A manufacturer may elect to satisfy subdivision (a) by ensuring the connected device does all of the following: (1) meets or exceeds the baseline product criteria of a NIST conforming labeling scheme; (2) satisfies a conformity assessment as described by that scheme that includes a third-party test, inspection or certification; and (3) bears the binary label the scheme describes. A NIST conforming labeling scheme is one conforming to NIST's Cybersecurity White Paper Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products of 4 February 2022, including revisions and successor publications. Added by AB 2392 (Stats. 2022, Ch. 785), effective 1 January 2023. The FCC's voluntary U.S. Cyber Trust Mark, finalised in January 2025 with accredited-lab testing, is the federal labeling programme a manufacturer would assess against that definition.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.