Australia IoT Code of Practice

Why does it matter?

The Code's 13 principles are specific enough to test in a product review, and the 2026 Rules turn the same themes of passwords, vulnerability reporting, and support periods into legal obligations for in-scope devices.

Key benefits include:

• Prioritized principles

The government names the top three, default passwords, vulnerability disclosure, and security updates, as the actions with the largest short-term security benefit.

• Role-specific guidance

Each principle states whether it applies primarily to device manufacturers, IoT service providers, mobile application developers, or retailers.

• Flexible adoption

An entity may comply with all or some principles and should state which principles it has met.

• Whole-lifecycle coverage

The principles run from credentials and updates through end-of-life policy to deleting personal data when a device changes hands or is disposed of.

• A link to privacy law

Principle 5 requires personal data to be handled in line with data protection law, such as the Privacy Act 1988 and the Australian Privacy Principles, with encryption as set out in the Information Security Manual.

How does it work?

The 13 principles are: 1 no duplicated default or weak passwords; 2 implement a vulnerability disclosure policy; 3 keep software securely updated; 4 securely store credentials; 5 ensure that personal data is protected; 6 minimize exposed attack surfaces; 7 ensure communication security; 8 ensure software integrity; 9 make systems resilient to outages; 10 monitor system telemetry data; 11 make it easy for consumers to delete personal data; 12 make installation and maintenance of devices easy; and 13 validate input data.

The Code defines consumer IoT as consumer-grade internet-connected devices and associated applications, such as wearables and smart televisions and refrigerators. It does not cover mobile phones, because other guidance may more accurately apply. It aligns with and builds on guidance from the United Kingdom and is consistent with other international standards.

In SmartSuite, Compliance Management holds the 13 principles as controls with owners, tests, and evidence, Cyber & IT Risk tracks product vulnerabilities, and Third Party Risk Management covers IoT service providers and suppliers.

Key Elements

• Passwords and credentials (principles 1 and 4)

Device and cloud account passwords are unique, unpredictable, and not resettable to a factory default shared across devices, associated web services use multi-factor authentication, and credentials are stored securely with none hard-coded in software or hardware.

• Vulnerability disclosure and updates (principles 2 and 3)

A public point of contact for reporting vulnerabilities, with timely action. Software and firmware are securely updateable, verified against a trusted digital signature, and covered by a clear end-of-life policy that states the minimum period of updates.

• Personal data (principles 5 and 11)

Personal data is collected only if necessary, privacy settings are protective by default, and consent can be withdrawn. Consumers can delete personal data when ownership changes or the device is disposed of.

• Attack surface and input (principles 6 and 13)

Least privilege, unused functionality disabled, unneeded ports closed, and web management limited to the local network unless remote management is needed. Data arriving through user interfaces, APIs, and network interfaces is validated.

• Communications and software integrity (principles 7 and 8)

Data needing confidentiality or integrity is encrypted in transit, and remote access is logged with at least the date, time, and source. Secure boot verifies software, and an unauthorized change triggers an alert.

• Resilience and telemetry (principles 9 and 10)

Devices keep operating locally if the network is lost, recover cleanly after a power loss, and reconnect in an orderly way. Telemetry data is monitored for security anomalies.

• Installation and maintenance (principle 12)

Setup and maintenance take minimal steps, follow Australian Government security and usability practice, and come with clear guidance. Accessibility options are on by default.

What does it cover?

The Code covers consumer-grade internet-connected devices and associated applications, with a focus on device manufacturers, IoT service providers, mobile application developers, and retailers. Governments, businesses, and individuals can all be consumers of such devices. Mobile phones are outside its focus. The 2025 Rules apply to most smart devices intended for personal, domestic, or household use and manufactured on or after 4 March 2026, and exclude desktop computers, laptops, smartphones, and tablet computers.

What are its objectives?

The Code represents a first step in the Australian Government's approach to improving the security of IoT devices.

Set a voluntary minimum standard for consumer IoT devices.

Raise awareness of the security safeguards associated with IoT devices.

Build consumer confidence in IoT technology.

Help Australia benefit from greater IoT adoption.

Inform domestic and international manufacturers about the security features expected of devices available in Australia.

Framework in Context

The Code is the voluntary precursor to the mandatory smart device standards that began on 4 March 2026. Home Affairs says the Rules reflect international best practice, and the Code itself builds on United Kingdom guidance. Product teams commonly map it to ETSI EN 303 645, NISTIR 8259A, ISO/IEC 27001, and the NIST Cybersecurity Framework.

Common Framework Mappings

Teams that build consumer devices map the Code's principles to the frameworks below, which cover similar baseline practices.

Mapped frameworks include:

CIS Controls v8.1

ETSI EN 303 645

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NISTIR 8259A

UK Code of Practice for Consumer IoT Security