What triggers Australia Cyber Security Act compliance, stop, and recall notices?
A compliance notice can be issued by the Secretary when an entity that must comply with section 15 or 16 is not complying, or when information suggests possible non-compliance. A response record should start with the product, the relevant connectable product class, the security-standard requirement, the manufacturer or supplier role, and the specific section 15 or 16 obligation at issue.
A stop notice is the next escalation. It depends on a prior compliance notice and the Secretary being reasonably satisfied that the compliance notice was not met or that attempted remediation was inadequate.
A recall notice is a further escalation after a stop notice. It can be issued where the stop notice was not met or remediation remains inadequate for the same section 15 or 16 non-compliance.
- Responsible actor: the entity that must comply with the section 15 or 16 obligation, usually the manufacturer or supplier for the affected smart device.
- Trigger evidence: the non-compliance or possible non-compliance, the applicable security-standard requirement, and any compliance-notice or stop-notice history.
- Grounded timing: before giving a compliance, stop, or recall notice, the Secretary must give the entity a representation period that is not shorter than 10 days.
Sections 17, 18, and 19 establish the compliance-notice, stop-notice, and recall-notice escalation path for section 15 or 16 smart-device obligations.
Section 8 and the simplified outline identify the consumer-grade relevant connectable products covered by the security standard and the manufacturer and supplier obligations that enforcement notices can attach to.