The Federal Communications Commission adopted a voluntary cybersecurity labeling framework for qualifying wireless consumer IoT products. The program uses the
Official source publication date: . AndroidSBC review date: 2026-10-26.
What did the FCC establish?
On 14 March 2024, the U.S. Federal Communications Commission adopted the framework for a voluntary cybersecurity labeling program for qualifying wireless consumer Internet of Things products.
Key points from the official publication
- The program is voluntary and is intended to help consumers identify qualifying connected products that meet the program’s cybersecurity criteria.
- The label is called the U.S. Cyber Trust Mark.
- The FCC framework includes a QR code connected to a product registry that provides consumer-facing security information.
- The program draws on cybersecurity criteria developed by the U.S. National Institute of Standards and Technology.
- Eligibility and authorization attach to the qualifying finished consumer IoT product and its evidence; they must not be inferred from a generic Android motherboard page.
Practical actions for an Android product project
- Separate board-level technical evidence from finished-device program eligibility.
- Plan secure default configuration, update handling, vulnerability response and public product information.
- Keep model, hardware, software and wireless configuration identifiers consistent across testing and registry records.
- Do not display the mark until the responsible finished product has completed the applicable authorization process.
What does this mean for Android board and embedded-device projects?
A board supplier and finished-device manufacturer should separate component evidence from product-level eligibility. Plan device identity, secure configuration, software updates, vulnerability handling, documentation and the final wireless product assessment before making any label claim.
What should buyers and engineering teams verify?
- The exact board, PCB revision, SoC, BSP branch, kernel and Android build.
- The finished product’s intended use, wireless modules, enclosure and destination market.
- Security-update ownership, vulnerability contact, support period and incident process.
- Which controlled report, declaration or certificate applies to the exact configuration.
This article is an engineering summary, not legal or conformity-assessment advice. Requirements can change; confirm the current official text and obtain qualified local advice for the finished product.
Buyer FAQ
Common procurement and engineering questions related to this update are answered below. Project decisions must use the current official requirements and the exact product configuration.
Is an Android board automatically eligible to display the U.S. Cyber Trust Mark?
No. The mark relates to a qualifying finished wireless consumer IoT product that completes the applicable program process. A component page or generic security claim is insufficient.
What should be prepared for a U.S. connected-product security review?
Prepare exact product and firmware identification, wireless configuration, secure defaults, update mechanism, vulnerability process, support information, test evidence and consumer-facing registry information.
Can AndroidSBC promise Cyber Trust Mark approval?
No. AndroidSBC can provide board and BSP information for an engineering assessment, but program eligibility, testing, authorization and use of the mark belong to the responsible finished-product applicant.
Official primary source
Primary source
U.S. Federal Communications Commission
Read the original official publication
Source URL: https://docs.fcc.gov/public/attachments/DOC-401201A1.pdf
Editorial note: This is an original AndroidSBC engineering summary of the cited official publication. It is not legal advice and does not claim that every Android board or finished device is certified for the named market.
