Cyber Trust Mark Program Faces Uncertain Future After Lead Administrator Resigns
Questions remain about the future of the FCC’s voluntary cyber trust mark program, which commissioners approved 5-0 in March 2024 (see 2403140034), because of concerns that progress has stalled after UL Solutions dropped out as lead administrator. FCC Chairman Brendan Carr earlier raised concerns about UL’s purported ties to China. Last week, the agency asked for applications from companies willing to replace UL Solutions, which are due Jan. 28.
Sign up for a free preview to unlock the rest of this article
Communications Daily is required reading for senior executives at top telecom corporations, law firms, lobbying organizations, associations and government agencies (including the FCC). Join them today!
President Donald Trump issued an executive order last year mandating that by Jan. 4, 2027, all IoT devices sold to the government must carry the cyber trust mark (see 2506090044).
UL's resignation “is certainly a setback when it comes to getting products with the label on shelves anytime soon,” Consumer Reports policy fellow Stacey Higginbotham told us Thursday. The FCC “certainly” didn’t “publicly make a compelling case against UL,” said Higginbotham, who served on a committee that helped design the program.
Carr expressed support for the initiative in general last week at CES during a fireside chat with Consumer Technology Association CEO Gary Shapiro (see 2601080056). In June, Carr called it a “Biden-era cybersecurity program” (see 2506200059).
The cyber trust mark gives “consumers a certain level of comfort that if they buy a product with that … mark, they have a certain level of protection,” though the mark won’t be “perfect,” Shapiro said at CES. The program has long been a priority for his association.
Carr replied that the program “is a really good concept” and is built on the Energy Star program, which certifies products as energy efficient. “We’re all in on that,” he said. “We hope to get one or more … companies that want to perform the lead administrator role,” and at a minimum, the lead administrator must be "U.S.-based."
Higginbotham told us that even if the cyber label is ready in September, “which would be pretty stunning,” manufacturers couldn't test and certify against the new standard until it’s published. “Then they have to design and make packaging and move those products through inventory,” which means that getting products in circulation “by early next year is incredibly doubtful.”
Other issues also loom, Higginbotham added, noting that ties to China are common for potential lead administrators, “given that certification and testing are often located wherever manufacturing and assembly take place.”
Part of the lead administrator's job is to create the label design and the testing framework that would lead to certification, Higginbotham said. UL submitted a plan to the FCC in June, but “it's unclear if a new lead administrator will want to revisit that work and put their own stamp on it.” Also unclear is whether the FCC will want slightly different things from the program, which may require the new lead administrator to ask for “a new 90-day period to develop a redesigned label or testing framework,” she said.
Summit Ridge Group President Armand Musey warned that initiatives like the cyber mark “usually take longer than expected.” UL's withdrawal and the lack of accredited label administrators don’t “bode well” for a quick launch, he said.
Kristian Stout, innovation policy director at the International Center for Law & Economics, offered a more optimistic outlook on whether products could be ready by the administration’s Jan. 4 deadline. With the lead administrator application window closing this month, “it seems totally plausible (not guaranteed) we could have a new administrator stood up by Q2,” he said in an email.
UL Solutions is based in Illinois and is part of the company founded as Underwriters Laboratories in 1894. After the FCC raised questions, UL addressed its ties to JV Entity, a joint venture between UL and China Certification & Inspection, by withdrawing the joint venture as an FCC-recognized testing laboratory (see 2510170025).