The US government has announced that its Cyber Trust Mark program, a voluntary labeling initiative aimed at improving the security of consumer internet-connected devices, will launch in 2025. The program, first introduced in June 2023, is designed to enable Americans to make informed decisions about the security of the devices they buy.

The Biden administration's initiative is modeled after the Energy Star program, which promotes energy-efficient products. Similarly, the Cyber Trust Mark program aims to raise the bar for internet-connected devices, including routers, home security cameras, smart speakers, and baby monitors, which often ship with easy-to-guess default passwords and no promise of continued security updates.

Companies will soon be able to submit their products to one of 11 approved testing companies to earn the label, with certified products expected to hit store shelves in 2025. The label will take the form of a QR code that consumers can scan for details about the cybersecurity of the product, such as the support period for the product and whether security updates are installed automatically.

Retailers, including Best Buy and Amazon, will highlight products that carry the U.S. Cyber Trust Mark, making it easier for consumers to make informed purchasing decisions. This move is expected to improve the overall security of consumer-grade internet-connected devices, which are often vulnerable to cyber attacks.

On a call with reporters, U.S. deputy national security adviser for cyber and emerging technology Anne Neuberger said the Biden administration is also finalizing an executive order that would require the U.S. government to only buy products certified with the Cyber Trust Mark starting in 2027. This move is expected to have a significant impact on the industry, as government agencies are major purchasers of IoT devices.

Products that receive the Cyber Trust Mark label must comply with a set of cybersecurity standards developed by the National Institute of Standards and Technology (NIST). These standards include requirements for unique and strong default passwords, data protection, software updates, and incident detection capabilities. While the full set of standards has not yet been published, NIST has started work on establishing recommendations for "high-risk" consumer-grade routers, which are frequently targeted by hackers.

The second phase of the Cyber Trust Mark program will aim to improve the security of routers used and marketed for small offices and home offices. These so-called SOHO routers have become an attractive target for botnet creators, which use the device's hijacked internet bandwidth to launch denial-of-service attacks. Neuberger did not provide a timeline for the second phase of the initiative.

The launch of the Cyber Trust Mark program is a significant step towards improving the security of IoT devices, which have become an essential part of modern life. As the number of connected devices continues to grow, the need for robust security measures has become increasingly important. The program's success will depend on its ability to raise awareness among consumers and drive industry-wide adoption of robust security standards.

With the Cyber Trust Mark program, the US government is taking a proactive approach to addressing the growing threat of cyber attacks on IoT devices. As the program rolls out in 2025, it will be important to monitor its impact on the industry and its effectiveness in improving the security of consumer-grade internet-connected devices.