In this article, the authors discuss a recent Notice of
Proposed Rulemaking issued by the Federal Communications Commission
in which the agency takes a broad view of its authority to enact a
cybersecurity labeling regime for Internet of Things
devices.
In a new Notice of Proposed Rulemaking (NPRM),1 the
Federal Communications Commission (FCC or Commission) imposes a
short comment deadline for a complex new cybersecurity labeling
regime for Internet of Things (IoT) devices. The NPRM also reveals
that the agency – which traditionally has not regulated in
the area of cybersecurity – is taking a broad view of its
authority to enact this program.
At a high level, the NPRM proposes that participating entities
will be able to display a Commission-created "IoT
cybersecurity label" on their connected devices (the U.S.
Cyber Trust Mark),2 indicating conformance with
"widely accepted cybersecurity standards." Although other
parts of the federal government have considered IoT
