图片名称

Australia's new cybersecurity regulations will be enforced from March 4, 2026, and how can connected device manufacturers break through the situation

Author.

LCS

Source:

Post time:

2025-11-06

In recent years, global cyber attacks have been frequent and escalating, posing a serious threat to the security of critical infrastructure such as energy, electricity, and healthcare. To effectively address the increasingly complex challenges of network security, many countries have successively introduced relevant regulations, strengthened the security standards for networked devices, and built a strong network security defense line in key areas.

New Australian Cybersecurity Regulations

In March 2025, the Australian government officially released Cyber Security (Security Standards for Smart Devices) Rules 2025 (hereinafter referred to as the "Australian Cybersecurity Act"), which will be enforced from March 4, 2026. The new law aims to enhance the network security protection capabilities of consumer connected devices, while also imposing clearer and stricter compliance requirements on relevant manufacturers.


Purpose and Core Obligations of Rules 2025 Act

The Australian Cybersecurity Act specifies the minimum cybersecurity standards that smart devices sold in Australia must meet. This bill is based on the Cyber Security Act 2024 and primarily targets manufacturers.

According to the law, manufacturers must ensure that their products comply with relevant safety standards and issue a Statement of Compliance. The statement must include multiple contents such as product model, manufacturer information, compliance statement, defined support period, etc., and must be kept for at least 5 years. If the company fails to comply with the regulations, it will face corresponding civil penalties.

Analysis of the Three Compliance Points of Rules 2025

Similar to the UK PSTI Act, the Australian Act also focuses on several core security dimensions, but differs in specific details:

1. Passwords must be unique or set by the user

The bill requires that the password for the device cannot use the universal default password.

The password must be unique to each product or defined by the user using the product.

Unique passwords must not be generated based on incremental counters, public information, or easily guessed methods.

2. Establish a transparent channel for reporting security issues

Manufacturers must publicly disclose their vulnerability disclosure policies.

At least one contact information must be provided for users to report security issues.

And promise to send confirmation of receipt and status updates on problem handling to the reporter upon receipt of the report.

3. Clearly announce the security update support cycle

Manufacturers must clearly and easily disclose to consumers the "defined support period" for product safety updates (i.e. the specific time period and deadline for providing safety updates).

Once announced, the support period shall not be shortened; If extended, information needs to be updated in a timely manner.

If selling products on a manufacturer controlled website, this information must be displayed alongside the main features of the product and have equal significance.


Rules 2025 Applicable Product Scope

Which devices require compliance?

The Act applies to "consumer related connectable products" that are acquired by consumers in Australia and can connect to the Internet directly or indirectly.

Typical products covered include:

Network camera, smart door lock, alarm system

Smart home assistant, smart home appliances

wearable devices

Intelligent lighting fixtures, intelligent controllers, IoT base stations, etc

The products explicitly excluded include:

Desktop computers, laptops

tablet

smartphone

Therapeutic Goods Act 1989 covers therapeutic products

Road vehicles and their components as defined by the Road Vehicle Standards Act 2018

Media Center

Latest News

Contact Us

图片名称
图片名称

National 24-hour service hotline

400-116-2629

Group Headquarters

Cell phone:18126505465

E-mail: webmaster@lcs-cert.com

Address: Shenzhen City, Baoan District, Shajing Street, Nga side of the school of Wei Juji Industrial Park, Building A 1 ~ 2 floor, Building C 3 floor