Cyber Security Act 2024 · Version 2024-11-29

Division 2—Security standards for relevant connectable products

Reading presentation · Verification limits and dated status · No live currency check

Part 2—Security standards for smart devices

(1) The rules may make provision for, or in relation to, security standards for specified classes of relevant connectable products that will be acquired in Australia in specified circumstances.
(2) Without limiting subsection (1) a class of relevant connectable products specified for the purposes of that subsection may consist of a particular relevant connectable product or of all relevant connectable products.
(3) Despite subsection 14(2) of the Legislation Act 2003, the rules may make provision in relation to a matter by applying, adopting or incorporating, with or without modification, any matter contained in an instrument or other writing as in force or existing from time to time.

Manufacturer must comply

(1) An entity must manufacture a relevant connectable product in compliance with the requirements of the security standard for a class of relevant connectable product that will be acquired in Australia in specified circumstances if:
(a) the product is included in that class; and
(b) the entity is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in those circumstances.
(2) The entity must comply with any other requirements of the security standard that apply to the manufacturer of a product included in that class.
(3) An entity must not supply a product in Australia that was not manufactured in compliance with the requirements of the security standard for a class of relevant connectable product that will be acquired in Australia in specified circumstances if:
(a) the product is included in that class; and
(b) the entity is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in those circumstances.
(4) The entity must comply with any other requirements of the security standard that apply to the supplier of a product included in that class.

Exception

(5) However, to the extent that a requirement in the security standard does not relate to any of the matters in subsection (6), an entity is not required to comply with subsections (1) to (4) if the entity is not:
(a) an entity that is a corporation to which paragraph 51(xx) of the Constitution applies; or
(b) an entity that is undertaking activities in the course of, or in relation to, trade or commerce with other countries, among the States, between Territories or between a Territory and a State.
(6) The matters are the following:
(a) the direct, or indirect, connection of the relevant connectable product to, a telegraphic, telephonic or other like service within the meaning of paragraph 51(v) of the Constitution (including, for example, connection to the internet);
(b) the direct, or indirect, use by the relevant connectable product of such a service (including, for example, use of the internet);
(c) measures that would protect the relevant connectable product from an attack effected by means of such a service (including, for example, by means of the internet).

Manufacturer must provide statement of compliance

(1) An entity that manufactures a relevant connectable product must provide, for the supply of the product in Australia, a statement of compliance with the security standard for a class of relevant connectable product that will be acquired in Australia in specified circumstances if:
(a) the product is included in that class; and
(b) the entity is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in those circumstances.
(2) The entity must retain a copy of the statement of compliance for the period specified in the rules for that class of statements.

Supplier must supply the product with statement of compliance

(3) An entity that supplies a relevant connectable product in Australia must supply the product with a statement of compliance with the security standard for a class of relevant connectable product that will be acquired in Australia in specified circumstances if:
(a) the product is included in that class; and
(b) the entity is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in those circumstances.
(4) The entity must retain a copy of the statement of compliance for the period specified in the rules for that class of statements.

Requirements for statement of compliance

(5) The statement of compliance with the security standard under subsection (1) or (2) must meet the requirements provided by the rules for that class of statements.

Matters relating to the rule making powers

(6) Without limiting subsection (2), (4) or (5) a class of statements may consist of a statement for a particular relevant connectable product or a particular security standard or all relevant connectable products or all security standards.