Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

To pursue the U.S. Cyber Trust Mark, first confirm that your product is an eligible wireless consumer IoT product, then assess the complete product against NISTIR 8425, assemble security and lifecycle evidence, complete testing through an eligible route, obtain a conformity report, and apply to a Commission-recognized Cybersecurity Label Administrator (CLA). The FCC program is voluntary. Because administrator authorization and application intake can change, verify the current FCC notice and administrator instructions before setting a budget or launch date.

What the Cyber Trust Mark is—and what it is not

The FCC adopted a voluntary cybersecurity labeling program in March 2024. Its initial focus is wireless consumer IoT products such as home-security cameras, smart appliances, fitness trackers, garage-door openers, and baby monitors. A participating product displays the U.S. Cyber Trust Mark and a QR code leading to a registry with product-specific security information.

The mark is not a general-purpose certification for every enterprise, industrial, or non-wireless product. It is also not permission to display a logo before the FCC or an authorized administrator grants approval. The FCC provides oversight while approved third parties manage application evaluation, label authorization, and consumer education.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Step 1: Decide whether your product is in scope

Start with the consumer-facing product and map every component needed for its advertised functions. The relevant “product” may extend beyond the physical device to include:

#1 Best Overall
Tapo Smart IR & IoT Hub w/ Chime, Matter-Certified, H110, Universal Remote
  • UNIVERSAL REMOTE - SMART HUB FOR 8,000+ BRANDS: Matter-certified IR & IoT hub with built-in alarm. Control TVs, ACs, fans and other smart devices from anywhere with 2.4 GHz WiFi. Voice commands, automations and fast alerts deliver a seamless connected home.
  • EXPANSIVE COMPATIBILITY ACROSS YOUR HOME: Supports 18 appliance types and thousands of IR brands—TV, Air Conditioner, Set-Top Box, Robot Vacuum, Fan, Light, Air Purifier, Humidifier, Water Heater, Electric Heater, Electric Curtain, Projector, Amplifier, DVD, Camera, Foot Tub, Drying Rack, and Box devices. Easily consolidate control for both new and legacy electronics within IR range, replacing multiple remotes with one powerful smart home hub.
  • SEAMLESS VOICE ASSISTANT SUPPORT: Hands-free control with Alexa, Google Assistant or Siri through Matter. Adjust temperature, switch channels and activate routines without touching a remote or phone.
  • REAL-TIME ALERTS WITH BUILT-IN 93 DB ALARM: Connect Tapo sensors for real time alerts on motion, door or window activity. Hear important events with loud audible feedback and customizable tones.
  • FULL REMOTE ACCESS IN THE TAPO APP: Use the Tapo app on iOS or Android to access devices wherever you are. Turn off forgotten appliances, adjust AC settings before arriving home and keep energy use under control.
  • Companion mobile or desktop applications
  • Gateways, hubs, or other supporting hardware
  • Cloud services and backend systems
  • Update mechanisms and other software that controls or protects the device

Use the FCC rules and current program guidance to confirm eligibility. Do not assume that a wireless feature alone makes an enterprise, industrial, or professional system eligible. Record the product model, intended consumer use, communications interfaces, jurisdictions, software versions, and dependencies that will be included in the assessment.

Step 2: Map the complete product to NISTIR 8425

NISTIR 8425, Profile of the IoT Core Baseline for Consumer IoT Products, is the technical foundation identified by the FCC. Build a requirements matrix that assigns an owner, implementation status, and evidence location for each applicable outcome.

Core technical areas

  • Asset identification: maintain an accurate inventory of devices, software, services, and interfaces.
  • Product configuration: provide secure defaults and restrict unnecessary functionality.
  • Data protection: protect data in storage and transit and document the protections used.
  • Interface access control: authenticate users and services, protect credentials, and limit privileges.
  • Software updates: deliver authenticated updates, define support processes, and communicate update behavior.
  • Cybersecurity state awareness: detect or communicate relevant security conditions and failures.
  • Product development and customer information: integrate security into development and provide understandable instructions and disclosures.

Assess interactions between components, not just each component in isolation. A secure device can still fail the product-level assessment if its application, update service, or backend exposes an avoidable weakness.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Shelly Plus Uni Smart Wi-Fi and Bluetooth Operated Module, Dry Contact
  • Shelly Plus Uni is a smart Wi-Fi controlled module designed for low-voltage systems. This compact device offers advanced automation and insightful monitoring, making it ideal for various low-voltage AC and DC applications (8-24 VAC, 9-28 VDC, and 5 VDC). Additionally, it functions as a Wi-Fi range extender and Bluetooth gateway.
  • Compatible with Alexa, Google Home, Home Assistant - Connect your Shelly device to Amazon Alexa, Google Home, Home Assistant, Samsung SmartThings, and other smart home platforms. Control lights and appliances with voice commands, create automations, schedules, and scenes, and manage your smart home from anywhere.
  • From Manual To Smart - Shelly Plus Uni has the unique capability to replace traditional buttons, bringing old appliances into the realm of remote control without the need for replacements. Now, you can easily make your intercom or alarm system smart. Receive instant notifications when someone's at the door and remotely arm or disarm your security system with ease.
  • Stay Connected To Your Gate and Garage - Now, whether you're at home or away, you can effortlessly operate your gate or garage door with your phone. But it doesn't stop there; the reed-switch provides real-time updates, ensuring you always know if they are securely closed or open. This setup simplifies daily routines, whether it's closing the garage from your office or welcoming guests without leaving your home.
  • Shelly is one of the fastest-growing Smart Home brands, offering automation solutions for homes, buildings, and businesses. Device include a 3-year warranty and professional support. With the Shelly Smart Control App, you can configure and manage devices remotely, get real-time notifications, and create personalized scenes by combining Shelly devices to trigger automated actions across your smart home.

Step 3: Build the evidence package before testing

Testing is more efficient when the underlying records are complete and consistent. Prepare a controlled evidence set that can be supplied to the selected lab and CLA.

  • Product description, architecture diagrams, data flows, interfaces, and component inventory
  • Secure-configuration settings, authentication design, credential handling, and access-control rules
  • Software bill of materials or equivalent dependency records, where requested by the applicable procedure
  • Threat-modeling, secure-development, vulnerability-management, and incident-response records
  • Update signing, deployment, rollback, and end-of-support procedures
  • Defined support period and customer communications for patches and security updates
  • Evidence of ongoing conformity and change-control records
  • Accurate registry information, including consumer-facing security explanations

Keep versioned evidence tied to the exact hardware, firmware, applications, and backend release being submitted. Establish a process for reviewing changes after authorization so that a major architecture or support-policy change does not silently invalidate the record.

Step 4: Choose an eligible testing route

The FCC framework identifies three possible testing routes: an accredited and FCC-recognized CyberLAB, a CLA Lab, or a manufacturer in-house lab. The applicant must obtain a report of conformity and compliance. Recognition and accreditation are scope-specific, so verify status rather than relying on a lab’s general cybersecurity credentials.

Rank #3
Sale
Kasa Smart Plug Mini 15A, EP25P4, Apple HomeKit Supported
  • 【Apple Homekit Support】This Apple HomeKit compatible smart plug fully integrates into your Apple ecosystem, just ask Siri to turn on/off the devices in your home. (Apple HomeKit remote control requires an additional networked Apple device at home such as an iPad, HomePod or Apple TV.)
  • 【Energy Monitoring & 15A Max Load】Use the smart Wi-Fi home plug to monitor your connected device's energy usage in real-time and view its historical power consumption within the Kasa Smart app. 1800W, 15A max load supported.
  • 【Super Easy Setup】Enjoy an extremely easy and quick setup process with this Amazon Frustration-Free Setup (FFS) & Google Seamless Setup (GSS) supported smart plug. You can also setup in a few steps with the Kasa App.
  • 【Compact & Flame Retardant Design】Avoid blocking additional outlets with its compact design, and plug in your WiFi smart plug with confidence thanks to its UL certified flame retardant design and 2-year limited warranty.
  • 【App & Voice Control】Control your WiFi smart plug from anywhere, anytime via the free Kasa App or just give voice commands to Siri, Amazon Alexa, Google Assistant or Samsung SmartThings. Your favorite smart assistant enables you to have a truly hands-free experience. Operating Humidity: 5%~90% RH, Non-condensing
Route What to verify Key trade-off
CyberLAB Current accreditation, FCC recognition, product and standard scope, approved test method, and report acceptance by your chosen CLA Independent testing may simplify credibility, but the lab must understand all product components and the selected administrator’s requirements.
CLA Lab That the lab is authorized under the relevant CLA, covers the product’s components, and uses the latest accepted procedure Coordination with the administrator may be direct, but scope and independence requirements still apply.
Manufacturer in-house lab Accreditation and FCC-recognition requirements, qualified personnel, controlled methods, and acceptance by the CLA Existing capability can reduce external coordination, while evidence of impartiality, competence, and controls may be more demanding.

Before signing a statement of work, ask for the lab’s current recognition evidence, exact scope, test version, treatment of companion software and cloud services, retest policy, and confirmation that the selected CLA accepts its reports.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Step 5: Apply through a recognized Cybersecurity Label Administrator

Submit the conformity report, compliance evidence, product information, and any other materials required by the selected CLA. The CLA evaluates the application under its procedures and, when requirements are met, authorizes use of the FCC IoT Label.

Compare administrators on criteria that can change:

Rank #4
Tapo Smart Hub with Built-in Chime, H100, 2.4GHz Wi-Fi Required
  • Reliable Long-Range Connections: The Tapo Hub operates on a lower frequency broadband, resulting in fewer signal interferences and ensuring stable connectivity for all your devices throughout your home. With a maximum connection distance of up to 30m, the Tapo Hub outperforms wireless network systems in the 2.4 GHz band. Our internal laboratory tests confirm the coverage and range of the Tapo Hub, but keep in mind that actual results may vary depending on environmental conditions.
  • A Low-Power Way to Connect Everything- The Tapo Hub serves as the central hub for your Tapo smart home, linking smart sensors, switches, and buttons via an ultra-low power wireless protocol. This technology extends the battery life of devices by up to 10 times, in contrast to devices powered by the Wi-Fi protocol.
  • Smart Action- With Tapo Smart Hub H100, you can trigger a Shortcut or control Tapo devices (such as smart plugs, smart lights and smart switches) based on sensor detection or with a button press. (Tapo H100 cannot directly connect to Tapo smart plugs or smart lighting, 2.4GHz Wi-Fi is required.)
  • All Devices in One Hub- Each Tapo Hub can connect up to 64 Tapo devices throughout your home. Build and manage your smart home ecosystem with ease.
  • Protect Your Home Day and Night- By integrating with Tapo motion sensors, door/window sensors, and other devices, the Tapo Hub can activate a high-decibel siren (up to 90 dB) to alert of potential hazards or discourage intruders.
  • Current FCC authorization status
  • Accepted lab routes and report formats
  • Required evidence and registry fields
  • Communication and deficiency-resolution process
  • Change, renewal, and post-market surveillance procedures
  • Published fees and service-level expectations

Do not display the Cyber Trust Mark, reproduce it in packaging, or represent a product as labeled until the relevant authorization has been granted.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Step 6: Prepare the consumer-facing registry record

The QR code is intended to take consumers to understandable, product-specific information rather than a generic security statement. FCC materials describe disclosures such as the product’s support period, whether patches and security updates are automatic, and instructions for changing a default password. Treat these as examples of the information consumers need, and confirm the mandatory fields in the current rules and administrator procedure.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Write disclosures for a non-specialist reader. State which products and software versions are covered, how updates are delivered, how long support is expected to continue, and where a customer can obtain security assistance. Keep the registry record synchronized with the product’s actual behavior.

Step 7: Maintain conformity after authorization

Authorization is not the end of the security program. Maintain a release and evidence process that covers:

  • Security-impact review for firmware, application, backend, and hardware changes
  • Continued vulnerability intake, triage, remediation, and customer notification
  • Authenticated update delivery and monitoring of failed or incomplete updates
  • Accurate support-period and update disclosures
  • Registry updates when product details or security practices change
  • Records demonstrating ongoing conformity and any required surveillance

Confirm the exact renewal, material-change, reporting, and post-market requirements with the current CLA. The applicable operational steps are not fixed by the high-level program description alone.

Is the program accepting applications now?

The FCC announced conditional approval of 10 Cybersecurity Label Administrators in December 2024. The official material summarized here does not establish whether those administrators subsequently received full authorization or whether product applications are currently being accepted. Check a current FCC notice and the administrator’s own intake instructions before committing engineering resources, lab work, or launch dates.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

No reliable current fee schedule or processing-time estimate is established here. Treat any quotation or timeline as administrator-specific and date-sensitive.

A practical readiness checklist

  1. Define the consumer use case and confirm wireless IoT scope with current FCC guidance.
  2. Inventory the device, applications, gateways, backend services, update systems, and external dependencies.
  3. Map each applicable NISTIR 8425 outcome to an implementation owner and evidence.
  4. Close gaps in secure defaults, access control, data protection, updates, state awareness, and customer information.
  5. Freeze the release candidate and version all hardware, firmware, applications, and services under assessment.
  6. Shortlist eligible labs and verify recognition, accreditation, scope, method, and CLA report acceptance.
  7. Assemble the conformity evidence and consumer registry content.
  8. Confirm the selected CLA’s current authorization, intake status, fees, and change requirements.
  9. Submit the application and resolve documented deficiencies.
  10. After authorization, operate the monitoring, update, support, and registry-maintenance process.

Who oversees the program?

The FCC is the lead agency for the Cyber Trust Mark program. NIST supplies the technical foundation through its consumer IoT cybersecurity work, including NISTIR 8425. The FCC’s order and March 14, 2024 announcement describe the voluntary label, QR-linked registry, and public-private administration model; the Federal Register final rule dated July 30, 2024 provides the adopted rule text.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.