The United States government has launched the Cyber Trust Mark, a new initiative to enhance consumer confidence in smart home devices. Similar to the Energy Star label for energy efficiency, this mark signifies that a device meets rigorous standards for cybersecurity. Companies can voluntarily apply for the label by having their products tested by accredited labs. Consumers can expect to see products bearing the Cyber Trust Mark on store shelves by the end of 2025, as companies are now submitting their products for evaluation. Features such as unique default passwords, software updates, and data protection are essential for certification. Consumers will also have access to a QR code for additional security information. Devices meeting the cybersecurity criteria set by the National Institute of Standards and Technology will display the Cyber Trust Mark. The mark is expected to appear on store shelves in 2025 and will be mandatory for federal government purchases by 2027.
The Cyber Trust Mark program could lead to challenges and opportunities for Managed Services Providers. On the one hand, the requirement for devices to meet new cybersecurity standards may necessitate MSPs reevaluating the products they recommend or support. This could lead to the need for additional training or expertise in the newly certified devices, thereby increasing operational costs. On the other hand, the program presents an opportunity for MSPs to enhance service offerings centered around compliance and security assessments. As organizations look to ensure that their IoT deployments align with the Cyber Trust Mark standards, MSPs could position themselves as essential partners in navigating these regulations. This could include services such as compliance audits, security assessments, and ongoing monitoring of IoT device security, now with entrance criteria on hardware.
Let me also note something else – The association that will be left after the CompTIA brand is sold has a problem on its hands now. The Trust Mark name broadly, but specifically the Cybersecurity Trustmark (with no space between the name), is now untenable. Cyber Trust Mark by the US Government has squished it. The new association has a dual problem – its own brand rebuilding and how (or if) to restart this initiative. It’s a good opportunity rather than focus on technical certification, which the for-profit CompTIA will do, instead focus on criteria for professionalism in the industry.