Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity/workshop-and-call-papers-cybersecurity-labeling

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology Laboratory

## Executive Order 14028,  Improving the Nation's Cybersecurity

-  Software Supply Chain Security Guidance  Expand or Collapse    -  Software Security in Supply Chains  Expand or Collapse      -  Guidance, Purpose, Scope, and Audience 
    -  EO-Critical Software and Security Measures for EO-Critical Software 
    -  Software Cybersecurity for Producers and Users  Expand or Collapse        -  Attesting to Conformity with Secure Software Development Practices 
    -  Software Verification 
    -  Evolving Standards, Tools, and Recommended Practices  Expand or Collapse        -  Software Bill of Materials (SBOM) 
      -  Enhanced Vendor Risk Assessments 
      -  Open Source Software Controls 
      -  Vulnerability Management 
    -  Additional Existing Industry Standards, Tools, and Recommended Practices 
    -  FAQs 
  -  Software Cybersecurity for Producers and Purchasers 
  -  Critical Software  Expand or Collapse      -  Critical Software Definition  Expand or Collapse        -  Introduction 
      -  Background & Approach 
      -  Definition & Explanatory Material 
      -  FAQs 
    -  Security Measures for Critical Software Use  Expand or Collapse        -  Introduction 
      -  Purpose & Scope 
      -  Security Measures for EO-Critical Software Use 
      -  FAQs 
  -  Software Verification  Expand or Collapse      -  Introduction 
    -  Background & Approach 
    -  Recommended Minimum Standard for Vendor or Developer Verification of Code 
    -  FAQs 
-  Cybersecurity Labeling for Consumers  Expand or Collapse    -  Consumer Cybersecurity Labeling Pilots: The Approach and Contributions 
  -  Workshops on Cybersecurity Labeling of Consumer Products 
  -  IoT Product Criteria 
  -  Consumer Software Criteria 
  -  News & Updates 
  -  Engage 
  -  Resources 
  -  FAQs 
-  Workshops & Call for Papers 
-  News & Updates 
-  Engage 
-  Fact Sheet 
-  Resources 
-  FAQs 
-  Cybersecurity @ NIST 

# Workshop and Call for Papers on Cybersecurity Labeling Programs for Consumers: Internet of Things (IoT) Devices and Software

## Share

Facebook

Linkedin

Twitter

Email

NOTE: This workshop has taken place. Nearly 550 participants joined the September 14-15 virtual event, with many actively involved by posing questions or joining the online chat. A video recording of the workshop can be found here.

The National Institute of Standards and Technology (NIST) is seeking suggestions and feedback on challenges and practical approaches to initiating cybersecurity labeling efforts for Internet of Things (IoT) devices and consumer software.  The information will help NIST to carry out one of its multiple assignments in an Executive Order (EO) on Improving the Nation’s Cybersecurity. Stakeholders were invited to respond to a call for papers, comment on draft IoT device criteria, and participate in a workshop on September 14-15, 2021.

## **Background**

The President on May 12, 2021, issued an Executive Order on Improving the Nation’s Cybersecurity (EO 14028). Among other things, Section 4 of the EO directs NIST to initiate two labeling efforts**– informed by existing consumer product labeling programs – to educate the public on the cybersecurity capabilities of Internet-of-Things (IoT) devices and software development practices. 

By February 6, 2022, in coordination with the Federal Trade Commission (FTC) and other agencies, NIST is required to:
                  - identify IoT cybersecurity criteria for a consumer labeling program, and 
                  - identify secure software development practices or criteria for a consumer software labeling program

The IoT cybersecurity criteria are to: 
                  - take into consideration whether a consumer labeling program may be operated in conjunction with or modeled after any similar existing government programs consistent with applicable law
                  - reflect increasingly comprehensive levels of testing and assessment that a product may have undergone 
                  - use or be compatible with existing labeling schemes that manufacturers use to inform consumers about the security of their products and
                  - be based on an examination of all relevant information, labeling, and incentive programs and employ best practices
                  - focus on ease of use for consumers
                  - determine measures to maximize manufacturer participation.

The secure software development criteria are to:
                  - reflect a baseline level of secure practices 
                  - if practicable, reflect increasingly comprehensive levels of testing and assessment that a product may have undergone
                  - be based on an examination all relevant information, labeling, and incentive programs
                  - employ best practices and identify, modify, or develop a recommended label or, if practicable, a tiered software security rating system
                  - focus on ease of use for consumers and a determination of what measures can be taken to maximize participation.

Both labeling efforts are to be conducted in a manner consistent with OMB Circular A-119 and NIST Special Publication 2002-02 (Conformity Assessment Considerations for Federal Agencies).

In August, NIST posted for public comment a set of **potential baseline security criteria for IoT devices.** These draft criteria were discussed at the workshopon September 14-15, 2021. 

## **Call for Papers on Consumer Software Labeling**

NIST requested one- to two-page submissions providing suggestions and feedback on the ***challenges and practical approaches to consumer software labeling***, especially: 
                  - formal and informal processes and practices used to secure the software development process
                  - technical criteria needed to support validation of consumer software security assertions that reflect a baseline level of secure practices 
                  - how different conformity assessment approaches (e.g., vendor attestation, third-party conformity assessment) can be employed in consumer software labeling efforts
                  - consumer product labeling programs for educating the public on the security properties of consumer software
                  - feasibility and possible means for implementing tiered labels that reflect increasingly comprehensive levels of testing and assessment
                  - measures for incentivizing participation by consumer software developers. 

Papers were reviewed for their diversity of information and suggestions in order to ensure that NIST considers a wide range of approaches for practically and effectively achieving the goal of the EO. NIST seeks to build on existing approaches and capabilities to avoid duplication and to speed implementation of needed security steps while also encouraging creative thinking and new approaches. 

NIST encouraged hearing additional views during the upcoming workshop.

## **Workshop**

On September 14-15, 2021, NIST hosted a virtual public workshop on Cybersecurity Labeling for Internet of Things (IoT) Devices and Consumer Software. The agenda for the workshop, which attracted nearly 550 participants, included facilitated panel discussions and presentations based on the consumer software labeling position papers submitted to NIST and on draft baseline security criteria for consumer IoT devices building on NIST’s current guidance on Cybersecurity for IoT. A video recording of the workshop and panelist presentations can be found here.

Frequently Asked Questions about this initiative are available here.

*Questions about the position papers**and this overall effort*should be directed to: *labeling-eo [at] nist.gov (labeling-eo[at]nist[dot]gov).*

Information technologyCybersecurityInternet of Things (IoT)

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov