Australia Cyber Security Act Statement of Compliance Evidence

Keep this evidence file focused on Part 2 smart-device duties, not ransomware reporting, critical-infrastructure obligations, privacy breach records, or general cyber controls. Part 2 applies to a relevant connectable product manufactured on or after 29 November 2025 or supplied other than as second-hand goods on or after that date. The statement trigger also requires the consumer-grade class, Australian acquisition by a consumer, and the Act's awareness condition. The official explanatory statement gives smart TVs, smart watches, home assistants, baby monitors, and consumer energy resources as examples, but the binding Act and Rules still require a product-specific connectivity, intended-use, acquisition, awareness, date, and exclusion analysis.

For this purpose, the Rules use the Australian Consumer Law acquisition test. A consumer can be an individual or business where the goods cost no more than the current $100,000 threshold or are ordinarily acquired for personal, domestic, or household use, subject to the separate vehicle-or-trailer limb and exclusions for acquisitions such as resupply or use up or transformation in production, manufacture, repair, or treatment.

The minimum evidence set should connect one product type and batch identifier to the manufacturer, the authorised representative named in the statement, any other authorised representatives in Australia, the applicable security standard, the manufacturer's compliance opinion, the defined support period at issue, and the signed place and date of issue. Section 9 requires one authorised representative and separately asks for each other Australian representative, if any; it does not state an exception for a manufacturer with none.

Build the evidence pack around each statement field specified by the Smart Devices Rules.

For each statement, capture the source record that proves the field value, the person who approved it, and the version of product or support-period information used when the statement was issued.

The statement says whether, in the manufacturer's opinion, the product was manufactured in compliance with the security standard and whether the manufacturer met the other obligations in that standard. That opinion should be backed by technical records for the three security-standard areas in Schedule 1.

The Rules require publication of the security-issue reporting information and defined support period, but they do not require the supporting technical file itself to be public. Product security, legal, compliance, and supplier-management reviewers should be able to use that file to explain why the statement was accepted.

For consumer-grade relevant connectable products covered by the Smart Devices Rules, the statement-of-compliance retention period is five years. The Act applies retention duties to both the manufacturer that provides the statement and the supplier that supplies the product with it. Section 10 does not specify the event from which the five years is calculated, so the record should document its retention calculation.

The Secretary may arrange an independent examination of the product, the statement, or both. Keep evidence retrievable by product and batch so the business does not have to rebuild the file after a request arrives.