White Paper Draft- Baseline Criteria for Consumer Software Cybersecurity Labeling

This draft document advances assignments to the National Institute of Standards and Technology (NIST)

in Sec. 4 (s) of Executive Order (EO) 14028, “Improving the Nation’s Cybersecurity” related to

cybersecurity labeling for consumer software. We reviewed this NIST Draft and appreciate this effort

and the opportunity to provide the below comments for your consideration:

General comments

Recommend that Labeling systems are accessible and consistent, since not going to do consumers much

good if there are many different versions all implemented and scored differently and not easily

understandable.

Page 11

Under desired outcome section,

Recommend to add that the consumer can easily view the label also before the time and point of

purchase as well as at a later time, as needed so consumers can prepare in advance.

Page 15

Recommend adding at the end of the Methodology paragraph before the last sentence as follows:

Unless easily recognized as a government approved product and Section 508 compliant for electronic

versions (since it is important that general public cybersecurity labels are understandable by all the

consumers) in order to be effective and actionable for cybersecurity:

Page 16

Recommend to add after the following sentence - All labeling approaches have their strengths and

weaknesses.

Recommend work towards goal of inclusion of also binary graphic that is easily recognized as a

government approved product and Section 508 compliant for electronic versions, since it is important

that consumer cybersecurity labels are understandable by all the consumers in order to be effective and

actionable for security.

Page 17.

Recommend to add at the end of the paragraph titled-NIST also is proposing coupling the binary label

with a layered approach as follows:

It is also unclear if consumers have access to technology that will allow them to scan a QR code or visit a

website to obtain additional information, so consumer testing in this regard will be essential.

Label Presentation– how and where a label is presented to consumers – is another important

consideration. Labels should be available to consumers at the time and place of purchase (in-store or

online) as well as after purchase. Recommend to add as follows:

Additionally label information should be available to consumers before purchase online with section 508

compliance whenever possible to increase accessibility by all consumers.
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommend on Page 19 after the last sentence on the page where it states that (The label design should

also account for accessibility factors that may significantly impact and overlap with the usability

components listed, for example, when used by consumers with disabilities or the aging.) to add the

following: written at the lowest elementary school reading level possible (according to the US

Department of Education’s National Assessment of Adult Literacy, 43% of the US population has low

literacy and less than 2% has a PhD) and Literacy levels are roughly the same in other advanced

countries also.) This will help greatly to keep this in mind in order to increase the general population

that can implement this cybersecurity protection and who may also need assistive technology and

Section 508 compliance in order to access.

Recommend on Page 21 after the first sentence of the last paragraph where it states that (Consumer

testing prior to program implementation is valuable, but initial perceptions and expressions of intent to

purchase may differ from actual consumer behavior) to add the following:

Including a demographically diverse, U.S. census-representative sample of consumers of varying

disabilities and abilities in periodic testing is essential and can include market studies to assess the

impact on consumer purchase decisions and the growth of brand recognition over time. The sample size

should be large enough for sufficient statistical power when analyzing test results of this inclusive

periodic testing after program implementation.