UK PSTI and the US Cyber Trust Mark: what device makers must do in each market

Selling a connected device into the UK and the US means meeting two very different regimes at once. UK PSTI is a mandatory law: since 29 April 2024, a relevant connectable product cannot lawfully be supplied in the UK unless it meets baseline security requirements. The US Cyber Trust Mark, run by the FCC, is a voluntary label: a device can still be sold without it, but earning the mark means passing testing against a NIST baseline. Treat them separately; a product can be PSTI-compliant and still fail Cyber Trust Mark criteria, or the reverse.

UK PSTI: mandatory, already in force

The Product Security and Telecommunications Infrastructure Act 2022 (PSTIA, c. 46) created the UK's product security regime in Part 1. The substantive requirements sit in secondary legislation, the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 (SI 2023/1007), which entered into force alongside the Act's enforcement powers on 29 April 2024.

Who it applies to and what it covers

PSTI applies to relevant connectable products: devices that can send and receive data over the internet or another network. It binds manufacturers, importers and distributors, each with distinct duties under the Act (manufacturers' duties, importers' duties and distributors' duties are set out in separate sections of Part 1). A limited set of product categories is excepted (for example, specific medical devices and smart meters; check Schedule 1 to the Act and Schedule 3 to the Regulations for the current exceptions list).

The three Schedule 1 security requirements

Requirement	What it means in practice
No universal default or easily guessable passwords	Each unit needs a unique password, or a password set by the user. A unique password must not be derived from an incremental counter, publicly available information, or the product's own identifiers unless hashed or encrypted in line with good industry practice
Vulnerability reporting information	Publish at least one contact point for security reports, with acknowledgement of receipt and status updates until resolution; accessible, transparent, in English, free of charge, without requiring personal data to submit a report
Minimum security update period	Publish, in English and free of charge, how long the product will receive security updates, in a way a non-technical reader can understand; this period cannot later be shortened once published

Enforcement and penalties

The Office for Product Safety and Standards (OPSS) enforces PSTI. Under Act sections 36 to 38, a monetary penalty cannot exceed the greater of GBP 10 million and 4% of the person's qualifying worldwide revenue for their most recent complete accounting period, with an additional penalty of up to GBP 20,000 per day for a continuing breach. OPSS also has compliance, stop and recall notice powers.

For the reporting-contact part of PSTI, our vulnerability disclosure policy template and security.txt guide gives a ready starting point.

US Cyber Trust Mark: voluntary, still rolling out

The FCC adopted the rules for the U.S. Cyber Trust Mark in a Report and Order, FCC 24-26 (PS Docket No. 23-239), on 14 March 2024. Unlike PSTI, it is a voluntary labelling programme for consumer wireless IoT products: a qualifying device can display an FCC IoT label, including the Cyber Trust Mark shield logo, once certified. Products without the mark remain legal to sell; they simply cannot use the label.

What the label certifies

The technical baseline is NIST IR 8425, Profile of the IoT Core Baseline for Consumer Products, published by NIST in September 2022. It defines the cybersecurity capabilities expected of consumer IoT products, such as device identification, configurability, secure update ability, and data protection, developed through a year-long, multi-stakeholder NIST process following Executive Order 14028.

Scope

The programme targets consumer wireless IoT products, such as smart home devices, connected cameras, fitness trackers and similar categories. Routers are explicitly called out by NIST and the FCC's process as needing separate, dedicated requirements rather than the general consumer baseline (the status of a router-specific baseline is to be confirmed against NIST's and the FCC's current publications). Medical devices, motor vehicles, personal computers and smartphones are outside this programme's current scope.

A programme still being stood up

Unlike PSTI, the US programme's administration has changed hands during rollout, which matters for anyone planning certification timing:

Date	Event
14 March 2024	FCC adopts the Report and Order (FCC 24-26) establishing the programme
4 December 2024	FCC names UL Solutions as Lead Administrator
December 2025	UL Solutions files a notice of withdrawal as Lead Administrator
13 April 2026	FCC names the ioXt Alliance as the new Lead Administrator

Because the programme is actively being implemented, check the FCC's Cyber Trust Mark programme page (see Sources) for the current list of accredited Cybersecurity Label Administrators and testing labs before committing a product launch date to certification; further milestones beyond April 2026 are to be confirmed against the FCC's own updates.

PSTI vs Cyber Trust Mark at a glance

	UK PSTI	US Cyber Trust Mark
Status	Mandatory in force since 29 April 2024	Voluntary, rules adopted 14 March 2024
Legal basis	PSTI Act 2022 + SI 2023/1007	FCC Report and Order FCC 24-26
Technical baseline	Three Schedule 1 requirements (passwords, reporting, update period)	NIST IR 8425 core baseline
Enforcement	OPSS; fines up to GBP 10m / 4% of turnover	FCC programme rules; no mark without certification
Can you sell without it?	No, if in scope	Yes; the mark is optional

What device makers selling into both markets should do

1. Treat PSTI as a baseline gate for the UK, not optional: confirm your default-password handling, reporting contact and support-period disclosure meet Schedule 1 before UK launch.
2. Decide whether the Cyber Trust Mark is worth pursuing as a US market differentiator once a current administrator and accredited labs are confirmed, rather than committing a launch date to it today.
3. Reuse the same underlying work for both. A documented vulnerability-handling process and support-period commitment, built once for CRA Annex I or your vulnerability disclosure policy, covers most of PSTI's Schedule 1 and a meaningful share of the NIST IR 8425 baseline.
4. Keep a per-market compliance record, since PSTI, the Cyber Trust Mark and the EU Cyber Resilience Act use different legal mechanisms and different regulators, even where the underlying security practices overlap.

SoftWSP can check a device's firmware and documentation against PSTI's Schedule 1 and the NIST IR 8425 baseline alongside EU CRA work: see device firmware security.

This guide is general information, not legal advice.