Public Regulatory Brief
Global Regulatory Intelligence
Verified compliance intelligence and regulatory updates curated by Eleos Compliance engineers.
United States of America
Public Consultation Document
In Force
Public Notice: U.S. Cyber Trust Mark Program Label Design, Certification Renewal, and Post-Market Surveillance
Affects:
Certification Process
Labelling
Spectrum Management
Testing
Executive Summary
This FCC Public Notice seeks public comment on proposed rules for the U.S. Cyber Trust Mark Program regarding IoT label design, certification renewal procedures, post-market surveillance, and administrative withdrawal/termination. It specifically addresses recommendations for label specifications, the cyber nutrition label format, renewal cycles, and the appointment of a Qualified Professional.
Last Updated
29-OCT-26
The FCC’s Public Safety and Homeland Security Bureau is seeking public comment on recommendations for the U.S. Cyber Trust Mark (USCTM) Program. The notice focuses on label requirements, certification renewals, post-market surveillance, and how the program will be administered.
Scope
The notice covers several areas:
- Labelling: Requirements for label design, size, and placement on product packaging, websites, and documentation, as well as the information included in the “cyber nutrition” label.
- Certification renewal: How and when manufacturers must renew their authorization to use the FCC IoT Label.
- Post-market surveillance: How Cybersecurity Label Administrators (CLAs) will monitor certified products, select samples for testing, and address non-compliance.
- Program administration: Procedures for the withdrawal or termination of the Lead Administrator or CLAs, including transferring records and handling complaints.
- Regulatory impact: An Initial Regulatory Flexibility Analysis (IRFA) examining the potential impact on small businesses.
Key Technical Requirements
The FCC is considering several requirements, some of which are based on the CTA-2120 standard.
Label requirements
- Physical labels would generally need to be at least 1 x 2 inches, although smaller alternatives are being considered.
- The proposed minimum font size is 4 or 5 points.
- Labels must include the Cyber Trust Mark and a scannable QR code linking to government-hosted information.
Cyber nutrition label
- Information would be presented in two layers: a basic overview for consumers and more detailed information for technical users.
- Manufacturers would need to disclose whether products contain cameras, microphones, or location-tracking sensors.
- Manufacturers would also need to state whether they maintain a Hardware or Software Bill of Materials (HBOM/SBOM).
- Information must be available in both English and Spanish.
Certification renewal
- Certifications would need to be renewed every three years.
- Renewal applications would require a test report from an accredited CyberLAB.
- Testing would need to cover any new or revised requirements, along with 70% of the remaining requirements.
Post-market surveillance
- CLAs would need to maintain a written Sample Test Plan and submit it annually to the Lead Administrator.
- Surveillance testing must be carried out by a CLA-operated lab or recognized CyberLAB, rather than a manufacturer's in-house lab.
- Manufacturers would have 30 days to provide production samples when requested. Failure to do so could result in certification being withdrawn.
Qualified Professional
- Manufacturers holding certifications would need to appoint a Qualified Professional responsible for monitoring compliance and product changes.
- This person would need to complete approved training and pass an exam covering USCTM Program requirements.
Attached Documents & Source Files
Public Notice: U.S. Cyber Trust Mark Program Label Design, Certification Renewal, and Post-Market Surveillance
Author / Agency: Federal Communications Commission
Published:
2026-10-27
Language:
English
Key Regulatory Timeline & Dates
Dec 11, 2026
Commenting Deadline
45 days after publication in the Federal Register (Reply Comment Date)
Oct 27, 2026
Date Published
Released: October 27, 2026
Nov 26, 2026
Commenting Deadline
30 days after publication in Federal Register
Stay Ahead of Global Regulatory Changes
Eleos Compliance delivers proactive regulatory monitoring, standard gap analysis, and type approval management across 150+ countries.