Cybersecurity Labeling for Internet of Things

Cybersecurity Labeling for Internet of Things

Supplementary Information

This document announces that OMB approved the information collection requirements in §§ 8.208, 8.209, 8.212, 8.214, 8.215, 8.217, 8.218, 8.219, 8.220, 8.221, and 8.222 on July 30, 2024.

The Commission publishes this document as an announcement of the effective date of the rules. If you have any comments on the burden estimates listed below, or how the Commission can improve the collections and reduce any burdens caused thereby, please contact Nicole Ongele, Federal Communications Commission, 45 L Street NE, Washington, DC 20554, regarding OMB Control Number 3060-1328. Please include the applicable OMB Control Number in your correspondence. The Commission will also accept your comments via email at [email protected].

To request materials in accessible formats for people with disabilities (Braille, large print, electronic files, audio format), send an email to [email protected] or call the Consumer and Governmental Affairs Bureau at (202) 418-0530 (voice), (202) 418-0432 (TTY).

Synopsis

As required by the Paperwork Reduction Act of 1995 (44 U.S.C. 3507), the FCC is notifying the public that it received final OMB approval on July 30, 2024, for the information collection requirements contained in §§ 8.208, 8.209, 8.212, 8.214, 8.215, 8.217, 8.218, 8.219, 8.220, 8.221, and 8.222. Under 5 CFR part 1320, an agency may not conduct or sponsor a collection of information unless it displays a current, valid OMB Control Number.

No person shall be subject to any penalty for failing to comply with a collection of information subject to the Paperwork Reduction Act that does not display a current, valid OMB Control Number. The foregoing notification is required by the Paperwork Reduction Act of 1995, Public Law 104-13, October 1, 1995, and 44 U.S.C. 3507.

The total annual reporting burdens and costs for the respondents are as follows:

OMB Control Number: 3060-1328.

OMB Approval Date: July 30, 2024.

OMB Expiration Date: July 31, 2027.

Title: Participation Information Collection for the IoT Labeling Program.

Form Number: N/A.

Respondents: Business or other for-profit entities, not-for-profit institutions.

Number of Respondents and Responses: 312 respondents; 3,130 responses.

Estimated Time per Response: 14 hours.

Frequency of Response: One-time; On occasion; Recordkeeping and Annual reporting requirements.

Obligation to Respond: Voluntary. Statutory authority for this collection is contained in sections 1, 2, 4(i), 4(n), 302, 303(r), 312, 333, and 503, of the Communications Act of 1934, as amended, 47 U.S.C. 151, 152, 154(i), 154(n), 302a, 303(r), 312, 333, 503; the IoT Cybersecurity Improvement Act of 2020, 15 U.S.C. 278g-3a to 278g-3e.

Total Annual Burden: 42,700 hours.

Total Annual Cost: No cost.

Needs and Uses: The collection will advance the public interest and safety because it is the basis for the Commission's IoT Labeling Program, which will provide consumers with an easy-to-understand and quickly recognizable FCC IoT Label that includes the U.S. government certification mark (referred to as the Cyber Trust Mark) that provides assurances regarding the baseline cybersecurity of an IoT product, together with a QR code that directs consumers to a registry with specific information about the product. This collection will help consumers make better purchasing decisions, raise consumer confidence with regard to the cybersecurity of the IoT products they buy to use in their homes and their lives, and encourage manufacturers of IoT products to develop products with security-by-design principles in mind. In addition, consumers who purchase an IoT product that bears the FCC IoT Label can be assured that their product meets the minimum cybersecurity standards of the IoT Labeling Program, which in turn will strengthen the chain of connected IoT products in their own homes and as part of a larger national IoT ecosystem. In addition, the Order estimates that the program will save consumers at least $60 million annually from reduced time spent researching cybersecurity features of potential purchases.