Resources

Ever heard of the Smart Device Security Standards?

A lot of Australian businesses have no idea what this law is, which is a problem because it’s
been in place since March 2026.
The rules cover security for smart devices and the IoT, which means it applies to your office’s IP
cameras, smart TVs in meeting rooms, routers, and connected printers.
In this post, we’ll give you a quick breakdown of what the law covers, the standards your
devices need to comply with, and how to prepare so you avoid any penalties.

What’s actually covered

The law came into full effect in March after a 12-month transition period, and it applies to
“relevant connectable products”, which basically means any devices that connect directly or
indirectly to the internet or a network and are intended for personal, domestic, or household use.
There are, however, a few notable exclusions here. Laptops, tablets, smartphones, and desktop
computers are not covered by the law. This is because the legislation specifically focuses on
smaller, easy-to-overlook devices that aren’t already loaded with security features.

The three minimum standards

Here’s what your devices will have to comply with:
● No universal default passwords; these must instead be unique per device or set by the
user on first use
● A free, accessible vulnerability-reporting channel (in English, with no personal info
required)
● A disclosed, fixed security-update support period that can’t be shortened after the fact

Who’s actually on the hook?

One of the most important things to note about this law is that the direct legal obligation sits
with manufacturers, importers, and suppliers rather than the businesses actually buying and
operating the devices.
They have to prepare a statement of compliance for each product and comply with other
requirements.
This is good news if you fall into the second category, because it means there’s less to worry
about. But it’s still a good reminder to make sure your IoT devices are secured.

What to do now

The most important thing to do here is to ask suppliers for the statement of compliance when
you procure new connected devices. Also:
● Add “still on default password?” to your device audit for existing office equipment like
cameras, smart TVs, routers, and printers
● Make a note of the declared support periods when planning refresh and replacement
cycles
● Treat every connected device as part of the attack surface

How Aryon can help

IoT devices are too often overlooked by businesses. But the days when the only things you had
to worry about were your employees’ devices and smartphones are now far behind us.
At Aryon, we can help you secure your entire network so that all devices are protected and your
entire attack surface is safe. Contact us to learn more.