The Australian Government has issued the Cyber Security (Security Standards for Smart Devices) Rules 2025 under the Cyber Security Act 2024, establishing mandatory cybersecurity requirements for consumer-grade connectable products supplied in Australia. The rules were registered on March 4, 2025, with security obligations becoming enforceable from March 4, 2026, following a 12-month transition period.

The regulation applies to consumer IoT and other relevant connectable products intended for personal, domestic, or household use, excluding desktops, laptops, tablets, smartphones, therapeutic goods, and road vehicles. Manufacturers must ensure that devices comply with strict password requirements (no default or easily guessable passwords), provide clear mechanisms for reporting security vulnerabilities, and publish a defined support period for security updates. Importantly, manufacturers are prohibited from shortening the declared support period once published.

Suppliers must ensure products are accompanied by a formal statement of compliance, and manufacturers must retain compliance documentation for five years. The framework strengthens market surveillance and recall enforcement mechanisms, aiming to enhance baseline cybersecurity for connected consumer devices in Australia while aligning with global IoT security best practices.

This regulatory development represents a high-impact compliance update for manufacturers and suppliers of consumer-grade connectable products in Australia, as it introduces mandatory cybersecurity-by-design obligations directly affecting product manufacturing, documentation, labeling, and post-market responsibilities.

• Mandatory unique or user-defined passwords (prohibition of default or predictable credentials)
• Mandatory public vulnerability disclosure mechanism
• Mandatory publication of defined security support period
• Prohibition on shortening declared support periods
• Mandatory statement of compliance accompanying products
• 5-year documentation retention obligation
• Applies to manufacturers and suppliers aware products will be acquired in Australia
• Enforceable under the Cyber Security Act 2024

Who?

• IoT device manufacturers
• Smart home device producers
• Consumer electronics brands (excluding smartphones, tablets, PCs)
• Importers and Australian distributors of connectable products
• Private label/OEM manufacturers
• Compliance, regulatory, and product security teams
• Australian market surveillance authorities

Conclusion

Australia’s Security Standards for Smart Devices Rules 2025 create binding cybersecurity baseline requirements for consumer IoT products supplied in the Australian market. Unlike voluntary best practices, these rules impose enforceable manufacturing, documentation, and post-market obligations, significantly impacting product design, firmware management, vulnerability handling processes, and compliance documentation. Companies supplying connected consumer devices in Australia must review product password architecture, security update policies, vulnerability disclosure programs, and compliance statements before the March 4, 2026 enforcement date.