What changed on 4 March 2026?
The Cyber Security (Security Standards for Smart Devices) Rules 2025, made under the Cyber Security Act 2024, commenced on 4 March 2026 after a 12-month transition period, according to the Department of Home Affairs. They set three baseline requirements for in-scope products:
- No universal default passwords. Once a device is out of its factory default state, passwords must be unique to each product or defined by the user.
- A published way to report security issues. Manufacturers must publish a means of reporting vulnerabilities and provide status updates on how reports are handled.
- A published support period. Manufacturers must publish how long the device will receive security updates, including an end date.
Suppliers must supply in-scope products with a statement of compliance and must not supply products that are required to comply but do not. The Technology Assessment and Regulation Office in the Department of Home Affairs regulates the standard, and the department says it will take an uplift-focused approach, working with manufacturers and suppliers.
Which devices does the standard cover?
Home Affairs describes the scope as most smart devices manufactured on and from 4 March 2026 that are intended for personal, domestic or household use. A legal summary by MinterEllison lists these examples and exclusions:
| Typically in scope (consumer-grade) | Excluded |
|---|---|
| Home routers and gateways | Desktop and laptop computers |
| IP cameras and video doorbells | Tablets |
| Smart TVs and speakers | Smartphones |
| Smart lighting and appliances | Therapeutic goods, road vehicles and vehicle components |
Two limits matter for events and temporary sites:
- Older stock: products manufactured before 4 March 2026 are not required to comply, even if they are sold or hired out afterwards.
- Business equipment: the standard is aimed at personal and household use, so business-grade access points, switches and site cameras may sit outside it altogether.
In other words, the label on a box tells you something about a new consumer device, but very little about a mixed kit of older and professional equipment.
Why does this matter for event and temporary site networks?
Temporary networks often mix equipment from different sources. A single event can include a hired router, an exhibitor's own consumer router at a stand, a home-style IP camera watching a storeroom, smart plugs on display lighting and screens on a guest network. On a shared network, one weak device can expose others.
- Default passwords: many older consumer devices shipped with the same password on every unit. Anyone on the same network who knows that password can try to log in.
- Unsupported firmware: a device past its support end date stops receiving security fixes, even if it still works perfectly well.
- Unknown configuration: exhibitor and contractor devices arrive with settings nobody has checked, so they belong on their own network, away from payments.
The standard makes new consumer gear safer out of the box, but it does not design the network. Separation, encryption and access control remain the job of whoever plans the event network. Our guide to event WiFi security covers the basics, and separate networks for events explains why payments, staff and guests should not share one network.
What should organisers check when hiring or buying network gear?
- Manufacture date: for consumer-grade devices, ask whether units were manufactured on or after 4 March 2026. Older stock is not required to meet the standard.
- Passwords: confirm each device has a unique admin password and a unique WiFi key, and change any that were set for a previous event.
- Support end date: check the published support period and avoid relying on devices whose security updates end before or during your event season.
- Firmware: confirm firmware was updated before dispatch rather than left at the version it shipped with.
- Router settings: the Australian Cyber Security Centre recommends changing default admin credentials, keeping firmware updated, using WPA3 where available, disabling remote management and WPS, and replacing end-of-life routers as a priority.
- Separation: put cameras, smart plugs and exhibitor devices on their own network segments, away from payments and staff devices, and offer visitors a separate guest network.
These checks apply whether a device falls inside the standard or not. For temporary sites, our page on protecting event network equipment covers the physical side of the same problem.
What about CCTV on construction sites and temporary premises?
Temporary CCTV is one of the clearest overlaps. Home-style IP cameras are named in-scope examples when they are consumer-grade, while professional site cameras may fall outside a standard aimed at household use. Either way, cameras that record people and property deserve the same checks: unique credentials, current firmware, a known support period and a network that is separate from guest WiFi.
| Device on a temporary network | Main risk | Practical control |
|---|---|---|
| Router or 4G/5G gateway | Shared or reused admin password | Unique credentials, remote management disabled or restricted |
| IP camera | Unsupported firmware, exposed video | Separate camera network, update check before deployment |
| Smart plug or display controller | Default settings, unknown origin | Isolated network with no access to payments |
| Exhibitor's own router | Unknown configuration, channel interference | Agreed channels, kept off organiser networks |
See temporary CCTV installation and the temporary CCTV planning guide for site camera planning.
What questions should you ask a network supplier?
- Which of the supplied devices are consumer-grade, and when were they manufactured?
- When does security update support end for each model?
- Are admin passwords and WiFi keys unique to this event or site?
- How are payments, staff, cameras and guests separated on the network?
- Who can access the devices remotely during the event, and how is that access removed afterwards?
Clear answers to these questions matter more than any single standard, because an event network is only as strong as its weakest connected device.
If you are planning an event or temporary site in Sydney, send us your floor plan, device list and dates, and we will come back with a network plan that keeps payments, cameras and guests apart. Start on the contact page, or see 4G and 5G router hire and network and CCTV packages.
Questions people ask
When did Australia's smart device security standard start?
The Cyber Security (Security Standards for Smart Devices) Rules 2025 commenced on 4 March 2026 after a 12-month transition period. They apply to in-scope devices manufactured on or after that date.
Does the standard cover WiFi routers and IP cameras?
Consumer-grade home routers, gateways and IP cameras are typical in-scope examples. Equipment built for business use may fall outside the standard, which is aimed at personal, domestic or household use.
Are laptops, phones and tablets covered?
No. Home Affairs lists desktop computers, laptops, smartphones and tablet computers as excluded from the smart device standard.
Does a compliant device make an event network secure?
No. The standard sets baseline protections such as unique passwords and a published support period. Network separation, encryption, remote access control and firmware updates still have to be planned for each event.
What is a security support period?
It is the period during which the manufacturer will provide security updates for a device, published with an end date. A device used after that date no longer receives security fixes.
Sources
- Department of Home Affairs: Security standards for smart devices
- MinterEllison: Cyber security standards for consumer smart devices
- Australian Cyber Security Centre: Secure your Wi-Fi and router
Event dates, prices and product details can change. Check the organiser or manufacturer before you plan around them. Planning figures are starting points; every network is confirmed against the actual site.