Smart Home Audit Checklist: Run It Once a Year

The U.S. government already decided what a family needs to know about a connected device, and wrote it down. The FCC’s Cyber Trust Mark label is designed so the QR code beside it tells a buyer four things: how to change the default password, how to configure the device securely, whether automatic updates are available, and the product’s minimum support period end date. That last item is the one no company volunteers. A useful smart home audit checklist is simply those four questions, asked of every device you already own, once a year.

Key Takeaways

• Build the audit around four disclosures: default password change, secure configuration, automatic update availability, and the minimum support period end date, which is what the FCC’s label QR code is specified to carry.
• The FTC surveyed 184 smart products in 2024 and found nearly 89% did not disclose on the manufacturer’s website how long software updates would continue. For 124 of the 184, ordinary internet searches found nothing either.
• Separate your devices into two networks. Appliances and cameras do not need to see laptops, and CISA’s home network guidance recommends disabling remote management, WPS and UPnP on the router.
• Count microphones and cameras rather than devices. A single smart display can be two sensors; a voice remote is one most people never count.
• Do it in the same week every year. January works because it follows the month when the most new connected devices enter a house.

Why four questions, and why these four

A security audit for a household cannot be a 40-page framework. It has to be short enough to actually finish.

The shortcut is that regulators already did the prioritisation. The FCC adopted the framework for the U.S. Cyber Trust Mark in March 2024, a voluntary cybersecurity label for wireless consumer devices. Eligible categories include internet-connected home security cameras, voice-activated shopping devices, smart appliances, fitness trackers, garage door openers and baby monitors. Personal computers, smartphones and routers are excluded, as are medical devices and vehicles.

The specified QR code content is the interesting part. It covers instructions for changing the default password, guidance on secure configuration, details on whether automatic updates are available, and the product’s minimum support period end date or a statement that the device is not supported.

Program milestones so far: the ioXt Alliance was named lead administrator on April 13, 2026, the Cybersecurity Label Administrator filing window opened August 11, 2026, and accreditation bodies were recognised on September 28, 2026. Full manufacturer applications are still pending a final launch announcement, so the label is not yet on most shelves. The questions behind it work regardless.

Underneath the label sits a technical document. NIST IR 8425, “Profile of the IoT Core Baseline for Consumer IoT Products,” published September 2022 by Fagan, Megas, Watrobski, Marron and Cuthill, phrases its requirements as cybersecurity outcomes that apply to an entire IoT product rather than to one component. That framing matters: the “product” includes the phone app and the cloud service, not just the box.

The audit, step by step

Step	The question	What a pass looks like	Time
1. Inventory	What is actually connected?	A written list from the router’s client table, not from memory	20 min
2. Sensors	How many microphones and cameras?	A number you can say out loud, counted per device	10 min
3. Credentials	Any default or reused passwords?	Unique password per account, multi-factor on anything with video	20 min
4. Updates	Is automatic updating on, and did it run?	A firmware date within the last six months on every device	15 min
5. Support window	When does each device stop getting patches?	A date in writing, or an acknowledged “unknown”	10 min
6. Segmentation	Can the doorbell reach the laptop?	Appliances on a guest or IoT network, laptops on the main one	15 min
7. Retire	What should leave the house?	At least one device unplugged and factory reset before disposal	10 min

Ninety minutes, once a year. Three of the seven steps are things most households have never done even once.

Step 1 and 2: inventory and sensor count

Do not list devices from memory. Log into the router’s administration page and open the connected-clients table. That list is the truth, and it usually contains three or four things nobody expected: an old tablet, a printer, a smart plug behind a sofa, a neighbour’s device that joined years ago.

Then convert the device list into a sensor list. A smart display is a microphone and a camera. A television is often a microphone in the remote plus far-field microphones in the set. A games console headset left plugged in is a live microphone. Our room-by-room microphone count is the long version of this step.

Why the sensor count rather than the device count? Because the risk scales with what can be captured, not with how many power bricks you own.

Step 3: credentials, and why video changes the stakes

Default passwords are the oldest failure in connected hardware, and they remain the first item the FCC’s label addresses.

The case that explains the priority is the FTC’s 2023 action against Ring. The order produced $5.8 million in consumer refunds after the complaint described employees and contractors accessing private home video, including bathrooms and bedrooms, and roughly 55,000 U.S. customers whose accounts were taken over by outsiders. Children appeared in some footage. Part of the remedy was mandatory multi-factor authentication.

The practical rule: every account attached to a camera or a microphone gets a unique password and a second factor, without exception. Everything else can wait until next year’s audit.

Step 4 and 5: updates and the date nobody publishes

Turn on automatic updates and then verify they ran. An app that says “up to date” without showing a firmware version and date is not evidence.

Then the hard question. In November 2024, the FTC published a staff survey of 184 smart devices across categories including hearing aids, security cameras and door locks. Nearly 89% did not disclose on the manufacturer’s website how long the product would receive software updates. When FTC staff ran basic internet searches, 124 of the 184 still had no discoverable support duration. Samuel Levine, then directing the Bureau of Consumer Protection, framed the harm: “Consumers stand to lose a lot of money if their smart products stop delivering the features they want.”

The staff paper also noted a legal angle: for products sold with a written warranty, failing to disclose software support duration may violate the Magnuson-Moss Warranty Act, and claims about usability may raise FTC Act issues.

So email support with one sentence and keep the reply. “Through what date will model X receive security updates?” A non-answer is still data, and recording it is the point. What happens after that date is covered in our piece on smart devices at end of support.

Step 6: two networks, fifteen minutes

Network segmentation means putting devices on separate networks so a compromise of one does not reach the others. Almost every router sold in the last decade can create a guest network, and that is enough.

Main network: laptops, phones, anything holding documents or banking. Second network: cameras, speakers, appliances, plugs, televisions, the pet feeder.

While you are in the router settings, CISA’s home network security guidance recommends several specific changes: use WPA3 with AES, change default administrator credentials, disable remote management, disable Wi-Fi Protected Setup to prevent PIN brute-forcing, disable UPnP unless something specifically needs it, keep firmware current, and rename the SSID so it does not identify the household or the hardware. Note that this page is archived content dated February 1, 2021, so treat it as a solid baseline rather than the latest word. The step-by-step for a typical home router is in our router security walkthrough.

Step 7: deciding what leaves

An audit that only adds work is an audit nobody repeats. End by removing something.

Good candidates: a speaker in a child’s bedroom, a camera pointed at a room nobody worries about, an old tablet still joined to the network, a device whose manufacturer no longer answers email. Unplug it, factory reset it before it leaves the house, and remove the account.

Factory reset matters more than people think. A device sold or donated with credentials and Wi-Fi details still on it hands a stranger a working key to your network.

What to do at home

Put it on the calendar with a name

“Smart home audit, 90 minutes” in the same week every year. Vague intentions do not survive January. A named calendar block does.

Let a teenager run steps 1 and 2

The inventory and sensor count are genuinely interesting work and a teenager will find devices you missed. Give them the router login for an hour under supervision. It is the single best introduction to how a home network actually works.

Keep a one-page record

Device, purchase date, firmware date, support end date if known, which network it is on. One page in a notes app. Next year’s audit takes half as long because you are comparing rather than discovering.

Treat agent features as a new line item

Assistants that can act rather than answer changed the smart home in 2026. Google’s Gemini for Home, announced June 25, 2026, is free on Google Home speakers with a premium tier from $10 a month for features including searching what cameras are seeing. When software gains the ability to take actions on your behalf, “what can this device do” becomes a question with a changing answer, and it belongs in the annual review.

What not to do

Do not try to audit everything in one sitting with a spreadsheet template downloaded from a security vendor. The 40-item version does not get finished, and an unfinished audit is worse than a short completed one because it creates the feeling of having done it.

What to Watch For Over the Next 3 Months

• Week 4: Check your router’s client list again. New devices appear after holidays and birthdays without anyone deciding to add them to the network.
• Month 2 red flags: A device that stops receiving firmware updates, an app that adds a permission it did not need, or a support email that bounces. Any of the three moves that device to the retirement list.
• Month 3 self-check: Look for the Cyber Trust Mark on packaging for anything you buy. If it is there, scan the QR code before paying and read the support end date. That is the whole audit, done at the point of purchase, in fifteen seconds.

Frequently Asked Questions

How long does a real smart home audit take?

About 90 minutes the first year and 45 the second, because you are updating a record rather than building one. The inventory step dominates the first pass.

What is the single most valuable step?

Step 5, finding out when each device stops getting security patches, because it is the only step that changes buying behaviour. It is also the step the FTC found almost no manufacturer supports: nearly 89% of 184 surveyed products disclosed nothing.

Do I really need two Wi-Fi networks at home?

For most families, yes, and it takes fifteen minutes once. A camera on a separate network cannot be used as a stepping stone to a laptop holding tax documents. CISA’s guidance on disabling remote management, WPS and UPnP is worth doing in the same sitting.

Is the Cyber Trust Mark available now?

The framework was adopted in March 2024 and administration milestones ran through 2026, with the ioXt Alliance named lead administrator in April 2026 and accreditation bodies recognised in September 2026. Full launch was still pending as of late 2026, so expect labels to appear gradually.

What about devices the label does not cover?

Phones, computers and routers are excluded from the program, so those stay on your own schedule: operating system updates on, router firmware checked annually, and the router replaced when the manufacturer stops issuing patches.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

---

Sources

1. Federal Communications Commission. “Cybersecurity Labeling for Internet of Things (U.S. Cyber Trust Mark).” FCC. https://www.fcc.gov/CyberTrustMark
2. Federal Trade Commission. (2024, November 26). “Smart Products Surveyed Fail to Provide Consumers with Information on How Long Companies will Provide Software Updates.” FTC Press Release. https://www.ftc.gov/news-events/news/press-releases/2024/11/smart-products-surveyed-fail-provide-consumers-information-how-long-companies-will-provide-software
3. Fagan, M., Megas, K., Watrobski, P., Marron, J., & Cuthill, B. (2022). Profile of the IoT Core Baseline for Consumer IoT Products (NIST IR 8425). National Institute of Standards and Technology. https://csrc.nist.gov/pubs/ir/8425/final
4. Cybersecurity and Infrastructure Security Agency. (2021, February 1). “Home Network Security.” CISA (archived content). https://www.cisa.gov/news-events/news/home-network-security
5. Federal Trade Commission. (2023, May 31). “FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users’ Cameras.” FTC Press Release. https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users
6. Schönherr, L., Golla, M., Eisenhofer, T., Wiele, J., Kolossa, D., & Holz, T. (2020). “Unacceptable, where is my privacy? Exploring Accidental Triggers of Smart Speakers.” arXiv:2008.00508. https://arxiv.org/abs/2008.00508
7. Google. (2026, June 25). “100 new ways to make your day easier with Gemini for Home voice assistant.” Google Blog. https://blog.google/products-and-platforms/devices/google-nest/gemini-home-voice-assistant-tips/