Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Cybersecurity Labeling for Consumers: Internet of Things (IoT) Devices and Software

The May 12, 2021, Presidential Executive Order on Improving the Nation’s Cybersecurity (14028) directs NIST to initiate two labeling programs on cybersecurity capabilities of Internet-of-Things (IoT) consumer devices and software development practices. The agency also received several other directives to enhance the security of the software supply chain.

Section 4 of the order directs NIST to take into account existing consumer product labeling programs as it considers efforts to educate the public on the cybersecurity capabilities of Internet-of-Things (IoT) devices and software development practices. NIST also is to consider ways to incentivize manufacturers and developers to participate in these programs.

By February 6, 2022, in coordination with the Federal Trade Commission (FTC) and other agencies, NIST is required to identify:

  • IoT cybersecurity criteria for a consumer labeling program and
  • secure software development practices or criteria for a consumer software labeling program.

NIST is relying heavily on information provided by diverse stakeholders as it carries out these directives. In October, NIST solicited public comments on draft criteria for consumer software cybersecurity and labeling. In August, the agency released for public comment a white paper suggesting a draft set of potential baseline security criteria for IoT devices. In November, NIST solicited public comments on draft criteria for consumer software cybersecurity and labeling.

NIST is identifying key elements of labeling programs in terms of minimum requirements and desirable attributes – rather than establishing its own programs; NIST will specify desired outcomes, allowing providers and customers to choose best solutions for their devices and environments. One size may not fit all, and multiple solutions might be offered by label providers.

Labeling should:

  • Encourage innovation in manufacturers’ consumer-oriented IoT and software security efforts, leaving room for changes in technologies and the security landscape.
  • Be practical and not be burdensome to manufacturers and distributors.
  • Factor in usability as a key consideration.
  • Build on national and international experience.
  • Allow for diversity of approaches and solutions across industries, verticals, and use cases – so long as they are deemed useful and effective for consumers.

On September 14-15, 2021, NIST hosted a virtual public workshop on these consumer education-oriented efforts. The workshop included facilitated panel discussions and presentations based on the preliminary feedback on the draft IoT criteria and the consumer software labeling position papers submitted to NIST and on preliminary feedback on potential IoT baseline security criteria. On December 2, 2021, taking public feedback into account, NIST released a further discussion paper: Consumer Cybersecurity Labeling for IoT Products: Discussion Draft on the Path Forward. This paper will be discussed at the upcoming workshop Cybersecurity Labeling for Consumer IoT and Software: Executive Order Update and Discussion - December 9, 2021.

EO Labeling Timeline

Questions about NIST’s activities related to these efforts should be directed to labeling-eo [at] nist.gov.

Created July 8, 2021, Updated December 2, 2021