2024-17482. Cybersecurity Labeling for Internet of Things

Document Headings

Document headings vary by document type but may contain the following:

1. the agency or agencies that issued and signed a document
2. the number of the CFR title and the number of each part the document amends, proposes to amend, or is directly related to
3. the agency docket number / agency internal file number
4. the RIN which identifies each regulatory action listed in the Unified Agenda of Federal Regulatory and Deregulatory Actions

See the Document Drafting Handbook for more details.

Federal Communications Commission

1. 47 CFR Part 8
2. [PS Docket No. 23-239; FCC 24-26; FR ID 236839]

AGENCY:

Federal Communications Commission.

ACTION:

Final rule; announcement of compliance date.

SUMMARY:

In this document, the Federal Communications Commission (Commission or FCC) announces that the Office of Management and Budget (OMB) has approved, for a period of three years, an information collection associated with rules establishing a voluntary cybersecurity labeling program for wireless consumer Internet of Things, or IoT, products in the Report and Order and Further Notice of Proposed Rulemaking ( IoT Order). This document is consistent with the IoT Order, which stated that the Commission would publish a document in the Federal Register announcing the effective date of those rules.

DATES:

The compliance date for 47 CFR 8.208, 8.209, 8.212, 8.214, 8.215, 8.217, 8.218, 8.219, 8.220, 8.221, and 8.222, added on July 30, 2024, at 89 FR 61242, and effective August 29, 2024, is September 9, 2024.

FOR FURTHER INFORMATION CONTACT:

Zoe Li, Cybersecurity and Communications Reliability Division, Public Safety and Homeland Security Bureau, [phone], or by email to [e-mail].

SUPPLEMENTARY INFORMATION:

This document announces that OMB approved the information collection requirements in §§ 8.208, 8.209, 8.212, 8.214, 8.215, 8.217, 8.218, 8.219, 8.220, 8.221, and 8.222 on July 30, 2024.

The Commission publishes this document as an announcement of the effective date of the rules. If you have any comments on the burden estimates listed below, or how the Commission can improve the collections and reduce any burdens caused thereby, please contact Nicole Ongele, Federal Communications Commission, 45 L Street NE, Washington, DC 20554, regarding OMB Control Number 3060-1328. Please include the applicable OMB Control Number in your correspondence. The Commission will also accept your comments via email at [e-mail].

To request materials in accessible formats for people with disabilities (Braille, large print, electronic files, audio format), send an email to [e-mail] or call the Consumer and Governmental Affairs Bureau at [phone] (voice), [phone] (TTY).

Synopsis

As required by the Paperwork Reduction Act of 1995 (44 U.S.C. 3507), the FCC is notifying the public that it received final OMB approval on July 30, 2024, for the information collection requirements contained in §§ 8.208, 8.209, 8.212, 8.214, 8.215, 8.217, 8.218, 8.219, 8.220, 8.221, and 8.222. Under 5 CFR part 1320, an agency may not conduct or sponsor a collection of information unless it displays a current, valid OMB Control Number.

No person shall be subject to any penalty for failing to comply with a collection of information subject to the Paperwork Reduction Act that does not display a current, valid OMB Control Number. The foregoing notification is required by the Paperwork Reduction Act of 1995, Public Law 104-13, October 1, 1995, and 44 U.S.C. 3507.

The total annual reporting burdens and costs for the respondents are as follows:

OMB Control Number: 3060-1328.

OMB Approval Date: July 30, 2024.

OMB Expiration Date: July 31, 2027.

Title: Participation Information Collection for the IoT Labeling Program.

Form Number: N/A.

Respondents: Business or other for-profit entities, not-for-profit institutions.

Number of Respondents and Responses: 312 respondents; 3,130 responses.

Estimated Time per Response: 14 hours.

Frequency of Response: One-time; On occasion; Recordkeeping and Annual reporting requirements.

Obligation to Respond: Voluntary. Statutory authority for this collection is contained in sections 1, 2, 4(i), 4(n), 302, 303(r), 312, 333, and 503, of the Communications Act of 1934, as amended, 47 U.S.C. 151, 152, 154(i), 154(n), 302a, 303(r), 312, 333, 503; the IoT Cybersecurity Improvement Act of 2020, 15 U.S.C. 278g-3a to 278g-3e.

Total Annual Burden: 42,700 hours.

Total Annual Cost: No cost.

Needs and Uses: The collection will advance the public interest and safety because it is the basis for the Commission's IoT Labeling Program, which will provide consumers with an easy-to-understand and quickly recognizable FCC IoT Label that includes the U.S. government certification mark (referred to as the Cyber Trust Mark) that provides assurances regarding the baseline cybersecurity of an IoT product, together with a QR code that directs consumers to a registry with specific information about the product. This collection will help consumers make better purchasing decisions, raise consumer confidence with regard to the cybersecurity of the IoT products they buy to use in their homes and their lives, and encourage manufacturers of IoT products to develop products with security-by-design principles in mind. In addition, consumers who purchase an IoT product that bears the FCC IoT Label can be assured that their product meets the minimum cybersecurity standards of the IoT Labeling Program, which in turn will strengthen the chain of connected IoT products in their own homes and as part of a larger national IoT ecosystem. In addition, the Order estimates that the program will save consumers at least $60 million annually from reduced time spent researching cybersecurity features of potential purchases.

Federal Communications Commission.

Katura Jackson,

Federal Register Liaison Officer, Office of the Secretary.