ACCREDITATION BODIES FOR THE U.S. CYBER TRUST MARK PROGRAM

WASHINGTON (September 28, 2026)

PUBLIC SAFETY AND HOMELAND SECURITY BUREAU RECOGNIZES ACCREDITATION BODIES FOR THE U.S. CYBER TRUST MARK PROGRAM - Public Notice

The Bureau finds that the following entities have demonstrated they have the credentials, qualifications, and competence in assessing CLAs and  CyberLABs that perform assessments and testing in support of the USCTM Program:

American Association for Laboratory Accreditation’s (A2LA)

ANSI National Accreditation Board (ANAB)

REF:

Action by: Chief, Public Safety and Homeland Security Bureau. DA-26-1029A1.docx DA-26-1029A1.pdf DA-26-1029A1.txt

Europe Radio Equipment Cybersecurity update

On January 30, 2025, EN 18031-1, -2 and -3 were listed in the Official Journal of the European Union thus now harmonized to give "presumption of conformity" with the essential requirements set out under articles 3.3 d, e, and f, of the Radio Equipment Directive, however with some conditions and limitations.

These standards where originally released on September 2, 2024.

EN 18031-1:2024 (Common security requirements for radio equipment - Part 1: Internet connected radio equipment)

EN 18031-2:2024 (Common security requirements for radio equipment - Part 2: radio equipment processing data, namely Internet connected radio equipment, childcare radio equipment, toys radio equipment and wearable radio equipment)

EN 18031-3:2024 (Common security requirements for radio equipment - Part 3: Internet connected radio equipment processing virtual money or monetary value)

It's important to note that these are framework standards defining common security requirements and assessment methods, not test standards.

 REF:

 Commission Delegated Regulation (EU) 2022/30

Document 32025D0138 

 

U.S. Cyber Trust Mark

Today (July 18, 2023) the White House announced a proposed voluntary cybersecurity certification and labeling program and the U.S. Cyber Trust Mark for smart devices. 

The Federal Communications Commission (FCC) intends the use of a QR code linking to a registry of certified devices and giving specific security information about the smart device. Working with other regulators and the U.S. Department of Justice the Commission plans to establish oversight and enforcement safeguards to maintain the trust and confidence in the program.

The National Institute of Standards and Technology (NIST) will immediately undertake efforts to define cybersecurity standards for consumer grade routers, a high-risk type of product. This work is to be completed by the end of 2023.

The U.S. Department of Energy announced a collaborative effort with National Labs and industry partners to research and develop cybersecurity labeling requirements for smart meters and power inverters.

The U.S. Department of State will support the FCC to engage allies and partners toward the harmonization of standards and pursue mutual recognition of similar labeling efforts.

REF:

https://www.whitehouse.gov/briefing-room/statements-releases/2023/07/18/biden-harris-administration-announces-cybersecurity-labeling-program-for-smart-devices-to-protect-american-consumers/

https://docs.fcc.gov/public/attachments/DOC-395185A1.pdf

 

U.S. FCC, cyber security standards and guidelines

US Federal Communication Commission is seeking comments for building cyber security into the equipment authorization program through standards and guidelines.  

Commenting period open until September 20, 2021, reply comments are due before October 18, 2021.

 

REF:

ET Docket No. 21–232, EA Docket No. 21– 233; FCC 21–73; FRID 39556

Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program and the Competitive Bidding Program

Cybersecurity risks bring new European regulations

 Cybersecurity risks to personal privacy, fraud, and the security of the open internet are of paramount concern for our interconnected, digitally dependent world, and the European Union is among the first economies to enact wide-reaching legislation to address the growing concerns of cybersecurity risks. 

Significant changes are coming concerning regulations and requirements for equipment covered by the EU Radio Equipment Directive (RED 2014/53/EU). To say significant may be an understatement. In today’s connected world virtually all personal electronics we use today are impacted by the changes coming one way or another, and most of them on the market would not meet these higher standards today.

Breakdown of the new requirements

1. New delegated regulation and activation of additional Radio Equipment Directive essential requirements for certain categories or classes of specific types of radio equipment.
1. Covering aspects of cybersecurity and internet-connected radio equipment, key points on the essential requirements are addressed.
1. Protection from harm to the network - Art 3.3(d)
2. protection of personal data, the privacy of users and subscribers - Art 3.3(e)
3. protection from fraud- Art 3.3(f)
2. Applicable to new categories or classes of equipment which are;
1. All Internet-connected radio equipment
2. Childcare radio equipment (internet-connected or not)
3. Toys with radio functionality (internet-connected or not)
4. Wearable electronics (internet-connected or not)
3. Internet-connected means capable of communication over the internet, directly or indirectly such as using an intermediary, an example of which is a cell phone.
4. Specific medical radio equipment and in vitro diagnostic medical devices falling under regulations (EU) 2017/745 and (EU) 2017/746 respectively, already have requirements to address these elements of cybersecurity and therefore are excluded from these new Radio Equipment Directive categories or classes.
5. Regulations related to Vehicles, Civil Aviation, and electronic road toll systems address some elements of cybersecurity related to Art 3.3(e) and Art 3.3(f) and are therefore excluded from the Radio Equipment Directives requirements on these aspects.
2. The exact technical requirements for compliance with these essential requirements are not defined at this time. The European Committee for Standardization (CEN), The European Committee for Electrotechnical Standardization (CENELEC), and the European Telecommunications Standards Institute (ETSI) shall prepare a work program indicating the standards and a timetable for implementation. A draft is expected 2 months after notification of the delegated regulation.
3. The new regulations shall apply 30 months after entry into force which is estimated to be around April 2024

Instructions for US Stakeholders wishing to submit comments on these new requirements

How to Comment  

Please limit comments to the draft Delegated Act only.

REF:

Draft Delegated Act