Australian Smart Devices Rules

Also known as: Smart Devices Rules, Security Standards for Smart Devices Rules 2025, F2025L00276, IoT Code of Practice, Code of Practice Securing the Internet of Things, Australian IoT code

Cyber Security (Security Standards for Smart Devices) Rules 2025 (Australia) — Australian Government (Department of Home Affairs)

Official site Official change log Subscribe to Australian Smart Devices Rules (RSS)

The mandatory security standard for consumer smart devices, made under the Cyber Security Act 2024 and registered on 4 March 2025. From 4 March 2026, consumer-grade connectable products acquired in Australia (with listed exceptions) must not ship with universal or easily guessable default passwords, and their manufacturers must publish how to report security issues and for how long the product will receive security updates. It makes law of the first principles of Australia's earlier voluntary IoT code of practice, which is why this page carries that code's name among its aliases. We watch the rules in the Federal Register of Legislation, so a new compiled version appears here.