On 4 March 2026 Australia brought the Cyber Security (Security Standards for Smart Devices) Rules 2025 into force. This means all smart devices entering the Australian market must meet mandatory cybersecurity requirements. These are no longer recommendations but a legal obligation.

Why does this regulation matter so much?

In the past, IoT security relied largely on voluntary effort.

In practice, however:

· Default passwords such as admin/1234 are still widespread;

· Many devices have no security update mechanism;

· Nobody responds to vulnerabilities.

These problems have become attack entry points worldwide.

Australia has therefore established mandatory baseline cybersecurity requirements to raise the overall security level. It is also one of the core measures of the country's 2023-2030 national cybersecurity strategy.

Core requirements

The regulation essentially focuses on three core security capabilities, plus a compliance statement.

1. No universal default passwords

· Universal default passwords such as admin/admin are not permitted;

· Either every device must have a unique password, or the user must be required to set one at first use.

This is the most basic, and most frequently overlooked, vulnerability entry point.

2. Vulnerability disclosure mechanism (PSIRT)

· A channel for reporting vulnerabilities must be provided;

· Feedback on the status of vulnerability handling must be given.

In effect, companies are required to establish a security response system.

3. Security updates and support period

· The security update period must be stated;

· Users must be told how long the product will be supported.

This fundamentally changes the sell-and-forget model.

4. Statement of compliance

· Products must be accompanied by a statement of compliance;

· It may be requested in random regulatory checks.

Non-compliant products may be prohibited from sale, withdrawn or recalled.

Which products are affected?

Almost all IoT and connected products:

· Smart home devices (cameras, door locks, lighting);

· Routers and network equipment;

· Smart televisions and speakers;

· Wearable devices.

Excluded are mobile phones, computers, tablets and vehicles.

The core challenge for companies

Many companies will find that this is not simply a matter of changing passwords. It involves:

· Secure by design;

· Firmware security;

· Encrypted communication;

· Vulnerability management mechanisms;

· Lifecycle management.

It is not only a testing issue but an integrated issue of system, engineering and testing.

Nor is it only an Australian issue. The regulation closely mirrors:

· ETSI EN 303 645;

· The UK PSTI;

· The EU CRA.

It reflects a global trend.

How an information security laboratory can help

We provide a one-stop compliance solution:

1. Gap analysis: a rapid determination of whether your product meets the regulatory requirements.

2. Security system development: PSIRT process design, secure SDLC, and vulnerability management mechanisms.

3. Security testing: firmware analysis, penetration testing, communication security and cryptographic verification.

4. Compliance support: test reports, assistance with the statement of compliance, and benchmarking against EN 303 645.

Why act now?

The timeline is clear:

· The regulation is formally in force (4 March 2026);

· New products must comply;

· The regulator already has enforcement powers.

Market impact:

· Non-compliance means no access to the Australian market;

· Products already on the market may be recalled;

· Distributors will prioritise compliant products.

In one sentence

Australia is turning cybersecurity into a product market access threshold.

Whoever completes compliance first gains the market.

Contact us

If you are working on IoT devices for export to Australia, smart home or consumer electronics, or network equipment, we recommend an assessment as early as possible.