At CES in Las Vegas, a panel chaired by the Consumer Technology Association brought together Afero, Sony, Keysight and IoTX to outline progress on the US Cyber Trust Mark – the US attempt to align with the EU Cyber Resilience Act.

Despite conference listings suggesting the scheme was live, it is still being finalised. Some requirements are being worked through between standards bodies and the Federal Communications Commission, which owns the scheme.

What’s clear is the direction of travel. The Cyber Trust Mark is a voluntary, consumer-facing label for wireless, internet-connected products. Manufacturers that qualify can display the logo and must include a QR code on packaging, linking to key security information such as support periods, password management and how the product is secured.

Like the CRA, the scheme goes beyond devices. It spans equipment, apps, cloud services and APIs, with expectations around risk assessments, vulnerability reporting, SBOMs and even HBOMs. The draft specification (PSHSB 23-239), published via the FCC, is based on National Institute of Standards and Technology standards.

The big open question is uptake. As a voluntary mark, its impact will depend on whether consumers recognise and value it. That said, cybersecurity is increasingly influencing purchasing decisions – and a future mutual recognition agreement with the CRA could accelerate adoption on both sides of the Atlantic.

With final details expected to be resolved early this year and launch anticipated later in the year, this is another signal that global product security requirements are converging.

For manufacturers, the message is consistent: getting ahead of these frameworks – and understanding how they overlap – is no longer optional.

This is where SafeShark can help.

At SafeShark, we work directly with manufacturers navigating exactly these kinds of emerging and converging frameworks. From early scoping and gap analysis through to risk assessments, SBOMs, vulnerability processes and full assurance, we support teams end to end, removing uncertainty and accelerating compliance.

As schemes like the US Cyber Trust Mark and the CRA continue to take shape, having a trusted partner who understands both the regulatory intent and the technical detail makes the difference between reacting late and moving with confidence.

Alex Buchan
Director
SafeShark