Key takeaways
- Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025 became mandatory on 4 March 2026, making it the country's first binding baseline for consumer connected-device security.
- A manufacturer prepares a statement of compliance for each covered product; a supplier must ensure the product is supplied together with that statement.
- Check the manufacture date, not the sale date.
Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025 became mandatory on 4 March 2026, making it the country's first binding baseline for consumer connected-device security. Made under Part 2 of the Cyber Security Act 2024 (Royal Assent 29 November 2024) and registered on the Federal Register of Legislation on 4 March 2025 as F2025L00276, the Rules replace Australia's earlier 2020 voluntary code of practice with an enforceable requirement covering three familiar baseline provisions — no default passwords, a vulnerability-reporting channel, and published update-support periods — for most consumer smart devices manufactured from the commencement date.
What the Rules are structured as
The registered legislative text sets out Part 1 (Preliminary) — sections on the Rules' name, commencement, the statutory authority (the Cyber Security Act 2024) and definitions — followed by Part 2 (Security Standards), which contains a simplified outline, the meaning of "consumer," the core security-standard obligation for "consumer grade relevant connectable products," requirements for a manufacturer's statement of compliance, a document-retention period, and a notification duty if a recall notice isn't complied with. The three substantive technical requirements themselves sit in a Schedule, as three clauses: clause 2 (passwords), clause 3 (addressing security issues and vulnerability disclosure), and clause 4 (defined support periods and security updates).
Who the Rules cover, and who's carved out
A "relevant connectable product" is a consumer-grade device that can connect, directly or indirectly, to the internet and is intended for personal, domestic or household use: smart TVs, IP cameras, smart speakers and home assistants, connected baby monitors, smart watches, home routers and similar connected appliances. The Rules explicitly exclude general-purpose computers, laptops and tablets, smartphones, therapeutic goods (which fall under separate medical-device regulation) and motor vehicles. Timing matters as much as category: the standard applies to a covered product manufactured on or after 4 March 2026; stock manufactured before that date isn't caught, because the standard wasn't yet in force when it was made.
The three requirements, and their ETSI EN 303 645 lineage
| # | Requirement | What it requires |
|---|---|---|
| 1 | No universal default passwords | Each unit ships with a unique per-device password, or requires the user to set one — no shared, factory-set default across a product line |
| 2 | Vulnerability reporting mechanism | A publicly available channel for reporting security issues, with stated acknowledgement and status-update timelines |
| 3 | Published security update period | A disclosed minimum support window for security updates, with a specified end date that cannot be shortened once published, made accessible and clear to users |
Law-firm analysis of the Rules describes these three as derived from the first three provisions of ETSI EN 303 645, the same baseline underlying the UK's PSTI regime and the US Cyber Trust Mark and Singapore's CLS(IoT) Tier 1 — see our ETSI EN 303 645 guide for that baseline's full text basis. Separate coverage of the reform frames the Rules as deliberately aligned with the UK PSTI regime specifically, which has applied since April 2024. A product that already satisfies PSTI's or CLS's Tier 1 obligations is, on this reading, most of the way to Australia's three requirements as well — though neither the UK, Singapore nor Australian schemes formally recognise each other's compliance statements, so each still needs its own documentation.
Compliance duties and enforcement
A manufacturer prepares a statement of compliance for each covered product; a supplier must ensure the product is supplied together with that statement. Secondary legal summaries of the Rules' retention provision describe a duty to keep that compliance documentation for five years. The Department of Home Affairs administers the scheme under the Cyber Security Act 2024, and law-firm coverage of the reform describes the Secretary's available tools as compliance notices, stop notices and recall notices for non-compliant products, with a further notification duty if a recall notice isn't actioned. This guide's own fetch of the Department's explainer page returned an HTTP 403 response rather than the rendered page, so the enforcement-mechanism description above rests on secondary legal analysis rather than the Department's own text — confirm current enforcement detail directly with the Department before relying on it for a live compliance decision.
What's next
Coverage of the reform notes the Government has flagged plans to add further requirements to the mandatory standard over time and to consider an equivalent standard for enterprise-grade devices, while a separate, government-funded but industry-led voluntary labelling scheme for smart devices is being developed in parallel by IoT Alliance Australia, targeted for completion by 31 March 2027. A manufacturer selling into Australia today should treat the current three-requirement baseline as a floor likely to be extended, not a fixed, one-time compliance target.
A workable starting point
Check the manufacture date, not the sale dateThe Rules bind products manufactured on or after 4 March 2026 — a device manufactured earlier and still in inventory isn't automatically caught, but confirm your own supply chain's manufacture dates before assuming an exemption applies. Reuse ETSI EN 303 645 / PSTI / Cyber Trust Mark workIf your device already meets the UK's PSTI baseline or the US Cyber Trust Mark, the underlying engineering evidence — unique credentials, a disclosure channel, a published support window — covers most of Australia's three requirements too, though the compliance statement itself is a separate document. Draft the statement of compliance and retention process nowBoth the manufacturer's statement and the five-year retention duty need to exist before the first covered unit ships, not after a Department inquiry. Publish the support-period end date deliberatelyBecause the Rules describe that date as unable to be shortened once published, treat the initial published window as a floor your product-support roadmap has to honour. Track the Department's page directly for near-term changesThe Government has signalled further mandatory requirements and a parallel voluntary labelling scheme are coming; a one-time compliance review against today's three requirements won't stay current.
SoftWSP's device and firmware assessments can document the unique-credential, vulnerability-disclosure and update-support evidence Australia's Rules, the UK's PSTI, and the US Cyber Trust Mark all expect from the same underlying engineering work: see Device & Firmware Security.
This guide summarizes the registered text of the Cyber Security (Security Standards for Smart Devices) Rules 2025 and independent secondary legal analysis current as of this guide's last-updated date; it is not a substitute for the Rules' full text or for compliance or legal advice. The Department of Home Affairs' own explainer page could not be fetched for this guide (HTTP 403) — confirm enforcement detail directly with the Department.
Sources
- Federal Register of Legislation: Cyber Security (Security Standards for Smart Devices) Rules 2025 (F2025L00276) — registered legislative text, Parts 1-2 and Schedule structure
- Federal Register of Legislation: Cyber Security (Security Standards for Smart Devices) Rules 2025 — as-made PDF
- Department of Home Affairs: Security Standards for Smart Devices (this guide's research fetch received an HTTP 403 response rather than the rendered page)
- Minter Ellison: Cyber security standards for consumer smart devices — Australia's new mandatory IoT security requirements
- AO Shearman: Australia — new security standards for smart devices
- Federal Register of Legislation: Cyber Security Act 2024 (Cth) — Royal Assent 29 November 2024
Frequently asked questions
What is the Cyber Security (Security Standards for Smart Devices) Rules 2025?
It is a legislative instrument made by the Australian Government under Part 2 of the Cyber Security Act 2024 (Cth) — the Act itself received Royal Assent on 29 November 2024. The Rules were registered on the Federal Register of Legislation on 4 March 2025 under reference F2025L00276, and, per that registered text, are structured as Part 1 (Preliminary: name, commencement, authority and definitions), Part 2 (Security Standards: a simplified outline, the meaning of "consumer," the security-standard obligation itself, statement-of-compliance requirements, a retention period, and recall-notice notification), and a Schedule setting out the three substantive technical requirements. They commenced on 4 March 2026, a date fixed by the instrument's own commencement provision rather than chosen informally.
What counts as a "relevant connectable product" under the Rules?
Industry guidance summarizing the Rules (the instrument's own definitions sit in Part 1, section 4) describes a relevant connectable product as a consumer-grade device that can connect, directly or indirectly, to the internet and is intended for personal, domestic or household use — smart TVs, IP cameras, smart speakers and home assistants, connected baby monitors, smart watches, home routers and similar connected appliances. Several categories are carved out: general-purpose computers, laptops and tablets, smartphones, therapeutic goods (regulated separately as medical devices), and motor vehicles. The Rules apply to covered products manufactured on or after 4 March 2026; stock manufactured before that date is not required to comply, because the standard was not yet in force when it was made.
What are the three security requirements, and do they track a specific international standard?
Per the Rules' Schedule (clauses 2 to 4, as reflected in the registered legislative text) and consistent secondary legal analysis, the three requirements are: (1) no universal default passwords — each device must ship with a unique per-device password or require the user to set one, rather than shipping a shared default; (2) a published mechanism for reporting security issues, with a public contact point and stated acknowledgement/update timelines; and (3) published transparency about the minimum period during which security updates will be provided, including a specified end date that, once published, cannot be shortened. Law-firm analysis of the Rules (AO Shearman) describes the first three as derived from the European Telecommunications Standards Institute's EN 303 645 baseline, while other coverage of the reform describes the regime as deliberately aligned with the UK's Product Security and Telecommunications Infrastructure (PSTI) Act regime, which rests on the same three ETSI EN 303 645 provisions — see our [ETSI EN 303 645](/guides/etsi-en-303-645-consumer-iot-security/) and [PSTI / US Cyber Trust Mark](/guides/psti-cyber-trust-mark/) guides for that baseline in its EU/UK/US form.
What must a manufacturer or supplier actually do to comply, and what happens if they don't?
The registered Rules require a manufacturer to prepare a statement of compliance for a covered product and a supplier to ensure the product is supplied together with that statement; secondary legal summaries of the retention provision (Part 2) describe a duty to keep that documentation for five years. The Department of Home Affairs administers the regime on the Secretary's behalf under the Cyber Security Act 2024, with compliance tools described in law-firm coverage of the reform including compliance notices, stop notices and recall notices for non-compliant products — this guide's direct fetch of the Department's own explainer page at homeaffairs.gov.au returned an HTTP 403 response, so the enforcement-mechanism description here rests on secondary legal analysis (Minter Ellison, AO Shearman) rather than the Department's own page text; confirm current enforcement detail directly with the Department before relying on it for a compliance decision.
In this cluster
