Australia's mandatory smart-device security standards have been in force since 4 March 2026, after a twelve-month transition period. They are a worthwhile improvement for potential buyers. They will do rather less for the camera installed several years ago whose administrator account still belongs to someone the household no longer employs. That equipment can keep working perfectly well while nobody is quite sure who controls it, or who can still view it.
Home Affairs explains that the requirements apply to most in-scope consumer-grade connected products manufactured on or after that date. Products manufactured earlier are not retrospectively required to comply, even if sold later. Desktop computers, laptops, smartphones and tablets are among the exclusions. This is a defined consumer-product regime, rather than a rule covering every internet-connected product or commercial system.
Under the Cyber Security Act 2024, the relevant duties sit with manufacturers and suppliers. Manufacturers must meet the applicable standard and provide a statement of compliance; suppliers must supply covered products with that statement and must not supply products manufactured in breach of the applicable standard, subject to the Act's scope and knowledge conditions. A homeowner has not acquired a new statutory compliance task merely by owning a connected doorbell.
The Rules themselves address passwords used by covered hardware and software. Relevant passwords must be unique per product or set by the user. The hardware and pre-installed-software provisions apply outside the factory-default state; required installable software is also covered. Product-specific passwords cannot simply use incremental counters or otherwise be unacceptably guessable. As the Home Affairs FAQ clarifies, the Rules do not require every product to have password functionality.
Manufacturers must also publish a security-reporting contact and say when reporters will receive acknowledgement and status updates through to resolution. For covered components capable of receiving security updates, they must publish a support period with an end date and cannot subsequently shorten it. Those requirements make it easier to establish what the manufacturer has committed to doing. They cannot establish whether a particular household's installation has been managed properly.
The support date may arrive before the hardware wears out
The Rules prescribe no universal minimum number of years of security updates. Their five-year provision concerns manufacturers and suppliers retaining compliance statements, not a promise of five years of updates. That distinction deserves attention before someone approves an expensive installation on the strength of an Australian compliance claim.
A camera can still produce a clear picture after security support ends. A connected lock may continue opening normally. Neither is necessarily compromised at that point, but a newly discovered vulnerability may no longer receive a manufacturer fix. Working hardware and supported software can have quite different remaining lives.
Consider a homeowner planning a permanent camera installation with cabling and labour included. A published support end date allows them to compare the software commitment with how long they expect to keep the system. That date belongs in the purchasing discussion before the installer arrives. An attractive equipment price may be less attractive if replacement requires paying for another visit and reconfiguring the installation sooner than expected.
A warranty concerns the supplier's or manufacturer's promises about the product; it does not, by itself, describe security-update support. An app subscription may pay for recording storage or remote features without extending that support either. Buyers need the actual terms for each. The useful disclosure is a date they can plan around, including whether a required companion app has its own support commitment.
The installer may still have a key of sorts
Imagine a larger home where a security company administers the cameras and an automation contractor maintains the lighting and entry controls. Household staff use apps, while a property manager can operate the alarm. This is an illustrative arrangement, and it can work well with delegated access and useful audit records. The difficulty comes when responsibilities change without the accounts changing with them.
Replacing the security company should involve establishing whether the old provider can still view recordings or administer the system. A departing staff member's access should be removable without forcing everyone to share a new owner's password. When a property changes hands, physical keys may arrive with very little documentation about cloud accounts. A factory reset may be part of the transfer, but account ownership and any continuing remote access need confirming for the particular product.
The Australian Government's device guidance recommends unlinking accounts and connected services when disposing of equipment, alongside resetting it. It also advises reviewing users who no longer need access. These are practical handover tasks, and they remain relevant to equipment that predates the new standards.
For a family office or property manager, a useful record connects each system to the account that owns it and the person responsible for maintenance. Include the recovery arrangements. An owner's email account is little use for recovery if the installer controls that mailbox too. The point is to make ordinary changes of contractor or staff manageable without losing control of the household's equipment.
Compliance leaves some decisions with the household
Meeting these baseline requirements does not comprehensively guarantee privacy or security. A compliance statement does not establish Australian data residency or end-to-end encryption. It does not mean the product has been independently audited or is free of vulnerabilities. Camera recordings may still depend on the manufacturer's cloud service, with terms and access arrangements that need examining separately.
For a privacy-sensitive household, the location and extent of recording may matter as much as the password. An indoor camera may collect more information than the owner needs; its functions deserve consideration before enabling them simply because they are available. Network separation also needs configuring around the installation; compliance does not tell you whether a television or automation hub can reach sensitive home-office resources.
An independent review of an existing home should start by identifying the equipment and its dependencies. Some systems may need replacement, but others may mainly need an account transfer or a firmware update. Establishing that difference is a useful part of private-client IT and cybersecurity support, particularly when several providers look after different parts of the property.
The new standards make purchasing decisions better informed, while leaving the existing installation largely where it was. In a home with years of connected equipment, replacing a functioning device with a compliant model can be a poor first priority if nobody has settled who owns the accounts. That uncertainty can survive an expensive upgrade. The better investment may be getting the existing arrangements understood and putting someone in charge of keeping them current.
Tags: security, australia, private-client