Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products

Executive Order (EO) 14028, “Improving the Nation’s Cybersecurity,” tasks the National Institute of Standards and Technology (NIST), in coordination with the Federal Trade Commission (FTC) and other agencies, to initiate pilot programs for cybersecurity labeling. NIST is, among other actions, directed “… to identify IoT cybersecurity criteria for a consumer labeling program…” This document seeks to fulfill this directive by recommending consumer IoT product label criteria, label design and consumer education considerations, and conformity assessment considerations for use by a scheme owner to inform a consumer Internet of Things (IoT) product labeling program.