Distributes a software product, in Australia

Cyber Security Act 2024 (Cth), No. 98, 2024, Part 2, ss. 13-24; Cyber Security (Security Standards for Smart Devices) Rules 2025 (F2025L00276), Schedule 1 · Read the law's page

• This binds a manufacturer or supplier of a relevant connectable product that will be acquired in Australia, and does not by itself reach a company that only publishes an app or other software with no connectable device of its own; the standard for consumer grade products does not reach a desktop computer, a laptop, a tablet computer, a smartphone, a therapeutic good, a road vehicle, or a road vehicle component.
• Do not manufacture or supply a consumer grade smart device with a universal default password from 4 March 2026 for a product manufactured on or after that date; the device's hardware and any pre-installed or required software must use a password unique to that unit or set by the user, for every state other than the factory default.
• Publish a means for a security issue affecting the device to be reported to the manufacturer, and provide status updates on the resolution of a reported issue.
• Publish, before supply, the period including an end date for which the device will receive security updates, provide or supply the product with a statement of compliance with the security standard, and retain a copy of that statement for five years.