Loading story…
UL Solutions has formally withdrawn as the lead administrator of the Federal Communications Commission's Cyber Trust Mark program, a flagship initiative designed to help consumers identify secure Internet of Things (IoT) devices. The departure, which followed internal security reviews and concerns about foreign influence in program management, has raised uncertainty about the future of the Biden-era voluntary cybersecurity labeling program for consumer electronics. UL Solutions stated it had completed foundational work for the initiative and expressed continued support for the FCC's goals of advancing IoT security and consumer safety.
The withdrawal leaves the FCC without a lead administrator for the Cyber Trust Mark program, and it is unclear who will take over the role. The program, launched to prioritize cybersecurity in consumer IoT products, now faces questions about its continuity and effectiveness amid the leadership change and ongoing scrutiny regarding potential ties to foreign entities. The situation underscores the challenges in establishing trusted oversight for national cybersecurity initiatives targeting the rapidly expanding IoT market.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
The FCC chose California-based nonprofit ioXt Alliance as the new lead administrator for its Cyber Trust Mark IoT cybersecurity labeling program after UL Solutions withdrew. ioXt said it would work with the FCC, UL Solutions, and industry stakeholders to advance the program.
UL Solutions formally withdrew from its role as chief administrator of the FCC's Cyber Trust Mark program, leaving the initiative without a lead entity. The FCC had not announced a replacement, creating uncertainty about the program's future.
A national security review was initiated in summer 2025 over concerns about possible foreign influence in the management of the Cyber Trust Mark program. The review raised questions about UL Solutions' role and the program's administration.
The Biden administration launched the FCC's voluntary Cyber Trust Mark program to label consumer IoT devices that meet cybersecurity standards. The initiative was intended to help consumers identify more secure smart home and connected products.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
nextgov.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcenextgov.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Federal Communications Commission (FCC) announced plans to vote on rescinding cybersecurity regulations that were enacted in response to major breaches of U.S. telecommunications companies by Chinese state-sponsored actors, specifically the Salt Typhoon group. These regulations, introduced at the end of the Biden administration, required telecom providers to implement enhanced network security measures and submit annual certifications of their cybersecurity risk management plans. The breaches included the theft of sensitive correspondence belonging to President Donald Trump and Vice President JD Vance, prompting the initial regulatory response. FCC officials, including Chairman Brendan Carr and Secretary Marlene Dortch, argued that the existing rules were overly broad, inflexible, and imposed unnecessary burdens on telecom providers, many of whom have already adopted voluntary security measures. The FCC contends that a more targeted, collaborative approach between federal agencies and private industry would be more effective in addressing sophisticated threats like those posed by Salt Typhoon, rather than blanket regulations. The upcoming vote will determine whether these Biden-era cybersecurity requirements for telecoms will be officially rescinded.
Jun 29, 2026
The Federal Communications Commission (FCC) is preparing to vote on whether to repeal cybersecurity regulations that were introduced following the Salt Typhoon attacks on U.S. telecommunications providers. These Biden-era rules, enacted in early 2025, required telecom carriers to implement basic security controls to prevent unauthorized access, but are now facing reversal under the Trump administration. Industry groups have petitioned the FCC, arguing that the agency overstepped its legal authority by interpreting the Communications Assistance for Law Enforcement Act (CALEA) to impose broad cybersecurity mandates, which they claim were not intended by Congress. The move to rescind these rules comes amid ongoing concerns about the security of the U.S. telecommunications sector, highlighted by the Salt Typhoon incident and subsequent calls from lawmakers for stronger, mandatory cybersecurity standards. Despite bipartisan pressure, including a Senate resolution and letters from Senators Wyden and Warner, the Cybersecurity and Infrastructure Security Agency (CISA) has not released a critical report on telecom sector vulnerabilities. The debate underscores the tension between regulatory authority, industry resistance, and the urgent need to address persistent cyber threats targeting national communications infrastructure.
Jun 29, 2026
The United States is experiencing a period of instability in its federal cybersecurity leadership, with budget cuts, leadership turnover, and shifting political priorities undermining the government's traditional role in setting national cyber strategy. Federal agencies, including the Office of the National Cyber Director, are facing funding and staffing challenges, leaving critical infrastructure operators and security professionals without consistent guidance or support. This erosion of centralized leadership is forcing the private sector and local governments to manage escalating cyber threats and operational risks independently, often without a unified national playbook. Compounding these challenges is a growing crisis in the cybersecurity workforce, as underfunded education systems and high burnout rates threaten the talent pipeline needed for national digital defense. The lack of federal investment in cyber education and workforce development is creating vulnerabilities that adversaries may exploit. Meanwhile, political divisions are evident in the debate over how to respond to major cyber intrusions, such as the China-linked Salt Typhoon campaign targeting US telecommunications networks. Lawmakers remain split on whether voluntary industry partnerships or mandated standards are necessary to address fundamental security weaknesses, highlighting the broader uncertainty in US cyber policy and enforcement.
Jun 29, 2026