Cyber Security Act 2024 Statements of Compliance FAQ

For covered smart devices, the manufacturer must provide a statement of compliance for supply in Australia, and the supplier must supply the product in Australia with that statement. Both manufacturer and supplier must retain a copy for the period set by the rules.

Start by confirming scope. The current Smart Devices Rules prescribe a security standard for consumer-grade relevant connectable products intended or likely to be used for personal, domestic, or household use or consumption, where the products will be acquired in Australia by a consumer. The rules exclude desktop and laptop computers, tablet computers, smartphones, therapeutic goods, road vehicles, and road vehicle components.

The statement must be prepared by, or on behalf of, the manufacturer. The Act requires the supplier to supply the covered product in Australia with a compliant statement when the statutory conditions are met. The official Explanatory Statement says the statement is not required to be provided with the product at the point of sale. Neither the Act nor the Rules prescribes a regulator-issued certificate, third-party approval, or mandatory statement template. The required contents still need to appear in the statement.

For statements of compliance with the security standard in Part 1 of Schedule 1 to the Smart Devices Rules, the statement must be prepared by, or on behalf of, the product manufacturer. It must identify the product and responsible parties, record manufacturer declarations, name the defined support period, and include execution details.

Use the required legal contents in the issued statement rather than a generic security attestation. The declaration records the manufacturer's opinion; it does not replace the product and publication evidence supporting that opinion.

Manufacturers and suppliers must each retain a copy of the statement for the five-year period prescribed for the consumer-grade relevant connectable product security standard. The Act and Rules state the period but do not state in these provisions that every supporting engineering or supply record has the same prescribed retention period. The retention file should connect the signed statement to the product batch, the manufacturer role, the supplier handoff, and the underlying security-standard controls.

Evidence should be practical and product-specific: retain the issued statement, the product classification decision, supporting test or engineering records, the published vulnerability-reporting and support-period materials, supplier distribution proof, and any notices or regulator correspondence about examination requests.

A broad cyber compliance memo cannot replace the product-specific statutory statement tied to the smart-device security standard. Suppliers also need their own retained copy and evidence of the method used to meet the Act's statement supply duty for products supplied in Australia.