图片名称

Australia issues the strictest IoT security regulations in the world! Intelligent hardware going global adds another hard threshold for compliance

Author.

LCS

Source:

Post time:

2026-01-23

On March 4, 2026, the Australian Cybersecurity (Smart Device Security Standards) Rules 2025 will officially come into effect. This IoT security regulation, known as the "strictest in the world," not only covers mainstream consumer electronics products such as smart homes and wearable devices, but also sets "hard bars" on key aspects such as password management, vulnerability disclosure, and security update cycles with technical requirements far exceeding the EU EN 303 645 standard.   

1. Core regulations:

⚠️  First lock: Mandatory password personalization setting

⊙ Completely disable universal default passwords such as "123456" and "admin", and require that the device factory password must meet the following requirements:

Uniqueness generation: Based on random algorithms, predictable patterns such as serial numbers and increasing digits must not be used

User autonomy: Allow consumers to customize high-strength passwords upon first use

📢  Second lock: Fully transparent vulnerability response mechanism

Manufacturers are required to prominently display their vulnerability disclosure policy on their official website and commit to:

Provide at least one security incident feedback channel (such as dedicated email, online form)

Send a confirmation receipt to the reporter within 48 hours and regularly update the progress of the repair

 

⏳  Third Lock: Security Update Cycle "Lifetime Responsibility System"

The product packaging, instructions, and sales page must clearly indicate the "minimum safety support period" (such as "guaranteed until December 31, 2030")

After the deadline is set, it can only be extended and cannot be shortened. If adjustments are made midway, a notification will be sent to the user

Devices sold on e-commerce platforms must have this information displayed synchronously at the top of the product details page

2 Scope of coverage:

✅  Key regulatory targets:

Intelligent security category: network cameras, electronic door locks, networked alarms

Home control category: smart speakers, IoT gateways, Wi Fi sockets

Wearable devices: smartwatches, health monitoring wristbands

Home appliances: Internet connected refrigerators, air conditioners, lighting systems

🚫  Exemption List:

Mobile phones, tablets, laptops (already subject to other regulatory constraints)

Vehicle mounted equipment (governed by the Road Vehicle Standards Law)

Medical equipment (applicable to the Therapeutic Goods Law)

3 Breaking Guide:

Technical self inspection: Compliance gap analysis of password policy, vulnerability management process, and OTA upgrade function immediately activated

Certification slot: Priority should be given to selecting laboratories with corresponding qualifications to ensure that the test report meets the Australian review requirements

Supply chain linkage: Negotiate with chip suppliers to integrate security modules and reduce transformation costs from the hardware bottom layer

LCS Action Support - As one of the few laboratories in the Asia Pacific region with both EU EN 18031 CNAS certification and IEC 62443 industrial safety certification capabilities, we offer:

 

Australian New Regulation Pre Inspection Service (Simulation Review+Vulnerability Stress Testing)

Customized password system renovation plan (compliant with uniqueness algorithm requirements)

Template for Security Update Cycle Declaration and Compliance Document Package

Smart device manufacturers immediately launch compliance engines to avoid the 2026 Australian market access crisis.

Media Center

Latest News

Contact Us

图片名称
图片名称

National 24-hour service hotline

400-116-2629

Group Headquarters

Cell phone:18126505465

E-mail: webmaster@lcs-cert.com

Address: Shenzhen City, Baoan District, Shajing Street, Nga side of the school of Wei Juji Industrial Park, Building A 1 ~ 2 floor, Building C 3 floor