The ioXt Alliance Security Pledge and certification programme, explained

The ioXt Alliance is an industry-led, non-profit certification body for consumer and commercial IoT product security, built around an 8-principle Security Pledge and a set of product-category security profiles that manufacturers test against — either by self-certifying or through an Authorized Lab. Its own mission statement describes the goal as building "confidence in Internet of Things products through multi-stakeholder, international, harmonized, and standardized security and privacy requirements, product compliance programs, and public transparency of those requirements and programs." The organization's profile has risen sharply in 2026: on 13 April 2026, the FCC named ioXt the new Lead Administrator of the U.S. Cyber Trust Mark programme, after the prior administrator withdrew amid a national-security review.

The 8 Security Pledge principles

A product certified against ioXt's Security Pledge commits its manufacturer to eight baseline practices:

1. No Universal Passwords — unique credentials required for operation.
2. Secured Interfaces — all product interfaces appropriately secured.
3. Proven Cryptography — strong, updatable methods using open, peer-reviewed designs.
4. Security by Default — security appropriately enabled without extra user action.
5. Verified Software — only signed software updates are supported.
6. Automatic Security Updates — the manufacturer applies timely updates.
7. Vulnerability Reporting Program — a channel exists with a timely manufacturer response.
8. Security Expiration Date — transparent disclosure of how long the product will receive updates.

These eight read as a condensed version of the same baseline ideas underlying ETSI EN 303 645 and the UK PSTI regime — unique passwords, a vulnerability disclosure channel, and a disclosed update-support window all appear on every one of those baselines, which is part of why a Pledge-compliant product tends to clear a large share of each scheme's requirements in parallel.

Self-certification or an Authorized Lab

ioXt's certification pages describe a continuous, subscription-style model rather than a one-time test. A manufacturer submits product information through the ioXt SmartCert portal and measures the product against a published security profile, with an independent researcher validating the submission. From there, two paths diverge:

Path	How it works
Self-certification	The manufacturer measures its own product against the profile, with independent-researcher validation of the submission
ioXt Authorized Lab	"IoT manufacturers and developers seeking more sophisticated testing and the validation of a third-party expert can have an ioXt Authorized Lab perform the test plan and certify the results"

Either path leads to an annual ioXt SmartCert, and ioXt states that "certification status is reevaluated as new device or app versions are released" — certification is not a one-time badge.

Six security profiles

ioXt's certification pages list six published profiles, each layering product-category-specific requirements on top of the 8-principle pledge: Base Profile, Android Profile, Mobile Application Profile, Smart Speaker Profile, Residential Camera Profile, and Network Lighting Controller Profile. A manufacturer selects the profile matching its product category rather than certifying against the generic Base Profile alone whenever a more specific profile exists.

April 2026: ioXt becomes the US Cyber Trust Mark's Lead Administrator

On 13 April 2026, the FCC announced it had selected ioXt as the new Lead Administrator of the U.S. Cyber Trust Mark Program — the voluntary cybersecurity label for consumer wireless IoT products built on the NIST IR 8425 baseline, covered in full in our UK PSTI and US Cyber Trust Mark guide. The FCC's press release describes ioXt as "an independent, U.S.-based non-profit organization, whose focus is on improving the security, privacy, and transparency of IoT products," noting that "ioXt describes itself as the United States' preeminent certification body dedicated to the security of IoT products." The prior Lead Administrator, UL Solutions, had "filed a notice of withdrawal" in December 2025 after FCC Chairman Brendan Carr opened a national-security review into UL's testing locations operating inside China. FCC Chairman Carr's statement framed the selection around that national-security concern: "With today's decision, the FCC is ensuring that the Lead Administrator will implement the program in a way that is consistent with that vision, while advancing national and cyber security."

As Lead Administrator, ioXt's duties — per the FCC's own release — are to collaborate "with stakeholders to develop a consumer outreach campaign and recommend[] to the Commission additional cybersecurity standards, testing procedures, and label design." This is a distinct, government-facing role layered on top of ioXt's pre-existing industry Pledge and profile certification programme described above; the two run in parallel rather than one replacing the other. Further Cyber Trust Mark rollout milestones (accredited Cybersecurity Label Administrators, testing labs) should be checked against the FCC's current programme page rather than assumed from this announcement alone.

A workable starting point

1. Map your existing EN 303 645/PSTI work to the 8 principles first. Unique passwords, a disclosed vulnerability-reporting channel, and a published update-support window are shared requirements — don't re-derive evidence you already have for another scheme.
2. Pick the most specific profile that fits your product, not the generic Base Profile, if a camera, speaker, lighting controller, Android, or mobile-app profile applies.
3. Decide self-certification vs. Authorized Lab by audience. Self-certification with independent-researcher validation is faster; an Authorized Lab's third-party test and certification buys more credibility with enterprise, retail, or export buyers.
4. Plan for annual re-evaluation, not a one-time badge. Certification status is revisited as new device or app versions ship, so build the SmartCert portal update into your release process rather than treating certification as a closed task.
5. Track ioXt's Cyber Trust Mark role separately from its Pledge programme, since the FCC's own administrator rollout (accredited labs, additional standards recommendations) is still being finalized as of this guide's last-updated date.

SoftWSP's device and firmware assessments can be scoped against the ioXt Pledge's 8 principles and the relevant security profile, alongside the NIST IR 8425 evidence a Cyber Trust Mark submission will eventually need: see Device & Firmware Security.

This guide summarises ioXt Alliance's own published pages and the FCC's 13 April 2026 press release; it is not a substitute for ioXt's current certification rules or the FCC's current programme page, and does not constitute compliance or legal advice.