Cyber Security Act 2024 · Version 2024-11-29

23 Examination to assess compliance with security standard and statement of compliance

Reading presentation · Verification limits and dated status · No live currency check

Part 2—Security standards for smart devices

(1) If an entity must comply with an obligation in section 15 or 16 in relation to a relevant connectable product, the Secretary may engage an appropriately qualified and experienced expert to carry out an independent examination of the product to determine either or both of the following:
(a) whether the product complies with the security standard for the class of relevant connectable product;
(b) whether the statement of compliance for the product complies with the requirements of section 16.
(2) The expert may examine the product, for example, by doing any of the following:
(a) opening any package in which the product is contained;
(b) operating the product;
(c) testing or analysing the product, including through the use of electronic equipment;
(d) if the product contains a record or document—reading the record or document either directly or with the use of an electronic device;
(e) taking photographs or video recordings of the product.

Request for product and statement of compliance

(3) For the purposes of the examination, the Secretary may request, by notice in writing, the entity to provide the product, or the statement of compliance for the product, or both.
(4) The notice must:
(a) specify the product; and
(b) if the entity is not the manufacturer—specify the manufacturer of the product (if known); and
(c) specify a reasonable period within which the entity must provide the notice; and
(d) specify the period for which the product will be retained for testing; and
(e) specify the requirements of the security standard that the product will be tested against; and
(f) explain the kind of testing or analysis that will be done; and
(g) explain what may happen if:
- (i) the entity does not comply with the notice; or
- (ii) the entity does not comply with its obligations in section 15 or 16 in relation to the product; and
(h) set out any other matters prescribed by the rules.

Compensation

(5) An entity is entitled to be paid by the Commonwealth reasonable compensation for complying with a request under subsection (3).