FCC Proposes Cybersecurity Labeling Program for IoT Devices

FCC Proposal on Cybersecurity for IoT

The Federal Communications Commission (FCC) has issued a Notice of Proposed Rulemaking regarding the cybersecurity of Internet-connected devices, commonly known as the Internet of Things (IoT). In this proposal, the FCC aims to establish a voluntary cybersecurity labeling program to provide consumers with easily understandable information about the security risks associated with IoT devices. The program also seeks to ensure that manufacturers of FCC-labeled devices comply with widely accepted cybersecurity standards.

The FCC is soliciting comments on various aspects of the proposed program, including its scope, criteria, requirements, standards, conformity assessment procedures, administration, and legal authority. Additionally, the FCC is seeking input on the form and content of the cybersecurity label.

It's important to note that any communications equipment identified as a threat to national security or the safety and security of the people of the USA, or produced by entities on government risk lists, will be excluded from the proposed program.

The objective of the proposed cybersecurity labeling program, based on criteria recommended by the National Institute of Standards and Technology (NIST), is to inform consumers about the cybersecurity properties of IoT products and encourage manufacturers and importers to adopt security standards. Participation in the program would be voluntary and based on an evaluation of IoT products' conformity with security standards established by the program owner, which could be the FCC or an external entity authorized by the FCC.