Federal Communications Commission	DC 26-834



DA 26-834
Released:  August 11, 2026

PUBLIC SAFETY AND HOMELAND SECURITY BUREAU ANNOUNCES CONDITONALLY APPROVED CYBERSECURITY LABEL ADMINISTRATORS AND OPENS FILING WINDOW FOR CYBERSECURITY LABEL ADMINISTRATOR APPLICATIONS UNDER THE U.S. CYBER TRUST MARK PROGRAM

PS Docket No. 23-239

By this Public Notice, the Public Safety and Homeland Security Bureau (Bureau) announces the conditional approval of two additional Cybersecurity Label Administrators (CLAs) for the Federal Communications Commission’s (FCC or Commission) voluntary cybersecurity labeling program for consumer wireless Internet of Things (IoT) products (U.S. Cyber Trust Mark (USCTM) Program) and reiterates program obligations. Cybersecurity Labeling for Internet of Things, PS Docket No. 23-239, Report and Order and Further Notice of Proposed Rulemaking, 39 FCC Rcd 2497, 2525, 2523, paras. 42, 53 (2024) (IoT Labeling Order).
  The Bureau finds that the following entities meet the Commission’s program criteria and requirements and conditionally approves each to serve as a CLA: 
IIA Lab Services, LLC 
Element Materials Technology Portland – Evergreen, Inc.
By this Public Notice, the Bureau also announces the opening of a new filing window for applications from entities seeking authority to be recognized as a CLA.  This CLA application filing window will open on August 11, 2026 and will remain open until closed by the Bureau. The IoT Labeling Order delegated authority to the Bureau to open additional application filing windows, as necessary, for entities seeking authority to be recognized by the Bureau as a CLA.  IoT Labeling Order, 39 FCC Rcd at 2523, 2532, paras. 51, 64.
  
I. CLA RESPONSIBILITIES
CLAs will be responsible for certifying use of the FCC IoT label and USCTM and day-to-day management of the program. IoT Labeling Order, 39 FCC Rcd at 2526, para. 55 (subject to Commission oversight CLAs will evaluate and grant or deny requests to use the FCC IoT Label); 47 CFR § 8.220(f)(11).
  The Commission retains ultimate control and oversight over the program as the USCTM Program owner. IoT Labeling Order, 39 FCC Rcd at 2519-20, paras. 40-41 (Commission fosters public-private collaboration, including with regard to administration of the program, while retaining ultimate control and oversight of the program).
  CLAs are responsible for sharing the Lead Administrator’s costs in performing its Lead Administrator duties on behalf of the program. IoT Labeling Order, 39 FCC Rcd at 2543, para. 93.
  CLAs will review for reasonableness the Lead Administrator’s estimated forward-looking costs which have been submitted to the Bureau and the Office of Managing Director (OMD), which will include program stand-up costs and ongoing program costs to perform the Lead Administrator’s duties for the upcoming calendar year. See Public Safety and Homeland Security Bureau Announces 15-Day Filing Window for Cybersecurity Labeling Administrator and Lead Administrator Applications Under the Cybersecurity Labeling for Internet of Things Program, PS Docket No. 23-239, Public Notice, 39 FCC Rcd 10372, 10380, paras. 18-19 (Sept. 10, 2024) (Initial Filing Window Public Notice).
  If these estimated costs are determined by the Bureau and OMD to be reasonable, they will be used to estimate the overall CLA cost sharing obligation.  Each CLA will work with the Lead Administrator and other CLAs, subject to Commission oversight, to develop a reasonable and equitable cost sharing methodology whereby CLAs will share in the Lead Administrator’s expenses incurred as a result of the performance of its duties under this program.  The cost sharing methodology will be subject to ongoing oversight by the Commission.
Each CLA must undertake the duties outlined in the IoT Labeling Order, which include but are not limited to participation in the ongoing Lead Administrator-led stakeholder engagement process, participation in the development of a consumer outreach campaign, and only after the Trademark Use Agreement has been signed, execution of the consumer outreach campaign.  IoT Labeling Order, 39 FCC Rcd at 2523-28, paras. 51-58 (detailing the duties of the CLAs); see also 47 CFR § 8.220.

Each entity’s CLA approval is conditioned upon its execution of a Trademark Use Agreement The Commission anticipates that it will periodically amend the Trademark Use Agreement as we gain experience in the program.  The Trademark Use Agreement will not be transferable.  That means that once executed, a CLA may not transfer the Trademark Use Agreement, or any interest in the Trademark Use Agreement, to another party.  A purported transfer in violation of this would annul the Trademark Use Agreement, except that all rights pertaining to the FCC would be reserved.
 with the FCC, and its commitment to obtain International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 17065 accreditation with the appropriate FCC program scope within six (6) months of the effective date of the Commission’s adoption of IoT cybersecurity labeling standards and testing procedures. See 47 C.F.R. § 8.220(c)(6) (The Commission will accept and conditionally approve a CLA application provided the entity obtains accreditation to ISO/IEC 17065 with the appropriate scope within six (6) months of the effective date by the adopted standards and testing procedures and otherwise meets the FCC’s IoT Labeling Program requirements).  IoT Labeling Order, 39 FCC Rcd at 2532, para. 64.
  Conditionally approved CLAs are not authorized by the Commission to approve the use of the FCC IoT Label.  The Bureau will only approve a CLA to accept and process manufacturer applications and authorize use of the FCC IoT Label, including the Trust Mark, after the CLA has executed the Trademark Use Agreement, demonstrated to the Bureau that it has obtained ISO/IEC 17065 accreditation with the FCC’s program scope, and demonstrated compliance with other CLA requirements (e.g., development of a cybersecurity risk management plan). Upon a CLA’s successful ISO/IEC 17065 accreditation with the FCC scope, and compliance with additional program requirements, PSHSB will release a public notice announcing that a CLA has moved from conditional approval to full approval and has authorization to accept and process manufacturer applications.
  
Further, to address national security concerns, the authority of CLAs to grant applications to use the FCC IoT Label under the USCTM Program, will automatically terminate if the CLA subsequently becomes owned or controlled by or affiliated with an entity that produces equipment found on the Covered List, or otherwise added to any exclusionary list identified in the IoT Labeling Order as precluding authorization as a CLA. IoT Labeling Order, 39 FCC Rcd at 2530-31, paras. 61, 63.

  A CLA’s authority may also be terminated for failure to uphold the required competencies or accreditations enumerated in the IoT Labeling Order, including those addressing national security risks. Id. at 2531, para. 63.
  As noted above, CLAs are conditionally approved pending ISO/IEC 17065 accreditation with the Commission’s program scope.  CLAs may apply for accreditation after the Commission has established accreditation program(s) with FCC-recognized accrediting bodies.  Once a CLA has obtained the appropriate accreditation, it will notify the Bureau and request Bureau recognition.  Once it has been recognized by the Bureau, a CLA will be authorized to approve applications for authority to affix the FCC IoT Label to products that comply with all of the program requirements.
Each of the parties listed above is advised that its selection does not constitute FCC or United States Government approval, acceptance, or endorsement of anything other than the organization’s participation in the administration of the USCTM Program, and they shall not so construe, claim, or imply such.  By accepting their roles, each party similarly acknowledges that activities undertaken in connection with the administration of the USCTM Program are voluntary and not intended to provide goods or services to the FCC or any other agency or instrumentality of the United States Government.  The selected entities may not submit claims for compensation to the FCC or any other agency or instrumentality of the United States Government for activities related to its role as CLA.  Moreover, each party’s selection does not obligate funds for any particular expenditure, nor does it authorize the transfer of funds and/or resources.  The Commission does not intend to commit funds on behalf of the FCC or any other agency or instrumentality of the U.S Government for the administration of the USCTM Program nor does it provide for the payment of funds by any agency or instrumentality of the U.S. Government to any entity. As outlined in the IoT Labeling Order, “to the extent that the Lead Administrator may incur costs in performing its duties on behalf of the program as a whole, we expect these costs to be shared among CLAs as a whole.”  IoT Labeling Order, 39 FCC Rcd at 2543, para. 93.
  Each selected party accepts the risk of loss in engaging in its respective roles in the USCTM Program.
II. CLA APPLICATION PROCEDURES
By this Notice, the Bureau opens a new filing window for applications for CLA, which will remain open until closed by the Bureau.  The Bureau outlined the format of CLA applications and the process for Bureau selection of these administrators, among other issues, in its September 2024 Initial Filing Window Public Notice. Initial Filing Window Public Notice, 39 FCC Rcd at 10373-86, paras. 3-32 (setting forth the format, filing fees, and selection process for CLA and Lead Administrator applications, as well as Lead Administrator cost-sharing among the CLAs, guardrails for Lead Administrator neutrality, and confidentiality and security requirements).
  The Bureau also provided guidance for who may apply and the relevant application procedures. Initial Filing Window Public Notice, 39 FCC Rcd at 10386-91, paras. 33-41.
  Applicants for CLA are advised to follow the same instructions, including the general filing instructions, provided in the Initial Filing Window Public Notice, as well as the additional guidance on confidential filing requirements published in October 2024. Initial Filing Window Public Notice, 39 FCC Rcd at 10395, Appx. A; Public Safety and Homeland Security Bureau Provides Additional Guidance on Confidential Filing Requirements for Cybersecurity Label Administrator and Lead Administrator Applications Under the Cybersecurity Labeling for Internet of Things Program, PS Docket No. 23-239, Public Notice, 39 FCC Rcd 10972 (PSHSB Oct. 3, 2024).
  We reiterate that conditionally approved CLAs are obligated to maintain their commitments made under their applications, including, demonstrations and certifications provided with respect to national security, obtaining accreditation pursuant to all of the requirements associated with ISO/IEC 17065 with the forthcoming FCC program scope, and implementing and updating cybersecurity risk management plans. Initial Filing Window Public Notice, 39 FCC Rcd at 10385, 10386-89, 10390-91, paras. 30, 33-35, 37.

The Bureau will, on a rolling basis, review CLA applications for compliance with the criteria set forth in the IoT Labeling Order and to best ensure the success of the program. The Bureau may request clarifying information from applicants in its review, as needed.
  The Bureau’s selection of CLA(s) will be announced by public notice.
People with Disabilities  
To request materials in accessible formats for people with disabilities (Braille, large print, electronic files, audio format), send an e-mail to fcc504@fcc.gov or call the Consumer & Governmental Affairs Bureau at 202-418-0530 (voice).
Privacy Act Statement 
Authority.  The FCC is authorized to collect the information pursuant to the authority contained in sections 1, 2, 4(i), 4(n), 302, 303(r), 312, 333, and 503, of the Communications Act of 1934, as amended, 47 U.S.C. §§ 151, 152, 154(i), 154(n), 302a, 303(r), 312, 333, 503; the IoT Cybersecurity Improvement Act of 2020, 15 U.S.C. § 278g-3a to § 278g-3e.
Purpose.  The information collected in CLA applications includes contact and certification information from entities voluntarily applying to serve as CLA in this FCC program.  The information is used to communicate with such entities and enforce their compliance with statements made in their applications.
Routine Uses.  While CLA applications will be presumed confidential, in addition to those disclosures generally permitted under 5 U.S.C. § 552a(b) of the Privacy Act of 1974, as amended, the FCC may disclose contact and certification information collected from applicants as is determined to be relevant and necessary, outside the FCC as a routine use pursuant to 5 U.S.C. § 552a(b)(3), including: to authorized third parties to administer, support, participate in, or receive information related to FCC programs and activities; to other Federal agencies in order to administer, support, participate in, or receive information related to FCC programs and activities; and to non-federal personnel, including contractors, who have been engaged to assist the FCC in the performance of a contract service, grant, cooperative agreement, or other activity related to this system of records and who need to have access to the records in order to perform their activity.  A full, detailed list of the routine uses is published in the system of records notice associated with this collection, FCC-2, Business Contacts and Certifications, which is available at https://www.fcc.gov/sites/default/files/sor-fcc-2.pdf.
Disclosure.  This information collection is voluntary.  The Bureau’s Public Notice provides entities the opportunity to apply to be designated a CLA.
For further information regarding this proceeding, please contact Zoe Li, Attorney Advisor, Cybersecurity and Communications Reliability Division, Public Safety and Homeland Security Bureau at CyberTrustMark@fcc.gov.


Action by the Chief, Public Safety and Homeland Security Bureau.

-FCC-
2