ioXt Alliance Takes Over as Lead Administrator of the US Cyber Trust Mark

The US Cyber Trust Mark, the FCC's voluntary cybersecurity labelling programme for consumer connected devices, has moved into operation with the ioXt Alliance appointed Lead Administrator effective 13 April 2026. The label is intended to let a shopper judge a device's security posture at the point of sale, against criteria drawn up by NIST.

Voluntary is the word that determines how much this matters. A label nobody is obliged to carry succeeds only if buyers look for it, which in consumer electronics has historically meant it succeeds when a large retailer decides to require it. Energy labelling followed exactly that path, and became decisive only once it appeared on the shelf edge rather than in a specification sheet.

For manufacturers selling into both the US and Europe, the more useful observation is that the underlying requirements are converging. The Cyber Trust Mark criteria, the UK's PSTI regime and the EU Cyber Resilience Act differ in enforcement and in timing, but they ask for broadly the same things: no universal default passwords, a route for reporting vulnerabilities, and a stated support period. A product built to satisfy the strictest of them satisfies the others largely as a side effect, which makes designing to the union of the three cheaper than treating them as three programmes.