Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products

In this report, NIST was directed to “identify IoT cybersecurity criteria for a consumer labeling program, and shall consider whether such a consumer labeling program may be operated in conjunction with or modeled after any similar existing government programs consistent with applicable law. The criteria shall reflect increasingly comprehensive levels of testing and assessment that a product may have undergone, and shall use or be compatible with existing labeling schemes that manufacturers use to inform consumers about the security of their products.”

The goal of this document is to provide recommendations, additional information, and context related to these responsibilities for use by a scheme owner creating the consumer IoT product labeling program.