The U.S. Cyber Trust Mark is the federal security label that will soon start appearing on smart home products, and it will not appear on your router. That exclusion is written into the program rather than left open by accident. The Federal Communications Commission set out the current scope on its program page, last updated on August 11, 2026, the same day it opened a filing window for the companies that will run the label day to day. The rollout is moving, yet routers stay outside it. This guide covers what the mark certifies, why networking gear was left out, where the program actually stands, and what to check on a router while no label exists.
What the Cyber Trust Mark certifies
The FCC proposed the program in August 2023 and adopted the rules creating its framework in March 2024. Participation is voluntary. A manufacturer chooses to submit a product, pays for testing at an accredited lab, and earns the right to print the mark if that product meets the program's cybersecurity requirements. The Commission owns the program and sets the rules, but private organisations carry out the work.
Three roles do the running. A Lead Administrator recommends the standards, the testing procedures and the label design, and it also builds the consumer education campaign. Cybersecurity Label Administrators handle daily operations, which means reviewing applications and then approving or denying use of the label. Accredited testing houses called CyberLABs run the product tests. All three must hold accreditation against international ISO and IEC standards.
The underlying criteria come largely from the National Institute of Standards and Technology. The printed mark arrives with a QR code beside it. Scan that code and you reach a registry entry describing the product in plain terms, including how long the manufacturer will support it and whether security patches install automatically.
Routers are excluded, and the FCC says so plainly
The program applies to wireless consumer Internet of Things products. The FCC gives examples of what qualifies: internet-connected home security cameras, voice-activated shopping devices, smart appliances, fitness trackers, garage door openers and baby monitors.
Then it names what stays out. The Commission states that the program "does not include personal computers, smartphones, and routers." Wired devices are excluded as well, along with medical devices regulated by the Food and Drug Administration, motor vehicles regulated by the National Highway Traffic Safety Administration, and products built mainly for manufacturing, industrial control or enterprise use. Equipment on the FCC's Covered List cannot take part either.
So a smart plug sitting on your network can carry the mark while the router serving that plug cannot. The gap looks strange at first, because a router handles every packet in the house. The reasoning is one of category rather than importance. A router behaves more like general-purpose computing equipment than like a single-function sensor, and the criteria the program launched with were drafted for consumer IoT devices.
Where the rollout actually stands
The program has moved slowly, and the record shows why. UL Solutions withdrew as Lead Administrator effective December 19, 2025. The FCC then accepted fresh applications for that role from January 7 through February 9, 2026. It named the ioXt Alliance as Lead Administrator effective April 13, 2026. On August 11, 2026, the Commission opened a filing window for Cybersecurity Label Administrator applications, and that window stays open until the Bureau closes it.
Manufacturers still cannot apply to put the mark on a product. Several steps come first. The Lead Administrator recommends standards and testing procedures for at least one class of consumer IoT product. The Bureau then seeks public comment, reviews the record, and releases an order adopting those standards and fixing the program's scope. Accrediting bodies use that scope to accredit Label Administrators to ISO/IEC 17065 and CyberLABs to ISO/IEC 17025. Only after all of that can applications open. The FCC says it will announce when the program is ready.
NIST has already written router requirements
Routers are not shut out forever. On the same page, the FCC notes that NIST "is working to define cybersecurity requirements for consumer-grade routers." NIST in fact published recommended requirements for consumer-grade routers, NIST IR 8425A, in September 2024, but the FCC has not adopted them into the label scope.
What the FCC does not give is a date. No published milestone says whether or when the Commission will fold routers into this program or build a separate one. Anyone promising a timeline for labelled routers is guessing.
What a label would not tell you anyway
Even once the mark ships, it will answer a narrower question than shoppers expect. Because the program is voluntary, a product without the mark is not automatically insecure. It may simply belong to a company that skipped the process, or to a category outside the scope.
The genuinely useful part sits in the registry rather than the logo. A stated support period and a clear answer on automatic updates are the two facts that most affect how long a device stays safe. Those are exactly the facts manufacturers tend to bury today.
What to check on a router right now
You can apply the same test yourself, and it takes a few minutes.
- Find the model's end-of-support date. A router that will stop receiving patches in a year is a poor buy at any price.
- Confirm whether firmware updates install automatically, and switch that on if it is optional.
- Check the hardware version printed on the label, because vendors patch hardware revisions separately.
- Turn off remote management, cloud access and any port forwarding you do not need.
- Prefer a model whose vendor publishes security advisories in public.
Model detail helps here, since bands, ports and hardware generation all shape how long a router stays useful. Our breakdown of the TP-Link Archer BE550 shows the kind of specification record worth reading before you go hunting for a manufacturer's support policy.
Should you wait for a labelled router?
No. Waiting has no defined endpoint, and the label was never going to cover routers in its first phase anyway. Buy on the evidence available now, which means support commitments, update behaviour and the vendor's advisory track record. Should the FCC extend the program to routers using the requirements NIST has already published, that will be welcome. Until then, the security of your network still rests on the questions you ask before you pay.
