Smart cameras, speakers, plugs and thermostats are only as safe as the software and settings behind them, and until now buyers have had little way to compare. This guide explains the federal technical baseline that a planned “U.S. Cyber Trust Mark” is built on, and what it suggests you should look for.
Why do smart devices need a security baseline at all?
A connected gadget is a small computer that sits on your home network, often for years. It may hold a camera feed, a microphone, a Wi-Fi password or a record of when you are home. Unlike a laptop, it rarely asks for attention: you plug it in, pair it with an app and forget it.
That is the problem a baseline tries to solve. Security features such as a way to update software or to change a default setting are easy to skip when a product is cheap to make and the buyer cannot see inside it. A shared list of expected capabilities gives manufacturers a common target and gives regulators, retailers and eventually shoppers something concrete to check against.
The category is usually called the Internet of Things, or IoT. In this guide, “smart device” means any consumer product that connects to the internet or a home network and is controlled through an app or voice.
What is the NIST baseline for consumer IoT products?
The National Institute of Standards and Technology (NIST) is a U.S. federal standards agency. According to NIST, on September 19, 2022 it published NIST IR 8425, titled Profile of the IoT Core Baseline for Consumer Products, which NIST describes as “the final version of NIST’s recommendations for Cybersecurity features in Consumer IoT Products.”
The document has a traceable history, according to NIST’s program timeline:
| Date | Milestone |
|---|---|
| August 31, 2021 | Draft baseline security criteria for consumer IoT devices |
| February 4, 2022 | White paper with recommended criteria for consumer IoT labeling |
| June 17, 2022 | Draft NIST IR 8425 |
| September 19, 2022 | Final NIST IR 8425 |
NIST’s FAQ says the criteria were first published in February 2022 in that white paper, and the requirements were later published separately as IR 8425. They trace back to May 2021’s Executive Order 14028, which, according to NIST, directed the agency to “identify IoT cybersecurity criteria for a consumer labeling program.”
What does the baseline actually cover?
NIST says its core baselines are generic starting points covering two things: device technical capabilities and non-technical supporting capabilities. Two companion documents split the work. IR 8259A defines the technical capabilities a device should have, while IR 8259B defines supporting capabilities that sit with the manufacturer, such as user training material and vulnerability disclosure programs.
Two features of the approach matter for ordinary buyers.
It is written as outcomes, not parts
NIST’s FAQ says the capabilities are written as outcomes “intended to apply to the entire IoT product.” In other words, the baseline describes what a product should achieve rather than dictating a particular chip or protocol. That keeps it usable across very different devices, from a doorbell to a fitness tracker.
It covers the whole product
“Entire product” is significant. A smart plug is not just the plug: it is also the phone app, the account system and the cloud service that make it work. A baseline that stopped at the hardware would miss many of the places where real-world problems appear.
NIST also notes that the consumer profile can serve as a starting point for small businesses buying IoT products, which matters for offices that use the same cameras and sensors as homes.
How does the Cyber Trust Mark fit in?
According to NIST, on July 18, 2023 the White House announced the “Cybersecurity Labeling Program for Smart Devices to Protect American Consumers,” referred to as the “U.S. Cyber Trust Mark,” with participation by the Federal Communications Commission (FCC). NIST’s FAQ says the FCC leads the program, NIST advises the FCC on technical matters, and IR 8425 supplies the technical criteria the program is based on.
The design is straightforward in principle. A manufacturer that meets the criteria could display a recognizable mark on a product, much as an energy rating or a safety certification appears on appliances today. Shoppers would not need to read a standards document; the mark would signal that the product was assessed against it.
Program details such as who may apply, how products are tested and when labeled items reach stores can change as rulemaking proceeds. Readers who want the current status should check the FCC’s own program page rather than rely on retail marketing, and should treat any product claiming the mark before the FCC confirms it with caution.
Is a security label a guarantee?
No, and it is worth being clear about what a baseline can and cannot do.
- It sets a floor, not a ceiling. NIST describes its baseline as a generic starting point. For products with higher risk, NIST says a more specific profile may add criteria.
- It cannot predict future flaws. Software of any kind can have bugs found later. What a baseline can require is that a product has a sound way to receive fixes.
- It depends on follow-through. A label is only as useful as the testing and oversight behind it, which is why the process around the mark matters as much as the criteria.
- Your own settings still count. A well-built camera with a weak shared account password is still a weak setup.
NIST has also produced router-specific work. The agency’s consumer IoT page notes that the White House directed NIST to define cybersecurity requirements for consumer routers, and that a draft NIST IR 8425A was published on April 17, 2024. Routers get separate attention because they sit between every other device and the internet.
What can you check before buying a smart device today?
Until a labeling scheme is widely visible on shelves, the baseline’s themes translate into reasonable shopping questions. These are general consumer-safety suggestions rather than requirements drawn from a particular rule.
- Does the maker say how long it will provide security updates? A product with no stated support period is a gamble.
- Can you change the sign-in details? Avoid any device that forces a shared or fixed password.
- Is there a way to report a problem? A published contact for security researchers suggests the maker expects to fix flaws, which echoes the vulnerability disclosure idea in NIST’s supporting capabilities.
- Does it need an account and cloud service to work at all? Consider what happens to the device if the service closes.
- Does it ask for more access than it needs? A lamp does not need microphone permission.
- Is there a clear way to reset and sell or discard it? You should be able to restore a secure default and wipe your data.
How should you set up and maintain devices at home?
Good buying helps, but upkeep matters just as much, because a device is exposed for its entire life on your network.
- Change defaults at once. Replace any factory sign-in details with a long, unique password, and use a passkey where an account supports it. Our guide on what passkeys are and whether to use them explains how they work.
- Turn on updates. Automatic updates are generally the simplest way to receive fixes. Check the app now and then to confirm they are working.
- Keep devices on a guest network. Many routers can place smart gadgets on a separate network from your computers and phones, limiting what a compromised gadget can reach.
- Remove what you no longer use. An old camera still on the network is an unattended door. Reset it and delete the linked account.
- Be wary of urgent alerts. Fraudsters sometimes imitate security warnings; see how fake security alerts fuel imposter scams.
Longer-term, the security of everything in this list depends on cryptography that researchers are already preparing to upgrade; our explainer on post-quantum encryption and what it means for you covers that.
What the label could change, and what to watch next
If the Cyber Trust Mark reaches shelves, its biggest effect may be on manufacturers rather than shoppers. A visible mark gives makers a commercial reason to build update paths and disclosure processes that buyers cannot easily see. For households, it would turn a vague worry into a simple question: does this product carry a recognized mark, and does the maker support it?
For now, the practical picture is uneven. The technical criteria have been public since September 2022, and the program is led by the FCC with NIST advising. Signs of progress to watch include FCC announcements on how manufacturers apply, how labels are verified, and when products first appear. Until then, the best protection is a mix of careful buying, prompt updates and sensible network habits. When a product’s age or support status is unclear, our look at whether you actually need to upgrade your phone offers a useful way to think about how long a connected device should stay in service.
A baseline is a starting point for safer homes
The NIST consumer IoT baseline is a plain idea: agree on the security capabilities a connected product should have, write them as outcomes for the whole product, and build a recognizable label on top. The Cyber Trust Mark is the planned public face of that effort, but it is a floor rather than a promise of perfect safety. Shoppers who ask about updates, sign-in controls and support periods, and who keep devices tidy after setup, will get most of the benefit whether or not a label is on the box.
This article is general information about consumer technology and does not constitute professional security advice.
Sources: National Institute of Standards and Technology
