The U.S. Cyber Trust Mark is a voluntary cybersecurity label for wireless consumer Internet of Things devices, overseen by the FCC. On 13 April 2026 the FCC named ioXt Alliance as Lead Administrator and said it would work to finalize implementation, so check the FCC for the current state before relying on it.
What it is
The FCC describes the program as a voluntary label meant to help consumers make informed decisions about the products they bring into their homes. It applies to wireless consumer IoT devices. Chairman Brendan Carr framed it in those terms in the FCC announcement.
Voluntary means a maker chooses to take part. A product without the mark is not necessarily unsafe, and a product with it is not a guarantee of safety. The label is a signal about whether a product met the program's standards.
What happened in 2026
The FCC announcement on 13 April 2026 says it named ioXt Alliance, a U.S. based nonprofit focused on the security, privacy and transparency of IoT products, as the new Lead Administrator. The FCC said it looks forward to working with ioXt to finalize implementation of the program, which tells you the program was not yet fully implemented at that point.
As Lead Administrator, ioXt is to work with stakeholders on a consumer outreach campaign and to recommend to the Commission additional cybersecurity standards, testing procedures and label design.
I did not find a later FCC source in this review. Whether labels are on shelves by the time you read this should be confirmed on the FCC site.
What the mark is built on
NIST's consumer IoT profile, NIST IR 8425, describes baseline cybersecurity outcomes for consumer IoT products and was created in response to Executive Order 14028. Whether the label's final criteria track that profile exactly is a detail to confirm in current FCC documents. Our separate post on NIST IR 8425 explains what the profile covers.
How to read a label when you see one
A security label is shorthand. When you see the mark on a box, ask what it covers. Does it speak to the device only, or to the companion app and cloud service too? Does it say anything about how long updates will arrive? The sources reviewed for this post do not answer those questions for the Cyber Trust Mark, and the FCC says it is still working with its administrator on standards, testing procedures and label design, so the answers may change.
Until the details settle, a label is a reason to look more closely at a product, not a reason to stop looking. The same checklist applies with or without it: a clear support period, a password you choose, a published way to report problems, and automatic updates.
What to do now
If you are a buyer, do not wait for labels. The basics still apply: check the update period, change default passwords, and keep devices updated.
If you make wireless consumer products for the U.S. market, follow the FCC program pages for the application route and testing requirements, and compare your design with the NIST profile.
Quick check
Is the Cyber Trust Mark mandatory?
No. The FCC describes it as voluntary.
Does the mark mean a device will get updates forever?
No claim like that appears in the sources reviewed. Check the specific product's support period.
Sources
Last reviewed: 19 October 2026.
