---
title: "Australia Smart Device Security Standards under the Cyber Security Act"
canonical_url: "https://www.sorena.io/artifacts/apac/australia-cyber-security-act/smart-device-security-standards"
source_url: "https://www.sorena.io/artifacts/apac/australia-cyber-security-act/smart-device-security-standards"
author: "Sorena AI"
description: "Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records."
published_at: "2026-05-09"
updated_at: "2026-05-09"
keywords:
  - "Australia Cyber Security Act smart device security standards"
  - "Cyber Security (Security Standards for Smart Devices) Rules 2025"
  - "relevant connectable products"
  - "statement of compliance"
  - "Australia Cyber Security Act"
  - "Smart device security standards"
---
**[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform

[Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io)

---

# Australia Smart Device Security Standards under the Cyber Security Act

Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records.

*Artifact Guide* *Australia* *Smart Device Security Standards*

## Australia smart device security standards

Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025 set mandatory baseline requirements for covered consumer-grade relevant connectable products.

This guide helps scope covered products and document password design, vulnerability-reporting contact points, support-period publication, statements of compliance, and supporting evidence. This guidance is practical, cited, and should be validated against current legal and policy requirements before implementation.

The Cyber Security Act 2024 allows rules to set mandatory standards for relevant connectable products. The 2025 Smart Devices Rules apply the standard to consumer-grade relevant connectable products that will be acquired in Australia by a consumer, unless an exclusion applies, and require manufacturers and suppliers to handle compliance, publication, and statement-of-compliance duties.

## What products are covered by Australia's smart-device security standard?

Start with product scope. The Rules cover relevant connectable products that are intended by the manufacturer for personal, domestic or household use or consumption, or are of a kind likely to be used that way, where the product will be acquired in Australia by a consumer.

Do not treat every connected product as covered. The Rules exclude desktop computers and laptops, tablet computers, smartphones, therapeutic goods, road vehicles, and road vehicle components.

- Record the product type, intended purpose, Australian supply path, and why the buyer is treated as a consumer for the Rules.
- Check whether an exclusion applies before assigning password, vulnerability-reporting, support-period, and statement-of-compliance work.
- Keep product-family and batch decisions separate when different versions ship with different software, security updates, or default credential behavior.
- For websites controlled by the manufacturer, plan where support-period information will appear alongside product information that informs consumer purchase decisions.

Sources for this answer:

- [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Source for the covered class of consumer-grade relevant connectable products, the Australian consumer acquisition circumstance, and the listed product exclusions.

## What does the password requirement require?

For covered products with password functionality, passwords used with covered hardware and software must either be unique per product or defined by the user. The rule applies to product hardware when not in the factory default state, pre-installed software when not in the factory default state, and software that must be installed for the manufacturer's intended purposes.

A unique-per-product password cannot be a simple sequence, public-information derivative, or plain serial-number derivative. If it is based on a unique product identifier such as a serial number, the Rules require an encryption method or keyed hashing algorithm accepted as good industry practice.

- Evidence the credential model for each covered hardware, firmware, app, cloud-linked, or required software surface.
- Show whether each password is user-defined or unique per product, and remove shared factory default passwords from covered flows.
- If serial numbers or other identifiers influence credential generation, retain the design evidence for encryption or keyed hashing and the good-industry-practice review.
- Include factory-reset behavior and post-sale required software updates in the password review, not only the first boot experience.

Sources for this answer:

- [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Schedule 1 clause 2 sets the password rule and the limits on guessable unique-per-product passwords.

## What vulnerability-reporting information must manufacturers publish?

Manufacturers of covered products must publish information on how a person can report security issues for the product's hardware, pre-installed software, required software for intended purposes, and software used for or in connection with the manufacturer's intended purposes.

The publication must include at least one point of contact, plus when the reporter will receive acknowledgement of receipt and status updates until the reported security issues are resolved. The information must be accessible, clear, transparent, in English, free of charge, available without a prior request, and available without requesting personal information just to access the reporting information.

- Publish a security-issue reporting contact that works for researchers, customers, and other reporters.
- State the acknowledgement and status-update process in the published reporting information.
- Make the reporting instructions available without an account gate, form gate, paywall, prior request, or collection of personal information merely to see the instructions.
- Keep evidence of the published page, contact routing, acknowledgement template, status-update workflow, and closure record for reported issues.

Sources for this answer:

- [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Schedule 1 clause 3 specifies the reporting contact, acknowledgement, status-update, accessibility, language, cost, and no-prior-request requirements.

## How should support periods and security updates be published?

Manufacturers must publish the defined support period for security updates for covered product hardware and software that can receive security updates. The defined support period is the period, expressed as a period of time with an end date, during which security updates will be provided by or on behalf of the manufacturer.

Once published, the defined support period must not be shortened. If it is extended, the new support period must be published as soon as practicable. For manufacturer-controlled websites that offer the product, the support-period information must be prominently published with consumer purchase information and given equal prominence where the product's main characteristics are published.

- Use a fixed end date for the support period, and align it with product pages, comparison pages, packaging copy, support pages, and statements of compliance.
- Track which hardware, pre-installed software, required software, and manufacturer-developed supporting software can receive security updates.
- Do not bury the defined support period only in a regulatory document if product characteristics or acquisition information appears elsewhere on a controlled website.
- Keep change control for support-period extensions and evidence that the updated period was published promptly.

Sources for this answer:

- [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Schedule 1 clause 4 defines security updates, defined support periods, publication requirements, website prominence, and the ban on shortening a published support period.

## What must the statement of compliance and evidence file contain?

For covered products, the statement of compliance must be prepared by or on behalf of the manufacturer. It must identify the product type and batch identifier, manufacturer and authorised representative details, the compliance declarations, the defined support period at issue date, signatory details, and the place and date of issue.

The Rules set a five-year retention period for statements of compliance made for the consumer-grade relevant connectable product standard. Pair that retained statement with the technical and publication evidence that supports the manufacturer's declarations.

- Keep the statement of compliance with the product type, batch identifier, manufacturer details, authorised representative details, compliance declarations, support period, signatory, place, and date of issue.
- Pair the statement with engineering evidence for password generation, vulnerability-reporting publication, support-period publication, and security-update handling.
- For suppliers, confirm the product is accompanied by a compliant statement and retain the statement for the required period.
- Maintain batch-level traceability where similar products have different manufacturing dates, default software, or security-update status.

Sources for this answer:

- [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/asmade/text?ref=sorena.io) - Part 2 establishes the manufacturer and supplier obligations to comply with security standards and provide or supply products with statements of compliance.
- [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Sections 9 and 10 list statement-of-compliance contents and set the five-year retention period for statements of compliance.

*Recommended next step*

*Placement: after the smart-device standards guide*

## Turn Australia's smart-device security standards into product evidence

This guide helps turn the Smart Devices Rules into product-scope records, credential reviews, vulnerability-reporting publication evidence, support-period records, and statement-of-compliance files in Sorena.

- [Open Assessment Autopilot for Australia Cyber Security Act](/solutions/assessment.md): Convert smart-device standards into scoped questions, evidence fields, owners, and review tasks.
- [Review smart-device source evidence](/solutions/research-copilot.md): Use Research Copilot to answer follow-up questions from the Cyber Security Act 2024 and the Smart Devices Rules.
- [Talk through smart-device standards implementation](/contact.md): Review product scope, password controls, vulnerability-reporting pages, support-period publication, and statements of compliance with Sorena.

## Primary sources

- [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/asmade/text?ref=sorena.io) - Primary Act establishing mandatory security standards for relevant connectable products and statement-of-compliance obligations for manufacturers and suppliers.
  - Quote: "mandatory security standards for certain products"
- [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Binding Rules setting the covered product class, exclusions, commencement for Part 2 and Schedule 1, password requirements, security-issue reporting, support-period publication, statement contents, and five-year statement retention period.
  - Quote: "Part 1 of Schedule 1 provides a security standard for consumer grade relevant connectable products"

## Related Topic Guides

- [Australia Cyber Security Act 2024 scope and definitions](/artifacts/apac/australia-cyber-security-act/scope-and-definitions.md): Official source scope guide for Australia's Cyber Security Act 2024: relevant connectable products, consumer-grade smart devices, reporting business entities, ransomware payment reports, and SOCI overlap.
- [Australia Cyber Security Act and SOCI Act overlap](/artifacts/apac/australia-cyber-security-act/security-of-critical-infrastructure-act-overlap.md): How the Australia Cyber Security Act overlaps with the Security of Critical Infrastructure Act for responsible entities, ransomware payment reporting, smart devices, and evidence records.
- [Australia Cyber Security Act Applicability Test](/artifacts/apac/australia-cyber-security-act/applicability-test.md): Decide whether the Australia Cyber Security Act 2024 applies to a smart-device product, supplier, manufacturer, or ransomware payment reporting scenario.
- [Australia Cyber Security Act Compliance Checklist](/artifacts/apac/australia-cyber-security-act/checklist.md): Concrete checklist items for Australian Cyber Security Act smart-device and ransomware duties, with SOCI and APRA CPS 234 evidence checks.
- [Australia Cyber Security Act Compliance Guide](/artifacts/apac/australia-cyber-security-act/compliance.md): A cited compliance guide for Australia Cyber Security Act smart-device statements, ransomware payment reporting, incident coordination, and review-board readiness.
- [Australia Cyber Security Act Deadlines and Compliance Calendar](/artifacts/apac/australia-cyber-security-act/deadlines-and-compliance-calendar.md): Calendar of official source Australia Cyber Security Act milestones for ransomware reporting, smart-device security standards, statements of compliance, and statutory review.
- [Australia Cyber Security Act FAQ](/artifacts/apac/australia-cyber-security-act/faq.md): Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review.
- [Australia Cyber Security Act penalties and fines](/artifacts/apac/australia-cyber-security-act/penalties-and-fines.md): Official source guide to Australia Cyber Security Act civil penalties, smart-device enforcement notices, ransomware reporting exposure, Board notice failures, and evidence records.
- [Australia Cyber Security Act recordkeeping FAQ](/artifacts/apac/australia-cyber-security-act/faq/recordkeeping.md): What records to keep for Cyber Security Act 2024 smart-device statements, ransomware payment reports, and supported SOCI or APRA overlap checks.
- [Australia Cyber Security Act Requirements](/artifacts/apac/australia-cyber-security-act/requirements.md): Australia Cyber Security Act requirements for smart-device security standards, statements of compliance, ransomware payment reports, notices, and evidence records.
- [Australia Cyber Security Act Statement of Compliance Evidence](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence.md): Evidence guide for Australia Cyber Security Act smart-device statements of compliance: required fields, manufacturer and supplier records, five-year retention, and examination readiness.
- [Australia Cyber Security Act templates](/artifacts/apac/australia-cyber-security-act/templates.md): Official source template fields for Australia Cyber Security Act smart-device scope, statements of compliance, ransomware reports, notices, SOCI overlap, and records.
- [Australia Cyber Security Act Timeline and Commencement Guide](/artifacts/apac/australia-cyber-security-act/timeline-and-commencement.md): Australia Cyber Security Act guidance for Timeline and Commencement, with practical decisions, evidence, edge cases, and external source citations.
- [Australia Cyber Security Act vs EU Cyber Resilience Act](/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-eu-cyber-resilience-act.md): Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes.
- [Australia Cyber Security Act vs UK PSTI Act Guide](/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime.
- [Australia ransomware payment reporting 72-hour duty](/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-72-hours.md): Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain.
- [Australia Smart Device Statement of Compliance Evidence Workflow](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence-workflow.md): Evidence workflow for preparing, supplying, and retaining statements of compliance under Australia's Cyber Security Act 2024 and Smart Devices Rules.
- [CSA 2024 Ransomware Payment Reporting Workflow](/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-workflow.md): Operational workflow for Australia Cyber Security Act 2024 ransomware payment reports: scope, 72-hour trigger, report fields, owners, evidence, and cited Act and Rules sources.
- [CSA 2024 Ransomware Threshold & Report FAQ](/artifacts/apac/australia-cyber-security-act/faq/ransomware-payment-threshold-and-report-content.md): FAQ answer on Australia's Cyber Security Act ransomware payment reporting scope, $3 million turnover threshold, 72-hour trigger, report fields, and evidence.
- [CSA 2024 Smart Device Applicability Test](/artifacts/apac/australia-cyber-security-act/smart-device-applicability-and-product-scope.md): Check whether a smart device is a consumer-grade relevant connectable product under Australia's Cyber Security Act and Smart Devices Rules.
- [CSA 2024 Smart Device Statement of Compliance](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-and-recordkeeping.md): What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Device Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination.
- [Cyber Security Act 2024 Smart Device Compliance Checklist](/artifacts/apac/australia-cyber-security-act/smart-device-compliance-checklist.md): Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence.
- [Cyber Security Act 2024 Statements of Compliance FAQ](/artifacts/apac/australia-cyber-security-act/faq/statements-of-compliance.md): FAQ answer on Australian Cyber Security Act 2024 statements of compliance for smart devices, including scope, actors, required contents, retention, evidence, and citations.
- [Cyber Security Act vs EU CRA: scope and obligations comparison](/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-eu-cyber-resilience-act.md): Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes.
- [Cyber Security Act vs UK PSTI Act: device security obligations compared](/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime.
- [How do notices and recalls work under the Australia Cyber Security Act?](/artifacts/apac/australia-cyber-security-act/faq/notices-and-recalls.md): FAQ on Australia Cyber Security Act compliance notices, stop notices, recall notices, public notifications, owners, evidence fields, and cited timing.
- [How does the Australia Cyber Security Act overlap with the SOCI Act?](/artifacts/apac/australia-cyber-security-act/faq/security-of-critical-infrastructure-act-overlap.md): FAQ on when Australia Cyber Security Act ransomware reporting overlaps with SOCI critical infrastructure assets, responsible entities, and smart-device duties.
- [Manufacturer, Importer, and Supplier Duties under Australia's Cyber Security Act 2024](/artifacts/apac/australia-cyber-security-act/faq/manufacturer-and-importer-obligations.md): Direct FAQ answer on Cyber Security Act 2024 smart-device duties for manufacturers, importers, and suppliers, including scope, statement records, exceptions, and citations.
- [Smart Device Applicability: CSA 2024](/artifacts/apac/australia-cyber-security-act/smart-device-applicability-workflow.md): A cited workflow for deciding whether a connected product is covered by Australia's Cyber Security Act 2024 smart-device standard and what evidence to keep.
- [SOCI overlap triage workflow for Australia Cyber Security Act](/artifacts/apac/australia-cyber-security-act/soci-overlap-triage-workflow.md): Triage SOCI Act overlap with Australia Cyber Security Act ransomware reporting and smart-device standards using separate owners, evidence, and cited scope checks.
- [Which smart devices are in scope under Australia's Cyber Security Act 2024?](/artifacts/apac/australia-cyber-security-act/faq/smart-device-scope.md): FAQ on Cyber Security Act 2024 smart-device scope: relevant connectable products, consumer-grade criteria, exclusions, Australian consumer acquisition, and records to keep.


---

[Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us)

(c) 2026 Sorena AB (559573-7338). All rights reserved.

Source: https://www.sorena.io/artifacts/apac/australia-cyber-security-act/smart-device-security-standards