Code of Practice: Securing the Internet of Things for Consumers

This Code of Practice is a voluntary suite of measures that the Australian Government recommends for industry as the standard for IoT devices. The Code of Practice will also help raise awareness of security safeguards associated with IoT devices, build greater consumer confdence in IoT technology and allow Australia to reap the benefts of greater IoT adoption. The Australian Government will continue to work with industry to provide better protection for consumers, including through complementary initiatives to lift security in IoT devices for consumers and specifc higher-risk sectors.

Australians are more connected to the Internet than ever before. A recent Gartner Inc. report forecasts that there will be more than 64 billion IoT devices globally by 2025. IoT devices provide signifcant benefts to Australians – enhancing our convenience, comfort and efciency.

However, these devices are often developed with functionality as a priority, with security being absent or an afterthought. Heavy reliance on IoT devices, and their rapid proliferation, increases the opportunities for malicious cyber activity. It is essential that these devices have cyber security provisions to defend against potential threats.

The draft Code of Practice is a frst step to improve the security of IoT devices in Australia. It is designed for an industry audience and comprises 13 principles. The frst three principles are the highest priority to achieve the greatest security beneft. The Australian Government recommends industry prioritise the top three principles. The draft Code of Practice aligns with and builds upon guidance provided by the United Kingdom. The principles will help inform domestic and international manufacturers about the security features expected of devices available in Australia.

Once published, the Code of Practice will be reviewed iteratively to ensure it remains ft for purpose.