AustraliaSecurity Standards for Smart Devices
Cyber Security Act 2024 (Cth) No. 98, 2024, Part 2, ss. 13-24; Cyber Security (Security Standards for Smart Devices) Rules 2025 (F2025L00276), Schedule 1
In force since .
A product security requirements rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Security, Disclosure, Governance
What it requires
- This binds a manufacturer or supplier of a relevant connectable product that will be acquired in Australia, and does not by itself reach a company that only publishes an app or other software with no connectable device of its own; the standard for consumer grade products does not reach a desktop computer, a laptop, a tablet computer, a smartphone, a therapeutic good, a road vehicle, or a road vehicle component.
- Do not manufacture or supply a consumer grade smart device with a universal default password from for a product manufactured on or after that date; the device's hardware and any pre-installed or required software must use a password unique to that unit or set by the user, for every state other than the factory default.NIST CSF 2.0PR.PS-06
- Publish a means for a security issue affecting the device to be reported to the manufacturer, and provide status updates on the resolution of a reported issue.NIST CSF 2.0ID.RA-08
- Publish, before supply, the period including an end date for which the device will receive security updates, provide or supply the product with a statement of compliance with the security standard, and retain a copy of that statement for five years.NIST CSF 2.0PR.PS-02NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text. Also read by: Department of Home Affairs, Technology Assessment and Regulation Office (TARO) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established
- PR.PS-02Software is maintained, replaced, and removed commensurate with risk
- PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
- CIS Controls
- 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
The Secretary of the Department of Home Affairs, supported by the Technology Assessment and Regulation Office (TARO).
Settledness
- As of
- Guidance link
- https://www.homeaffairs.gov.au/cyber-security-subsite/files/factsheet-security-standards-for-smart-devices-and-consumer-grade-rules.pdf
- Guidance body
- Department of Home Affairs, Technology Assessment and Regulation Office (TARO)
- Open questions
- Section 15(5)-(6) of the Cyber Security Act 2024 confines the compliance duty, for an entity that is not a constitutional corporation and is not trading interstate or internationally, to requirements concerning the product's connection to, or use of, a telecommunications-type service and measures protecting it from an attack by such a service: does a requirement of the security standard that does not fit that description bind such an entity at all?
What this law does
A manufacturer of a relevant connectable product, a product able to connect directly or indirectly to the internet or to another such product by a like means, must manufacture it in compliance with the security standard the rules set for its class if the manufacturer is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia, and a supplier must not supply a product that was not manufactured in compliance with that standard.
The Cyber Security (Security Standards for Smart Devices) Rules 2025 apply the standard to most consumer grade relevant connectable products manufactured on or after , and a product manufactured before that date is not required to comply. The standard bans a universal default password, requiring the device's hardware and any pre-installed or required software to use a password unique to the unit or set by the user for any state other than the factory default.
It requires the manufacturer to publish a means for a security issue to be reported to the manufacturer, with status updates on the resolution of a reported issue, and to publish the period, including an end date, for which the device will receive security updates. A desktop computer, a laptop, a tablet computer, a smartphone, a therapeutic good, a road vehicle, and a road vehicle component are excluded from the standard.
The manufacturer must provide, and the supplier must supply the product with, a statement of compliance with the security standard, and each must retain a copy for five years.
The Secretary of the Department of Home Affairs enforces the regime through a compliance notice, a stop notice, and a recall notice rather than through a fine, and may publish an entity's identity, product details, and the risks posed by the product on the Department's website if the entity fails to comply with a recall notice.
When LexLint raises it
When your app profile says your app distributes a software product.
Back to the example · Lint your app
Page updated .