Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Practices & Industries

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Irving Picard Receives Lifetime Achievement Award from The American Lawyer

IP Intelligence Report

Director Squires’ Latest Memo: Share Your Search to Boost Your Odds of IPR Institution

Data Counsel

Understanding Compliance: FCC’s Final Rule on IoT Cybersecurity Labeling and Executive Order 14306: A New Mandatory Regime for Connected Device Manufacturers

Ohio Clock

Hallway with a grandfather clock displayed

The Weekly Hill Update

On June 6, 2025, the regulatory landscape for manufacturers of connected devices changed significantly with the implementation of Executive Order 14306, which extends the reach of the Federal Communications Commission’s (FCC) Final Rule on Cybersecurity Labeling for Internet of Things (IoT) Products (Final Rule) and makes the voluntary FCC regime compulsory for connected products sold to the federal government after Jan. 4, 2027. For legal and compliance teams advising manufacturers of connected devices, understanding the compliance obligations under these new frameworks is essential.

core/paragraph

FCC’s Final Rule: Cybersecurity Labeling for IoT Products

core/heading

In 2024, the FCC finalized its rule authorizing the use of cybersecurity labeling (the U.S. Cyber Trust Mark) for a broad range of consumer IoT devices. The Final Rule mandates that manufacturers that use the labeling ensure their connected devices meet baseline cybersecurity standards, such as secure software updates, data protection measures and vulnerability reporting mechanisms. Devices that comply will bear a cybersecurity label, signaling to consumers that the product meets federal guidelines. The Final Rule points to NISTIR 8425 as the operative set of baseline cybersecurity standards.

For connected device manufacturers, compliance means:

Establishing robust cybersecurity protocols during the product design phase

core/list-item

Maintaining documentation demonstrating adherence to FCC standards

Participating in third-party assessments or self-attestation processes, as specified by the rule

Ensuring ongoing compliance, including timely software updates and incident response plans

core/list

Executive Order 14306 reinforces and expands upon federal cybersecurity initiatives. While originally focused on promoting competition, the order now explicitly directs the Federal Acquisition Regulatory Council to require U.S. Cyber Trust Mark labeling on all federally procured connected devices after Jan. 4, 2027. This means manufacturers seeking to sell to the federal government – or whose products may be used in critical infrastructure – must adhere to the FCC’s labeling requirements and may face additional scrutiny regarding supply chain security and data privacy. The timeline afforded the FAR Council to amend the Federal Acquisition Regulations to incorporate these requirements is notable as well. EO 14306 requires the agency members of the FAR Council to jointly take steps to amend the Federal Acquisition Regulations within one year of June 6, 2025. As a result, organizations may have as little as six months to assess the reach of the amended Federal Acquisition Regulations and bring products into compliance for procurement by the federal government in 2027.

Review product portfolios: Assess which devices fall under the scope of the FCC’s rule, EO 14306 and the amended Federal Acquisition Regulations.

Update compliance programs: Align internal policies and procedures with new labeling and security standards.

Monitor regulatory guidance: Stay abreast of FCC updates and agency interpretations of EO 14306, as enforcement priorities may evolve.

Engage stakeholders: Work with product development, IT and supply chain teams to ensure compliance at every stage of the life cycle of each device.

Related Services

Featured Insights