500 10th Street NW

Atlanta, Georgia 30332-0620

Phone: 404.385.4614

Fax: 404.385.0269

https://cdait.gatech.edu

NIST Cybersecurity Labeling for Consumers: Internet of Things (IoT) Devices and Software:

challenges and practical approaches to consumer software labeling white paper

Considerations for Ensuring Accessibility of Consumer Cybersecurity Labeling for IoT Devices 

Paul M.A. Baker, Ph.D., Center for the Development and Application of Internet of Things Technologies (CDAIT)

Brad Fain, Ph.D., Center for Advanced Communications policy (CACP)

Context: Executive Order 14028, issued May 12, 2021, directs NIST to initiate two labeling efforts: to educate the 

public on the cybersecurity capabilities of Internet-of-Things (IoT) devices and software development practices. While 

IoT devices are increasingly deployed concerns have been raised about the security, and privacy of IoT devices (Megas, 

Cuthill, & Gupta, 2021). This paper address considerations relative to “consumer product labeling programs for 

educating the public on the security properties of consumer software,” specifically in terms of accessibility and 

usability for people with disabilities and the aging. The Center for the Development and Application of Internet of 

Things Technologies (CDAIT) at the Georgia Institute of Technology generally with the conclusions of the Megas, et al. 

white paper particularly “the need to strengthen the available ecosystem for confidence mechanisms for IoT device 

security ... Bringing together communities of interest around particular device types and market segments.” (P.19). We 

believe that effective policy, in this case standards for labeling, is best generated by participatory multi-stakeholder 

consultation (Baker, Gandy, & Zeagler, 2015) particularly given the needs of critical populations such as people with 

disabilities and the importance of IoT to enhance social engagement and participation (Mitchell, et al., 2017). 

Labeling Considerations: NIST notes that labelling should:

• Encourage innovation in manufacturers’ IoT security efforts, leaving room for changes in technologies and the 

security landscape.

• Be practical and not be burdensome to manufacturers and distributors.

• Factor in usability as a key consideration.

• Build on national and international experience.

• Allow for diversity of approaches and solutions across industries, verticals, and use cases – so long as they are 

deemed useful and effective for consumers.

CDAIT generally agrees with these objectives, particularly the importance of usability, but suggests that the 

“practical and not be burdensome” consideration be weighed against the need that labelling specifically address the 

accessibility of the labeling for sensitive populations. Many of the characteristics of IoT are very useful to people with 

disabilities, and hence any labelling needs to be not just technically accessible, but we argue, usable to these 

stakeholders (Moon, Baker, & Goughnour, 2019). 

The NIST paper notes that “Many customers of IoT devices are unaware of the security implications of their 

use” (p.18). While we agree that awareness of security implications is critical, it is a bit more nuanced than simple lack 

of awareness. In focus groups conducted with users with disabilities (Moon et al., 2019), concerns were raised on both 

security and privacy, with security having several components: 1) security of the device and network connection 

against malevolent access, and 2) security of the user information embedded in the systems. Labeling needs to be 

developed in a way that is both accessible and comprehensible, which can be developed based on user testing and 

participatory design. Perhaps a labeling system based on user perceived risk categories such as “risk of loss of private 

information,” “risk of disruption of normal operations,” or “risk of damage to existing software and hardware,” could 

be used to communicate potential risk. In terms of security labeling specifications, several contextual factors need to 

be considered. Drawing from some research conducted on labelling for consumer products (Fain, 2018), does labeling 

context take into account the demographics and characteristics of the IoT user (e,g, older adults, children, and 

consumers with sensory limitations, or other limiting factors? What functional abilities (vision, physical dexterity, 

strength, and range of motion) are required for each of the tasks involved in set up and use of the product?
Does failure to follow-specific set-up protocols open the user to security risks, such as network intrusion or access to 

IoT by unauthorized users? Has the labeling been subjected accessibility testing to verify the results? To what extent 

have complaints been received about the instructions/labeling, and are there systems in place to record the data? To 

what extent is risk mitigated by a properly configured and managed home network infrastructure?

Labeling Design: We recommend that the specific design of labelling requirements be developed as a collaborative 

effort between industry, end users, human factors engineers, and security experts. This could be done in a set of data 

gathering efforts, a focused continuation of effort following the workshop to be held by NIST in September. We 

recommend the development of a labeling “style guide” that governs the look, appearance, and information content 

of proposed labels. The style guide would ensure consistency and help take into account the diversity of human 

abilities that must be addressed in an effective labeling system. A set of guidelines could be generated along several 

gradients, include product set-up, use, and safety/security aspects. Components to include are:

• visual presentation format - warnings and instructions should be presented as bullets in an outline format. 

The prominence of visual warnings and instructions can be further enhanced using large, bold print, high 

contrast, color, borders, and pictorial symbols. Warnings and instructions should contain a signal word to 

attract the attention of the user. Security guidance and remediation could be highlighted. 

• readability and comprehensibility - labels, critical instructions, and guidance. Print critical text with large print 

in a sans-serif typeface with high contrast on a solid background. The recommended minimum font size is 12 

point (4.25 mm), especially for warnings, expiry dates and instructions. Lower case text is easier to read, 

especially if the text is several lines long, so avoid using text consisting entirely of capital letters. The height of 

and spacing between letters should not be modified.

Collaborative partnerships: In order to be not just minimally accessible, but useable to a wide set of stakeholders, we 

argue that development of labeling related to security of IoT devices be done in a collaborative process with a robust 

array of stakeholders. Further, we support the suggestion (Megas, et al., p 10) that a nonprofit, nongovernmental 

organization would be a reasonable manager for a centralized certification and labeling effort, and that in the US, 

enforcement would be handled by the Federal Trade Commission for falsely labeled or mislabeled products. 

References:

Baker, P.M.A.; Gandy, M. & Zeagler, C. (2015). Innovation and Wearable Computing: A Proposed Framework for

Collaborative Policy Design. IEEE Internet Computing, 19(5),18-25.

Fain, B. (2018). Food Packaging Design Accessibility Guidelines. URL: https://arthritisaustralia.com.au/wordpress/wpcontent/uploads/2018/12/Food-Packaging-Design-Accessibility-Guidelines_Arthritis-Australia_18.pdf

NIST (2020). SP 800-213 (DRAFT) IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT 

Device Cybersecurity Requirements. https://csrc.nist.gov/publications/detail/sp/800-213/draft (December).

Megas, K; Cuthill, B. & Gupta, S. (2021). Establishing Confidence in IoT Device Security: How do we get there? (Draft): 

Gaithersburg, MD: National Institute of Standards and Technology (NIST), U.S. Department of Commerce. 

https://doi.org/10.6028/NIST.CSWP.05142021-draft. 

Mitchell, H., Baker, P.M.A., Moon N.C., Fain, B., LaForce, S. (2017, March 13). Comments filed in response to National 

Telecommunications and Information Administration (NTIA) Notice, Request for Comments on the Benefits, 

Challenges, and Potential Roles for the Government in Fostering the Advancement of the Internet of Things

[Docket No. 170105023-7023-01] RIN 0660–XC03. Washington D.C: NTIA. 

Moon, N. W., Baker, P. M., & Goughnour, K. (2019). Designing wearable technologies for users with disabilities: 

Accessibility, usability, and connectivity factors. Journal of Rehabilitation and Assistive Technologies 

Engineering. vol. 6, pp. 1-12. https://doi.org/10.1177/2055668319862137