The Cyber Security Act 2024: mandatory security standards for smart devices

Australia now has mandatory minimum cyber security standards for consumer "smart" (Internet of Things) devices. They flow from Part 2 of the Cyber Security Act 2024, which was made on 29 November 2024, and are given effect by the Cyber Security (Security Standards for Smart Devices) Rules 2025. Home Affairs states that the Rules "commenced on 4 March 2026, following a 12-month transition period" (Home Affairs). They apply to relevant connectable products acquired in Australia by a consumer, including those made by overseas manufacturers.

In short: if you manufacture, import or supply consumer smart devices in Australia, those devices must meet a baseline security standard and ship with a statement of compliance. The regime is administered by the Department of Home Affairs, and the headline obligations align with the international consumer-IoT baseline, ETSI EN 303 645.

What the smart device standards require

The standards set a floor, not a ceiling. They target the most common, low-effort security failures in cheap connected devices rather than imposing a full security-engineering regime. Three obligations form the core of the rules:

• no universal default passwords;
• a published means for reporting security vulnerabilities; and
• a published defined support period during which security updates will be provided.

Manufacturers must also provide a statement of compliance with each affected product. Home Affairs says the standards closely follow the first three principles of ETSI EN 303 645 and the United Kingdom's Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023. For broader context on how this fits Australia's cyber framework, see the cyber security topic hub.

Which devices and businesses are in scope

Home Affairs' factsheet says the standards apply to any smart device that meets the definition of a relevant connectable product in the Act, will be acquired (or could reasonably be expected to be acquired) in Australia by a consumer, and is intended by the manufacturer to be used for personal, domestic or household use. Examples it gives include:

• smart TVs;
• smart watches;
• home assistants;
• baby monitors; and
• consumer energy resources.

The standards apply to all in-scope products manufactured on and from 4 March 2026. Products manufactured before that date are not required to comply. Because the obligations are tied to products acquired in Australia, an overseas manufacturer whose product is sold here is captured just as an Australian one would be. The duties fall on manufacturers and suppliers rather than on end users.

Section 8 of the Rules excludes: desktop computers and laptops; tablet computers; smartphones; therapeutic goods within the meaning of the Therapeutic Goods Act 1989; road vehicles; and road vehicle components. If your product is borderline (for example, a device sold to both businesses and households), assess it against the definition above and the exclusions in the current Rules.

The three mandatory security requirements

No universal default passwords. Home Affairs' factsheet says passwords must be unique per product or defined by the user of the product, for a device's hardware or pre-installed software used in any state other than factory default.

A means to report security issues. Manufacturers must publish a means to report security issues to the manufacturer, with status updates on the resolution of those issues.

A defined support period. Manufacturers must publish information about how long the device will be supported, including an end date for the period during which the product will receive security updates. This gives consumers transparency about how long their device will be patched.

Statements of compliance and timing

A central mechanism in the regime is the statement of compliance. Manufacturers must provide statements of compliance for the supply of in-scope products where they are aware, or could reasonably be expected to be aware, that the product will be acquired by a consumer in Australia, and suppliers must supply in-scope products with the statement. The Rules also set the period for which manufacturers and suppliers must retain these statements. Home Affairs notes that the Act does not define what "accompanied" or "supply the product with" requires, so each entity must decide how it will comply for its own products.

The Rules commenced after a 12-month transition period. Home Affairs states that products manufactured before 4 March 2026 are not required to comply with the security standards, because the standards were not in effect on their date of manufacture; the obligation on suppliers not to supply non-compliant products applies to products required to comply. See the Department of Home Affairs.

Enforcement: compliance, stop and recall notices

Part 2 of the Cyber Security Act 2024 gives the Secretary of the Department of Home Affairs graduated enforcement powers. An independent audit of a product may be undertaken to determine compliance, and the Secretary may request the manufacturer or supplier to provide the product, the statement of compliance or both for that purpose. The Secretary may also give:

• a compliance notice (s 17), where reasonably satisfied that an entity is not complying with its obligation;
• a stop notice (s 18), only if the entity has already been given a compliance notice for that non-compliance; and
• a recall notice (s 19), only if the entity has already been given a stop notice for that non-compliance.

This escalation ladder gives the regulator scope to respond proportionately. Non-compliance can therefore have commercial consequences (lost market access, recalls) well beyond any direct penalty. Confirm the current penalty settings in the Act with Home Affairs before quantifying exposure.

What manufacturers and suppliers should do now

A practical compliance pathway:

1. Inventory your products. Identify which SKUs supplied in Australia are in-scope consumer connectable devices.
2. Map to ETSI EN 303 645. The Australian standards closely follow its first three principles, so use it as a reference control set; the three Australian requirements are the minimum.
3. Eliminate default passwords. Move to per-device credentials or forced first-use password setting.
4. Publish a vulnerability disclosure policy. Stand up a monitored channel and document your triage process.
5. Publish a defined support period. Commit to, and disclose, a minimum security-update window.
6. Prepare statements of compliance and retain supporting evidence (test records, configuration documentation).
7. Assign accountability internally — this is a board-level supply-chain and product-safety issue, not just an engineering one.

Organisations already maturing their broader security posture can use the Essential Eight assessment as a complementary internal control baseline, and entities in regulated sectors should align this work with their obligations under SOCI cyber incident reporting where relevant.

Common pitfalls

• Assuming overseas manufacture is a shield. It is not — supply into Australia triggers the obligations.
• Treating it as a paperwork exercise. A statement of compliance must be substantiated; an audit can test the underlying device.
• Forgetting the support period must be honoured. Publishing a window then failing to ship updates is itself a problem.
• Letting the vulnerability mailbox go unmonitored. A published contact that nobody reads defeats the requirement.
• Over-reading exemptions. Borderline consumer/enterprise products are easy to misclassify; check the current Rules.
• Ignoring inventory churn. New SKUs, firmware variants and rebadged products each need their own assessment.

The smart-device standards are a relatively light-touch first step, but they are mandatory and enforceable. Building the three core controls into product design and documentation now is far cheaper than responding to a stop or recall notice later.