IoT Cybersecurity Regulation in the United States
The United States has no single law for the cybersecurity of Internet of Things (IoT) devices. Federal initiatives, state laws, and voluntary standards together form the rules that IoT manufacturers have to meet. This article describes the main elements and what they mean for manufacturers that sell connected products in the US.
Contents
How regulation works in the United States
At the federal level, Congress passes laws. The President can issue executive orders, which have the force of law for federal agencies. Federal agencies such as the National Institute of Standards and Technology (NIST) also develop detailed guidelines and standards that support the practical implementation of laws and executive orders.
The individual states can pass their own laws as long as they do not conflict with federal law. This federal structure often produces a complex set of rules that companies must work through carefully. For IoT manufacturers, this means that national standards are not enough. They must also consider the specific requirements of each state where they want to sell their products.
Federal laws and initiatives
At the federal level, several laws and initiatives aim to improve cybersecurity in general and the security of IoT devices in particular.
Executive Order 14028: Improving the Nation's Cybersecurity
On May 12, 2021, President Biden signed Executive Order 14028, which aims to strengthen cybersecurity across the United States. The order sets several priorities:
- It promotes better information sharing between government and the private sector, so that threats can be detected and addressed faster.
- It requires federal agencies to adopt stronger cybersecurity standards, including zero trust architectures.
- It puts particular focus on software supply chain security, among other things through the software bill of materials (SBOM), which makes the components used in software transparent.
The order also provided for a Cyber Safety Review Board to analyze significant cyber incidents and draw lessons from them. In January 2025, the Department of Homeland Security ended the memberships of the board. The order also aims to standardize the response to cybersecurity incidents, so that threats can be met in a more effective and coordinated way.
For IoT manufacturers, the executive order has far-reaching consequences. They must prepare for higher security standards, especially if they want to sell products to government agencies. The order also calls for more transparency about product security and prepares the ground for stricter reviews and certifications. It is aimed primarily at federal agencies, but it sets new benchmarks for the whole industry and indirectly affects the private sector.
Many manufacturers are unsure which requirements from executive orders, federal laws, and NIST guidelines actually apply to them, especially when they supply public agencies or critical customers. A short assessment helps clarify how far your products are affected.
Internet of Things Cybersecurity Improvement Act of 2020
Another milestone in IoT security regulation is the IoT Cybersecurity Improvement Act, which entered into force on December 4, 2020. The act focuses specifically on the security of IoT devices used by US federal agencies. It tasks NIST with developing standards for these devices and sets minimum requirements in areas such as secure development, identity management, patching, and configuration.
The act requires the Office of Management and Budget (OMB) to develop procurement guidelines for IoT devices and introduces guidelines for vulnerability disclosure. For IoT manufacturers, this means they must meet the standards developed by NIST to sell their products to federal agencies. The act also sets a de facto standard for the industry, because many private companies tend to follow the requirements for the public sector.
These rules give manufacturers a strong incentive to revise their development practices and security measures. The act initially applies only to sales to federal agencies. It still affects the entire IoT market indirectly, because companies often aim for a single product line for all customers.
U.S. Cyber Trust Mark
In July 2023, the U.S. Cyber Trust Mark was announced, a voluntary certification program for IoT devices. The Federal Communications Commission (FCC) adopted the program in March 2024. Since April 2026, the ioXt Alliance has led the program, after UL Solutions withdrew as lead administrator at the end of 2025. As of October 2026, the program is still being set up.
The program provides a visible label for products that meet certain security standards. The underlying standards are based on NIST guidelines and cover aspects such as secure default settings, data encryption, regular updates, and clear privacy policies.
At first, the program focuses on consumer IoT devices such as smart home devices, fitness trackers, and smart TVs. For IoT manufacturers, the Cyber Trust Mark offers a way to stand out in the market and build trust with consumers. It creates an incentive for continuous investment in product security and could become a de facto standard in the market.
The program shows the growing importance of IoT security at the national level and aims to build a culture of security across the industry. For consumers, it offers simple guidance when choosing secure IoT products.
State laws
Besides the federal initiatives, several US states have passed their own IoT security laws or are considering them. These state laws play an important role in shaping IoT security in the US.
- California was the first state to pass an IoT security law, with Senate Bill No. 327 in 2018. The law requires “reasonable” security features for connected devices. Devices must either have a unique password or require users to create a new password before first use. As a pioneering law, it set an important precedent for state-level IoT regulation. It also drew the attention of manufacturers and consumers to basic security measures.
- Oregon followed in 2019 with House Bill 2395, which builds on the California model but goes a step further. It defines more precisely what counts as “reasonable” security features and requires industry-standard security features and explicit protection against unauthorized access. This more precise definition gives manufacturers more concrete guidance and sets a higher bar for IoT security. The Oregon law shows how states learn from each other and refine their laws to close gaps in earlier versions.
- Other states have also started IoT security initiatives. In Illinois, House Bill 3391 was introduced to create a “Security of Connected Devices Act”, but it did not pass in the 2019–2020 legislative session.
- New York is considering a law similar to the approaches in California and Oregon with Senate Bill 7269. Its predecessor, Assembly Bill 561, did not pass in the 2023–2024 legislative session. The bill is still under discussion. Because of New York's size and influence, it could have far-reaching effects on IoT security across the country.
The significance of these state laws goes far beyond state borders. They set benchmarks for basic security measures and influence the development of federal standards. For IoT manufacturers, this means adapting product development to different state requirements. Many manufacturers tend to design their products to the strictest requirements, so that they can offer a single product line for the entire US market. As a result, the laws of large states such as California and New York often have a de facto national effect.
Different requirements at the federal and state levels raise practical questions about product strategy. Does a “strictest requirement” approach pay off, or do separate product variants make more sense? We can work through this with you in a short call.
What this means for IoT manufacturers
The changing rules have far-reaching effects on IoT manufacturers. They must adapt their product development to the different state and federal requirements. They must also expect higher investment in research and development for security features. This can raise production costs. It also gives manufacturers a chance to stand out in the market through early adaptation and innovative security solutions.
Manufacturers who respond proactively to these regulatory demands can gain competitive advantages. They position themselves as leaders in security and as trustworthy partners for consumers and businesses, who pay more and more attention to the security of their connected devices.
Future developments and trends
IoT security regulation in the US is still evolving. The IoT Cybersecurity Improvement Act has already taken important steps toward harmonization at the federal level, but the development is far from complete.
The framework created by the act is expected to be expanded and refined. The NIST standards are likely to be updated regularly to keep pace with fast-changing threats.
Initiatives such as the U.S. Cyber Trust Mark are likely to gain importance. Such programs could move from voluntary to quasi-mandatory standards, as happened with energy efficiency labels. For manufacturers, taking part in such programs could become a deciding competitive factor.
As artificial intelligence and machine learning play a growing role in IoT security, future regulations are expected to set specific requirements for the use of these technologies. These could include rules on transparent algorithms, bias prevention, and the ethical use of AI.
IoT devices collect more and more data, so closer links between security and data protection rules are likely. Future regulations could require integrated approaches that address both aspects together.
These developments will continue to shape the IoT market in the US. They bring new challenges for manufacturers, but also opportunities for innovation and for competitive advantage through early adaptation to higher security standards.
Balancing security and innovation
US cybersecurity regulation for IoT is at a decisive stage. Federal initiatives, state laws, and voluntary standards together form a complex but forward-looking set of rules. IoT manufacturers must keep adjusting their strategies, and they gain room for innovation and competitive advantage in return.
The challenge is to balance security and technological progress. AI-based security solutions, international standardization efforts, and a closer link between security and data protection are likely to gain importance. The rules will be judged by whether they create an IoT ecosystem that is both secure and open to innovation. The decisions made in the US will also influence IoT markets worldwide.
US IoT regulation differs considerably from the European approach, for example the CRA, the RED, or ETSI standards. If you want to assess how US requirements affect your product development, documentation, or market access strategy, we can work through this in a no-obligation call.
