--- title: "Cyber Security Act 2024 Smart Device Compliance Checklist" canonical_url: "https://www.sorena.io/artifacts/apac/australia-cyber-security-act/smart-device-compliance-checklist" source_url: "https://www.sorena.io/artifacts/apac/australia-cyber-security-act/smart-device-compliance-checklist" author: "Sorena AI" description: "Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "Cyber Security Act 2024" - "Security Standards for Smart Devices Rules 2025" - "smart device compliance" - "statement of compliance" - "Australia cyber security" - "Smart device compliance checklist" - "Australia cyber security compliance" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # Cyber Security Act 2024 Smart Device Compliance Checklist Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence. *Checklist* *Australia* *Smart Devices* ## Cyber Security Act 2024 Smart Device Compliance Checklist This checklist helps test whether a product is a covered consumer-grade relevant connectable product, verify the three smart-device security-standard controls, prepare the statement of compliance, and retain evidence for the required record period. This is implementation support for product, security, legal, compliance, and supply-chain teams. It is supporting implementation planning and should be validated against jurisdiction-specific legal, contractual, and policy requirements before implementation. The Cyber Security (Security Standards for Smart Devices) Rules 2025 apply the Cyber Security Act 2024 smart-device regime to consumer-grade relevant connectable products acquired in Australia by a consumer, unless an exclusion applies. Part 1 of the Rules commenced on 4 March 2025, and Part 2 and Schedule 1 commence on 4 March 2026. A useful compliance checklist should therefore start with scope, then test passwords, vulnerability-reporting publication, security-update support-period publication, statement contents, retention, and enforcement evidence. ## 1. Confirm the product is in smart-device scope Start every checklist record with the product facts that decide whether the Security Standards for Smart Devices Rules 2025 apply. The Rules cover relevant connectable products that are intended by the manufacturer for personal, domestic or household use or consumption, or are of a kind likely to be used that way, when the products will be acquired in Australia by a consumer. Record any exclusion before testing controls. The Rules exclude desktop computers and laptops, tablet computers, smartphones, therapeutic goods, road vehicles, and road vehicle components from the consumer-grade relevant connectable product standard. - Record the product type, model, batch or SKU identifier, manufacturer, supplier, Australian acquisition channel, and intended personal, domestic or household use. - Confirm that the product can connect directly or indirectly to the internet and therefore may be a relevant connectable product under the Act. - Document the consumer-acquisition basis under the Rules rather than assuming that every connected business or industrial device is covered. - If relying on an exclusion, keep the exclusion category, supporting product evidence, reviewer, and approval date with the checklist record. Sources for this answer: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/asmade/text?ref=sorena.io) - Establishes the Part 2 smart-device regime for products that can connect directly or indirectly to the internet and will be acquired in Australia. - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Defines the covered class as consumer-grade relevant connectable products and lists the product exclusions for the Schedule 1 standard. ## 2. Check the three mandatory smart-device security controls For in-scope products, test the product against the three Schedule 1 control areas. The checklist should produce evidence that passwords, security-issue reporting, and security-update support-period publication have been reviewed for the product hardware and relevant software. The password check should cover passwords used with the product hardware, pre-installed software, and software that must be installed for the manufacturer's intended purposes. Passwords must be unique per product or defined by the user, and unique-per-product passwords must not be based on incremental counters, public information, serial numbers unless protected by accepted encryption or keyed hashing, or otherwise guessable in a way unacceptable as good industry practice. - Password evidence: factory-default state description, account and setup flows, password-generation method, uniqueness evidence, and reviewer confirmation that no banned derivation method is used. - Security-issue reporting evidence: public point of contact, acknowledgement timing, status-update timing, and proof the information is accessible, clear, transparent, in English, free of charge, available without prior request, and available without requesting personal information. - Security-update evidence: the defined support period expressed as a period with an end date, the affected update-capable hardware and software, and the place where the support period is published. - Website evidence: when the manufacturer offers the product on a website it controls, retain screenshots or page exports showing the support-period information with acquisition information and with equal prominence where main product characteristics appear. Sources for this answer: - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Schedule 1 sets the password, security-issue reporting, and defined-support-period requirements for covered consumer-grade relevant connectable products. ## 3. Prepare and retain the statement of compliance The statement of compliance must be prepared by, or on behalf of, the manufacturer. Suppliers should not treat it as a marketing claim; it is the statutory record that accompanies supply and may be examined for compliance. The statement should be checked against each required field before supply: product type and batch identifier, manufacturer and authorised-representative names and addresses, manufacturer declaration, compliance declaration, defined support period at issue date, signatory signature, signatory name and function, place of issue, and date of issue. - Retain the statement of compliance for five years, because the Rules set a five-year retention period for statements under the consumer-grade relevant connectable product standard. - Keep the statement with the product-scope assessment, Schedule 1 control evidence, source URLs, reviewer approval, supplier handoff record, and any exception note. - When a product or batch changes, re-check whether the existing statement still matches the product type, batch identifier, support period, software state, and manufacturer declaration. - If using a statement prepared for another comparable market, verify every field required by the Australian Rules is still present. Sources for this answer: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/asmade/text?ref=sorena.io) - Section 16 creates manufacturer and supplier statement-of-compliance obligations and allows the Rules to specify statement requirements and retention. - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Sections 9 and 10 specify statement contents and the five-year retention period for covered smart-device statements of compliance. *Recommended next step* *Placement: after the practical guidance* ## Turn the smart-device checklist into assigned evidence work This Cyber Security Act 2024 checklist helps route smart-device scope, security controls, statement-of-compliance fields, and retention evidence to accountable owners. - [Open Assessment Autopilot for smart-device compliance](/solutions/assessment.md): Convert the checklist into scoped questions, evidence fields, owner assignments, and review tasks. - [Review Cyber Security Act source evidence](/solutions/research-copilot.md): Use Research Copilot to answer follow-up questions with cited Australian source material. - [Talk through smart-device implementation](/contact.md): Review product scope, statement contents, retained evidence, and next compliance actions with Sorena. ## 4. Add enforcement and recall evidence before release A release-ready checklist should make it easy to respond if the Secretary or Minister uses the Act's compliance, stop, recall, publication, or examination powers. Keep evidence in a form that can show both product compliance and statement-of-compliance accuracy. For recall readiness, the Rules allow publication of recall-notice details and consumer actions if an entity fails to comply with a recall notice. Product, support, and communications teams should therefore keep a current consumer-action draft for each covered product family. - Assign one product owner for technical remediation, one compliance owner for statement records, one security owner for vulnerability-reporting intake, and one communications owner for consumer-facing recall language. - Keep an audit packet containing product samples or access instructions, statement copies, support-period publication evidence, vulnerability-reporting page evidence, and password-control test results. - Escalate before launch if the product scope is uncertain, the defined support period lacks an end date, security-issue reporting is not publicly accessible, or the statement does not match the current product batch. - Review the checklist after firmware changes, companion-app changes, support-period extensions, supplier changes, Australian channel changes, vulnerability-process changes, or regulator notices. Sources for this answer: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/asmade/text?ref=sorena.io) - Provides compliance notice, stop notice, recall notice, public notification, and examination powers for Part 2 smart-device obligations. - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Section 11 allows publication of recall-notice details and recommended consumer actions after failure to comply with a recall notice. ## Primary sources - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/asmade/text?ref=sorena.io) - Official Act source for Part 2 smart-device standards, manufacturer and supplier duties, statement-of-compliance obligations, enforcement notices, and examination powers. - Quote: "Security standards for smart devices" - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Official Rules source for consumer-grade product scope, exclusions, password controls, security-issue reporting, support-period publication, statement contents, and five-year retention. - Quote: "Security standards for consumer grade relevant connectable products" ## Related Topic Guides - [Australia Cyber Security Act 2024 scope and definitions](/artifacts/apac/australia-cyber-security-act/scope-and-definitions.md): Official source scope guide for Australia's Cyber Security Act 2024: relevant connectable products, consumer-grade smart devices, reporting business entities, ransomware payment reports, and SOCI overlap. - [Australia Cyber Security Act and SOCI Act overlap](/artifacts/apac/australia-cyber-security-act/security-of-critical-infrastructure-act-overlap.md): How the Australia Cyber Security Act overlaps with the Security of Critical Infrastructure Act for responsible entities, ransomware payment reporting, smart devices, and evidence records. - [Australia Cyber Security Act Applicability Test](/artifacts/apac/australia-cyber-security-act/applicability-test.md): Decide whether the Australia Cyber Security Act 2024 applies to a smart-device product, supplier, manufacturer, or ransomware payment reporting scenario. - [Australia Cyber Security Act Compliance Checklist](/artifacts/apac/australia-cyber-security-act/checklist.md): Concrete checklist items for Australian Cyber Security Act smart-device and ransomware duties, with SOCI and APRA CPS 234 evidence checks. - [Australia Cyber Security Act Compliance Guide](/artifacts/apac/australia-cyber-security-act/compliance.md): A cited compliance guide for Australia Cyber Security Act smart-device statements, ransomware payment reporting, incident coordination, and review-board readiness. - [Australia Cyber Security Act Deadlines and Compliance Calendar](/artifacts/apac/australia-cyber-security-act/deadlines-and-compliance-calendar.md): Calendar of official source Australia Cyber Security Act milestones for ransomware reporting, smart-device security standards, statements of compliance, and statutory review. - [Australia Cyber Security Act FAQ](/artifacts/apac/australia-cyber-security-act/faq.md): Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review. - [Australia Cyber Security Act penalties and fines](/artifacts/apac/australia-cyber-security-act/penalties-and-fines.md): Official source guide to Australia Cyber Security Act civil penalties, smart-device enforcement notices, ransomware reporting exposure, Board notice failures, and evidence records. - [Australia Cyber Security Act recordkeeping FAQ](/artifacts/apac/australia-cyber-security-act/faq/recordkeeping.md): What records to keep for Cyber Security Act 2024 smart-device statements, ransomware payment reports, and supported SOCI or APRA overlap checks. - [Australia Cyber Security Act Requirements](/artifacts/apac/australia-cyber-security-act/requirements.md): Australia Cyber Security Act requirements for smart-device security standards, statements of compliance, ransomware payment reports, notices, and evidence records. - [Australia Cyber Security Act Statement of Compliance Evidence](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence.md): Evidence guide for Australia Cyber Security Act smart-device statements of compliance: required fields, manufacturer and supplier records, five-year retention, and examination readiness. - [Australia Cyber Security Act templates](/artifacts/apac/australia-cyber-security-act/templates.md): Official source template fields for Australia Cyber Security Act smart-device scope, statements of compliance, ransomware reports, notices, SOCI overlap, and records. - [Australia Cyber Security Act Timeline and Commencement Guide](/artifacts/apac/australia-cyber-security-act/timeline-and-commencement.md): Australia Cyber Security Act commencement dates for ransomware reporting, CIRB reviews, smart-device duties, statement retention, and statutory review. - [Australia Cyber Security Act vs EU Cyber Resilience Act](/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-eu-cyber-resilience-act.md): Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes. - [Australia Cyber Security Act vs UK PSTI Act Guide](/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime. - [Australia ransomware payment reporting 72-hour duty](/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-72-hours.md): Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain. - [Australia Smart Device Security Standards under the Cyber Security Act](/artifacts/apac/australia-cyber-security-act/smart-device-security-standards.md): Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records. - [Australia Smart Device Statement of Compliance Evidence Workflow](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence-workflow.md): Evidence workflow for preparing, supplying, and retaining statements of compliance under Australia's Cyber Security Act 2024 and Smart Devices Rules. - [CSA 2024 Ransomware Payment Reporting Workflow](/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-workflow.md): Operational workflow for Australia Cyber Security Act 2024 ransomware payment reports: scope, 72-hour trigger, report fields, owners, evidence, and cited Act and Rules sources. - [CSA 2024 Ransomware Threshold & Report FAQ](/artifacts/apac/australia-cyber-security-act/faq/ransomware-payment-threshold-and-report-content.md): FAQ answer on Australia's Cyber Security Act ransomware payment reporting scope, $3 million turnover threshold, 72-hour trigger, report fields, and evidence. - [CSA 2024 Smart Device Applicability Test](/artifacts/apac/australia-cyber-security-act/smart-device-applicability-and-product-scope.md): Check whether a smart device is a consumer-grade relevant connectable product under Australia's Cyber Security Act and Smart Devices Rules. - [CSA 2024 Smart Device Statement of Compliance](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-and-recordkeeping.md): What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Device Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination. - [Cyber Security Act 2024 Statements of Compliance FAQ](/artifacts/apac/australia-cyber-security-act/faq/statements-of-compliance.md): FAQ answer on Australian Cyber Security Act 2024 statements of compliance for smart devices, including scope, actors, required contents, retention, evidence, and citations. - [Cyber Security Act vs EU CRA: scope and obligations comparison](/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-eu-cyber-resilience-act.md): Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes. - [Cyber Security Act vs UK PSTI Act: device security obligations compared](/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime. - [How do notices and recalls work under the Australia Cyber Security Act?](/artifacts/apac/australia-cyber-security-act/faq/notices-and-recalls.md): FAQ on Australia Cyber Security Act compliance notices, stop notices, recall notices, public notifications, owners, evidence fields, and cited timing. - [How does the Australia Cyber Security Act overlap with the SOCI Act?](/artifacts/apac/australia-cyber-security-act/faq/security-of-critical-infrastructure-act-overlap.md): FAQ on when Australia Cyber Security Act ransomware reporting overlaps with SOCI critical infrastructure assets, responsible entities, and smart-device duties. - [Manufacturer, Importer, and Supplier Duties under Australia's Cyber Security Act 2024](/artifacts/apac/australia-cyber-security-act/faq/manufacturer-and-importer-obligations.md): Direct FAQ answer on Cyber Security Act 2024 smart-device duties for manufacturers, importers, and suppliers, including scope, statement records, exceptions, and citations. - [Smart Device Applicability: CSA 2024](/artifacts/apac/australia-cyber-security-act/smart-device-applicability-workflow.md): A cited workflow for deciding whether a connected product is covered by Australia's Cyber Security Act 2024 smart-device standard and what evidence to keep. - [SOCI overlap triage workflow for Australia Cyber Security Act](/artifacts/apac/australia-cyber-security-act/soci-overlap-triage-workflow.md): Triage SOCI Act overlap with Australia Cyber Security Act ransomware reporting and smart-device standards using separate owners, evidence, and cited scope checks. - [Which smart devices are in scope under Australia's Cyber Security Act 2024?](/artifacts/apac/australia-cyber-security-act/faq/smart-device-scope.md): FAQ on Cyber Security Act 2024 smart-device scope: relevant connectable products, consumer-grade criteria, exclusions, Australian consumer acquisition, and records to keep. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/apac/australia-cyber-security-act/smart-device-compliance-checklist.md