Australia Cyber Security Act FAQ

Part 2 of the Cyber Security Act applies to a relevant connectable product manufactured on or after 29 November 2025, or supplied in Australia on or after that date other than as second-hand goods. A relevant connectable product is an internet-connectable product or a network-connectable product unless exempted by rules.

Part 2 and Schedule 1 of the 2025 Smart Devices Rules commenced on 4 March 2026. They prescribe the security standard for consumer grade relevant connectable products: products intended by the manufacturer to be used, or likely to be used, for personal, domestic, or household use or consumption, where the product will be acquired in Australia by a consumer. The incorporated Australian Consumer Law test can cover goods priced at no more than the prescribed $100,000 amount or goods ordinarily acquired for personal, domestic or household use, including some business purchases. It excludes goods acquired for resale and specified production, manufacture, repair, or treatment uses.

Manufacturers must manufacture covered relevant connectable products in compliance with the applicable security standard when they are aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in the specified circumstances. Suppliers must not supply a non-compliant covered product in Australia on the same awareness basis.

For consumer grade relevant connectable products, the Smart Devices Rules require password controls, a published security-issue reporting route, and a published defined support period for security updates. Manufacturers must provide a statement of compliance for supply in Australia, and suppliers must supply the product with that statement.

For consumer grade relevant connectable products covered by the Smart Devices Rules, manufacturers and suppliers must retain a copy of the statement of compliance for 5 years. The Act places the retention duty on both the manufacturer that provides the statement and the supplier that supplies the product with it.

The retained record should prove the specific product and batch covered by the statement, who prepared it, who signed it, the declared compliance position, the defined support period at the issue date, and the place and date of issue.

A ransomware payment report is required when an incident has occurred, is occurring, or is imminent; it is a cyber security incident with the required direct or indirect impact on a reporting business entity; an extorting entity makes the required demand; and the reporting business entity provides, or knows another entity has provided on its behalf, a directly related payment or benefit. The report must be given within 72 hours of making the payment or becoming aware that the payment has been made, whichever applies.

An entity is a reporting business entity if it is a responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies, or if it meets the ordinary-business limb in section 26. That limb requires the entity to carry on business in Australia, have previous-financial-year turnover exceeding $3 million, and not be a Commonwealth body, State body, or responsible entity for a critical infrastructure asset. Turnover of exactly $3 million does not exceed the statutory threshold. The current cyber.gov.au form nevertheless labels its business option "equal to or exceeds $3 million," so an entity at exactly $3 million should confirm the filing position promptly. If the business operated for only part of the previous financial year, the threshold is prorated using the formula in the Rules.

For smart-device obligations under sections 15 and 16, the Secretary may issue a compliance notice when reasonably satisfied that an entity is not complying, or when aware of information suggesting possible non-compliance. Before giving a compliance notice, the Secretary must notify the entity and give a specified period of at least 10 days for representations.

If the entity has received a compliance notice and has not complied, or its rectification is inadequate, the Secretary may issue a stop notice. If the entity then has a stop notice and does not comply, or its rectification remains inadequate, the Secretary may issue a recall notice. If an entity fails to comply with a recall notice, the Minister may publish information about the failure. An entity may apply in writing for internal review within 30 days after a notice is given.

The Act allows an impacted entity to voluntarily provide information to the National Cyber Security Coordinator about a significant cyber security incident. The Coordinator's statutory role is to lead whole-of-government coordination and triage of action in response to significant cyber security incidents.

The Act also establishes the Cyber Incident Review Board. The Board causes reviews to be conducted for certain cyber security incidents and makes recommendations to government and industry about actions that could prevent, detect, respond to, or minimise the impact of similar incidents in the future. The Board Rules add procedures for review prioritisation, terms of reference, timing to avoid interfering with investigations, and notification of reviews.