澳洲推出智慧裝置安全標籤制度

🔑 增強重點摘要

•The new security labeling scheme is a key action under Australia's broader 2023-2030 Cyber Security Strategy.
•This initiative marks a shift from previous voluntary IoT security guidance to enforceable baseline protections for consumer smart devices in Australia.
•The mandatory security standards, which came into effect on March 4, 2026, are closely aligned with the European Telecommunications Standards Institute (ETSI) EN 303 645 standard.
•The rules apply to 'relevant connectable products,' covering both internet-connectable and network-connectable devices intended for personal, domestic, or household use, but explicitly exclude products such as smartphones, laptops, and therapeutic goods.
•Non-compliance with these new standards can result in blocked market access, reputational damage, and significant enforcement actions, including potential penalties of up to $15,000 per device per violation.

📊 競品分析▸ Show

Feature/Scheme	Australia (Mandatory Standards)	Germany (IT-Security Label)	Singapore (Cyber Security Labeling Scheme)	US (Cyber Trust Mark)
Nature	Mandatory security standards (from March 2026)	Voluntary labeling scheme	Voluntary labeling scheme	Voluntary labeling program
Basis Standard	Aligned with ETSI EN 303 645	Refers to ETSI EN 303 645	Refers to ETSI EN 303 645	Based on NIST cybersecurity criteria
Label Type	No specific consumer-facing label for mandatory standards; a voluntary labeling scheme is under co-design	Binary label model	Star-rated system (more stars = more stringent security)	'U.S. Cyber Trust Mark' logo
Key Requirements	No universal default passwords, vulnerability reporting, defined security update periods, statement of compliance	13 provisions from ETSI EN 303 645, online registry	Evaluates against ETSI EN 303 645 principles, online registry	Cybersecurity criteria for consumer IoT, led by FCC

🛠️ 技術深入

The Australian mandatory security standards are derived from the 13 principles outlined in the European Telecommunications Standards Institute (ETSI) EN 303 645 standard.
No Universal Default Passwords: Devices must not ship with generic default passwords; each unit must have a unique, non-guessable password, or users must be prompted to set/change the password at first use with minimum length and complexity requirements.
Vulnerability Reporting Mechanism: Manufacturers are required to implement and publicize a clear process for users to report security vulnerabilities in both hardware and software, including contact information and timelines for acknowledgment and resolution.
Defined Support Period: Manufacturers must publicly state the length of time for which the product will receive security updates and support, and this period cannot be shortened once declared.
Statement of Compliance: Manufacturers or authorized representatives must prepare and maintain a formal statement of compliance.
Secure by Design Principles: Broader guidance from the Australian Cyber Security Centre (ACSC) also emphasizes principles like ensuring personal data protection, minimizing exposed attack surfaces, ensuring communication security (e.g., encryption for data in transit and at rest), and maintaining software integrity.

🔮 前景展望基於引用來源的 AI 分析

Consumer trust in smart devices will significantly increase.

The mandatory standards and transparent labeling will provide consumers with clearer information, enabling more informed purchasing decisions based on security.

Manufacturers will be compelled to integrate security earlier in the product development lifecycle.

The new rules incentivize a 'secure-by-design' approach to avoid non-compliance penalties and leverage security as a market differentiator.

Australia's alignment with international standards will foster global harmonization in IoT security.

By adopting standards like ETSI EN 303 645, Australia contributes to a more consistent global regulatory landscape for IoT device security.

⏳ 時間線

2019

Five Eyes nations (including Australia) released a joint statement of intent on IoT security.

2020-09

Australian Cyber Security Centre (ACSC) published the 'Voluntary Code of Practice: Securing the Internet of Things for Consumers'.

2023

Launch of the 2023-2030 Australian Cyber Security Strategy, under which the labeling scheme is a key action.

2024-11

The Cyber Security Act 2024 was enacted.

2025-03

The Cyber Security (Security Standards for Smart Devices) Rules 2025 were registered.

2026-03-04

The Cyber Security (Security Standards for Smart Devices) Rules 2025 came into effect, introducing mandatory security standards for smart devices.

澳洲推出智慧裝置安全標籤制度

⚡ 30 秒速覽

關鍵要點

🧠 深度解析

🔑 增強重點摘要

🛠️ 技術深入

🔮 前景展望基於引用來源的 AI 分析

⏳ 時間線

📎 來源 (17)

👉相關動態