--- title: "CSA 2024 Smart Device Statement of Compliance" canonical_url: "https://www.sorena.io/artifacts/apac/australia-cyber-security-act/statement-of-compliance-and-recordkeeping" source_url: "https://www.sorena.io/artifacts/apac/australia-cyber-security-act/statement-of-compliance-and-recordkeeping" author: "Sorena AI" description: "What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Device Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "Australia Cyber Security Act smart device statement of compliance" - "Security Standards for Smart Devices Rules 2025" - "statement retention" - "consumer grade relevant connectable products" - "Australia Cyber Security Act" - "Smart device statement of compliance" - "Recordkeeping" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # CSA 2024 Smart Device Statement of Compliance What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Device Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination. *Artifact Guide* *Australia* *Smart Device Statement of Compliance* ## Australia Cyber Security Act Smart Device Statement of Compliance For covered consumer-grade smart devices, the statement of compliance is the product-level record that connects the manufacturer, the product batch, the declared security-standard compliance position, and the support-period claim. This page helps prepare the statement, keep the five-year record, and make the product and statement ready if the Secretary requests them for independent examination. Australia's Cyber Security Act 2024 and the Cyber Security (Security Standards for Smart Devices) Rules 2025 require a statement of compliance for covered consumer-grade relevant connectable products. This guide focuses on the statement itself: who prepares it, who supplies it with the product, what fields it must contain, how long copies must be retained, and what records should be ready for examination. ## When a smart-device statement of compliance is needed The statement duty sits in Part 2 of the Cyber Security Act 2024. It applies when rules prescribe a security standard for a class of relevant connectable products that will be acquired in Australia in specified circumstances. The Smart Device Rules prescribe a security standard for consumer-grade relevant connectable products: products intended by the manufacturer to be used, or of a kind likely to be used, for personal, domestic, or household use or consumption, excluding listed product categories such as desktop and laptop computers, tablets, smartphones, therapeutic goods, road vehicles, and road vehicle components. For an in-scope product, the manufacturer must provide a statement of compliance for supply in Australia. A supplier that supplies the product in Australia must supply it with the statement of compliance. - Confirm that the product is a relevant connectable product and is within the consumer-grade class covered by the Smart Device Rules. - Record whether any listed exclusion applies before treating the product as covered. - Identify the manufacturer because the statement must be prepared by, or on behalf of, the manufacturer. - Identify each Australian supplier path because the Act also places a supply-with-statement duty on suppliers. Sources for this answer: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/asmade/text?ref=sorena.io) - Establishes the manufacturer and supplier duties to provide or supply relevant connectable products with a statement of compliance. - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Defines the consumer-grade product class covered by the smart-device security standard and lists excluded product categories. ## Required fields in the statement of compliance The Smart Device Rules specify the contents of the statement for consumer-grade relevant connectable products. Treat these as mandatory data fields, not as optional narrative text. The statement must identify the product and batch, name and address the manufacturer and relevant authorised representatives, declare that it was prepared by or on behalf of the manufacturer, and include the manufacturer's opinion that the product was manufactured in compliance with the security standard and that the manufacturer complied with other obligations in that standard. The statement must also include the product's defined support period at the date of issue, plus the signature, name, function, place, and date of issue for the manufacturer's signatory. - Product type and batch identifier. - Manufacturer name and address. - Authorised representative details, including each of the manufacturer's other authorised representatives in Australia, if any. - Declaration that the statement was prepared by, or on behalf of, the manufacturer. - Declaration of the manufacturer's opinion on product compliance with the security-standard requirements and other obligations. - Defined support period for the product at the date the statement is issued. - Signature, name, and function of the manufacturer's signatory. - Place and date of issue. Sources for this answer: - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Lists the required information that must appear in a statement of compliance for covered consumer-grade relevant connectable products. ## Recordkeeping and five-year retention The Act requires both the manufacturer and supplier, where the statement duty applies to them, to retain a copy of the statement for the period specified in the rules. For statements of compliance with the consumer-grade smart-device security standard, the Smart Device Rules set that period at five years. The record should be tied to the exact product type and batch identifier used in the statement. Keep it with evidence for the manufacturer's security-standard position, defined support period publication, vulnerability-reporting process, and supply-chain hand-off so a reviewer can connect the signed statement to the product actually supplied in Australia. - Keep the issued statement and any replacement or corrected statement for five years. - Store the statement against the product type, batch identifier, manufacturer, signatory, issue date, and Australian supplier path. - Retain evidence supporting the statement's declared support period and the manufacturer's compliance opinion. - Make supplier records show that the product was supplied in Australia with the statement, not merely that a statement existed internally. Sources for this answer: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/asmade/text?ref=sorena.io) - Requires manufacturers and suppliers to retain a copy of the statement of compliance for the period specified in the rules. - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Sets the retention period for consumer-grade smart-device statements of compliance at five years. *Recommended next step* *Placement: after the practical guidance* ## Build a defensible smart-device statement file This guide helps turn each covered smart-device product into a statement record with required fields, retention evidence, supplier hand-off records, and examination-ready support material. - [Open Assessment Autopilot for Australia Cyber Security Act](/solutions/assessment.md): Turn smart-device scope, statement fields, and retention duties into assigned evidence tasks. - [Review Australia Cyber Security Act source evidence](/solutions/research-copilot.md): Use Research Copilot to answer follow-up questions with cited official source material. - [Talk through implementation](/contact.md): Review product scope, statement fields, retention records, and examination readiness with Sorena. ## Examination readiness The Cyber Security Act 2024 allows the Secretary to engage an appropriately qualified and experienced expert to conduct an independent examination of a product where an entity must comply with section 15 or 16 obligations. The examination can assess whether the product complies with the security standard, whether the statement complies with section 16 requirements, or both. For examination readiness, keep the statement retrievable together with the product identifier, manufacturer details, Australian supplier details, support-period publication evidence, and the technical evidence that supports password, security-issue reporting, and security-update support-period controls. If a written request is made for examination, the Act says the notice may request the product, the statement of compliance, or both, and must specify matters such as the product, the manufacturer if known, the period for providing the item, the period of retention for testing, the security-standard requirements to be tested, the testing or analysis to be done, and what may happen if the entity does not comply. - Maintain a retrieval path from the Australian-supplied product to the exact statement version that accompanied it. - Keep product samples, packaging references, firmware and software evidence, and support-period publication screenshots linked to the statement record. - Prepare a response owner for Secretary notices so product, legal, security, and supply-chain teams can provide the product or statement within the specified period. - Do not treat the statement as a marketing asset only; it is also evidence that may be tested against statutory statement requirements. Sources for this answer: - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/asmade/text?ref=sorena.io) - Provides the examination power for products and statements of compliance, including written requests for the product, statement, or both. - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Provides the security-standard controls that statement records should be able to support: passwords, security-issue reporting, and defined support periods for security updates. ## Primary sources - [Cyber Security Act 2024](https://www.legislation.gov.au/C2024A00098/asmade/text?ref=sorena.io) - Official Act source for the smart-device statement duties, manufacturer and supplier retention duties, and examination powers. - Quote: "Obligation to provide and supply products with a statement of compliance" - [Cyber Security (Security Standards for Smart Devices) Rules 2025](https://www.legislation.gov.au/F2025L00276/asmade/text?ref=sorena.io) - Official rules source for covered consumer-grade relevant connectable products, required statement fields, the five-year retention period, and the smart-device security standard. - Quote: "Requirements for statement of compliance" ## Related Topic Guides - [Australia Cyber Security Act 2024 scope and definitions](/artifacts/apac/australia-cyber-security-act/scope-and-definitions.md): Official source scope guide for Australia's Cyber Security Act 2024: relevant connectable products, consumer-grade smart devices, reporting business entities, ransomware payment reports, and SOCI overlap. - [Australia Cyber Security Act and SOCI Act overlap](/artifacts/apac/australia-cyber-security-act/security-of-critical-infrastructure-act-overlap.md): How the Australia Cyber Security Act overlaps with the Security of Critical Infrastructure Act for responsible entities, ransomware payment reporting, smart devices, and evidence records. - [Australia Cyber Security Act Applicability Test](/artifacts/apac/australia-cyber-security-act/applicability-test.md): Decide whether the Australia Cyber Security Act 2024 applies to a smart-device product, supplier, manufacturer, or ransomware payment reporting scenario. - [Australia Cyber Security Act Compliance Checklist](/artifacts/apac/australia-cyber-security-act/checklist.md): Concrete checklist items for Australian Cyber Security Act smart-device and ransomware duties, with SOCI and APRA CPS 234 evidence checks. - [Australia Cyber Security Act Compliance Guide](/artifacts/apac/australia-cyber-security-act/compliance.md): A cited compliance guide for Australia Cyber Security Act smart-device statements, ransomware payment reporting, incident coordination, and review-board readiness. - [Australia Cyber Security Act Deadlines and Compliance Calendar](/artifacts/apac/australia-cyber-security-act/deadlines-and-compliance-calendar.md): Calendar of official source Australia Cyber Security Act milestones for ransomware reporting, smart-device security standards, statements of compliance, and statutory review. - [Australia Cyber Security Act FAQ](/artifacts/apac/australia-cyber-security-act/faq.md): Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review. - [Australia Cyber Security Act penalties and fines](/artifacts/apac/australia-cyber-security-act/penalties-and-fines.md): Official source guide to Australia Cyber Security Act civil penalties, smart-device enforcement notices, ransomware reporting exposure, Board notice failures, and evidence records. - [Australia Cyber Security Act recordkeeping FAQ](/artifacts/apac/australia-cyber-security-act/faq/recordkeeping.md): What records to keep for Cyber Security Act 2024 smart-device statements, ransomware payment reports, and supported SOCI or APRA overlap checks. - [Australia Cyber Security Act Requirements](/artifacts/apac/australia-cyber-security-act/requirements.md): Australia Cyber Security Act requirements for smart-device security standards, statements of compliance, ransomware payment reports, notices, and evidence records. - [Australia Cyber Security Act Statement of Compliance Evidence](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence.md): Evidence guide for Australia Cyber Security Act smart-device statements of compliance: required fields, manufacturer and supplier records, five-year retention, and examination readiness. - [Australia Cyber Security Act templates](/artifacts/apac/australia-cyber-security-act/templates.md): Official source template fields for Australia Cyber Security Act smart-device scope, statements of compliance, ransomware reports, notices, SOCI overlap, and records. - [Australia Cyber Security Act Timeline and Commencement Guide](/artifacts/apac/australia-cyber-security-act/timeline-and-commencement.md): Australia Cyber Security Act guidance for Timeline and Commencement, with practical decisions, evidence, edge cases, and external source citations. - [Australia Cyber Security Act vs EU Cyber Resilience Act](/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-eu-cyber-resilience-act.md): Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes. - [Australia Cyber Security Act vs UK PSTI Act Guide](/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime. - [Australia ransomware payment reporting 72-hour duty](/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-72-hours.md): Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain. - [Australia Smart Device Security Standards under the Cyber Security Act](/artifacts/apac/australia-cyber-security-act/smart-device-security-standards.md): Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records. - [Australia Smart Device Statement of Compliance Evidence Workflow](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence-workflow.md): Evidence workflow for preparing, supplying, and retaining statements of compliance under Australia's Cyber Security Act 2024 and Smart Devices Rules. - [CSA 2024 Ransomware Payment Reporting Workflow](/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-workflow.md): Operational workflow for Australia Cyber Security Act 2024 ransomware payment reports: scope, 72-hour trigger, report fields, owners, evidence, and cited Act and Rules sources. - [CSA 2024 Ransomware Threshold & Report FAQ](/artifacts/apac/australia-cyber-security-act/faq/ransomware-payment-threshold-and-report-content.md): FAQ answer on Australia's Cyber Security Act ransomware payment reporting scope, $3 million turnover threshold, 72-hour trigger, report fields, and evidence. - [CSA 2024 Smart Device Applicability Test](/artifacts/apac/australia-cyber-security-act/smart-device-applicability-and-product-scope.md): Check whether a smart device is a consumer-grade relevant connectable product under Australia's Cyber Security Act and Smart Devices Rules. - [Cyber Security Act 2024 Smart Device Compliance Checklist](/artifacts/apac/australia-cyber-security-act/smart-device-compliance-checklist.md): Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence. - [Cyber Security Act 2024 Statements of Compliance FAQ](/artifacts/apac/australia-cyber-security-act/faq/statements-of-compliance.md): FAQ answer on Australian Cyber Security Act 2024 statements of compliance for smart devices, including scope, actors, required contents, retention, evidence, and citations. - [Cyber Security Act vs EU CRA: scope and obligations comparison](/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-eu-cyber-resilience-act.md): Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes. - [Cyber Security Act vs UK PSTI Act: device security obligations compared](/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime. - [How do notices and recalls work under the Australia Cyber Security Act?](/artifacts/apac/australia-cyber-security-act/faq/notices-and-recalls.md): FAQ on Australia Cyber Security Act compliance notices, stop notices, recall notices, public notifications, owners, evidence fields, and cited timing. - [How does the Australia Cyber Security Act overlap with the SOCI Act?](/artifacts/apac/australia-cyber-security-act/faq/security-of-critical-infrastructure-act-overlap.md): FAQ on when Australia Cyber Security Act ransomware reporting overlaps with SOCI critical infrastructure assets, responsible entities, and smart-device duties. - [Manufacturer, Importer, and Supplier Duties under Australia's Cyber Security Act 2024](/artifacts/apac/australia-cyber-security-act/faq/manufacturer-and-importer-obligations.md): Direct FAQ answer on Cyber Security Act 2024 smart-device duties for manufacturers, importers, and suppliers, including scope, statement records, exceptions, and citations. - [Smart Device Applicability: CSA 2024](/artifacts/apac/australia-cyber-security-act/smart-device-applicability-workflow.md): A cited workflow for deciding whether a connected product is covered by Australia's Cyber Security Act 2024 smart-device standard and what evidence to keep. - [SOCI overlap triage workflow for Australia Cyber Security Act](/artifacts/apac/australia-cyber-security-act/soci-overlap-triage-workflow.md): Triage SOCI Act overlap with Australia Cyber Security Act ransomware reporting and smart-device standards using separate owners, evidence, and cited scope checks. - [Which smart devices are in scope under Australia's Cyber Security Act 2024?](/artifacts/apac/australia-cyber-security-act/faq/smart-device-scope.md): FAQ on Cyber Security Act 2024 smart-device scope: relevant connectable products, consumer-grade criteria, exclusions, Australian consumer acquisition, and records to keep. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/apac/australia-cyber-security-act/statement-of-compliance-and-recordkeeping