, voluntary standard, devices may need embedded protections like secure software updates, encryption and default password protocols. For companies that have historically prioritized speed-to-market over security, this may necessitate a redesign of existing workflows.

At the same time, building cybersecurity features into devices from the ground up could increase production costs. Smaller manufacturers or startups might find these requirements particularly challenging due to resource constraints. Separately, ensuring that components sourced from third-party suppliers also meet the cyber standards could further complicate manufacturing processes, but also aligns with the broader marketplace trend of emphasizing security across supply chains.

For the initiative to succeed, consumers must recognize, understand and prioritize the Cyber Trust Mark. However, it isn’t just consumer-facing manufacturers that need to take steps in 2025 to prioritize cybersecurity. The business landscape is also undergoing a digital transformation.

This sea of technological change could have unanticipated consequences if not navigated adroitly.

AI-Powered Cybersecurity Reshapes Business Resiliency

For B2B enterprises, where sensitive financial data, proprietary information and critical supply chain operations are at stake, failing to prioritize cybersecurity could lead to devastating consequences — not only in terms of financial loss but also reputational damage and legal repercussions.

The democratization of technologies like AI has made complex tools available to virtually anyone, making it easier for cybercriminals to carry out attacks, Finexio Chief Strategy Officer Chris Wyatt told PYMNTS in an interview posted in August.

But the use of AI isn’t solely reserved for fraudsters. The PYMNTS Intelligence report “The AI MonitorEdge Report: COOs Leverage GenAI to Reduce Data Security Losses” showed that 55% of companies employ AI-powered cybersecurity measures. The report, based on an August survey, marked a sharp increase from the 17% of chief operating officers who reported using AI-driven security tools in May.

In interviews for the “What’s Next in Payments” series, a panel of executives explained to PYMNTS that a multilayered security strategy, also known as defense in depth, reduces risks at various levels.

“The surge in cyberattacks targeting enterprise operations highlights a shift in how hackers approach their targets,” PYMNTS wrote last month. “Rather than casting wide nets through ransomware campaigns, cybercriminal groups are focusing on critical infrastructure that serves as the backbone of corporate data exchange.”

read more
Trustpilot
The rating of livingsafeonline.com at Trustprofile Reviews is 9.1/10 based on 13 reviews.
Verified by MonsterInsights