Since 4 March 2026, most consumer smart devices sold in Australia have to meet a new baseline of security rules. The Cyber Security (Security Standards for Smart Device) Rules 2025, made under the Cyber Security Act 2024, force manufacturers and suppliers to do three things: stop shipping gear with universal default passwords, publish a way for people to report security bugs, and state plainly how long a device will get security updates, including an end date. Laptops, phones and tablets are carved out — this is aimed squarely at the cheaper connected kit that has never been secure by design.

For a hospitality venue, that kit is everywhere: smart TVs in rooms, IoT door locks, IP cameras, booking kiosks, guest Wi-Fi access points, even the smart thermostats and sensors out the back. Here’s the catch most coverage skips — the Rules only bind devices manufactured from 4 March 2026 onward. Every bargain camera, lock and streaming stick already plugged into your network is untouched by them. In the venues we look after across the Northern Beaches and Brookvale, that older, imported gear — often still running its factory password on the same flat network as the POS — is exactly where the real exposure sits, not the shiny new devices the law now covers.

So the rules help you going forward, but they don’t clean up what you already own. When you buy anything new, ask the supplier for the statement of compliance and the update end date, and don’t buy a device that’s already near the end of its support window. For what’s on the floor now: inventory every connected device, change the default passwords, and put IoT gear on its own network segment — well away from your payment systems and guest data. Anything that no longer gets updates should be retired, not left online.

If you’re not sure what’s actually talking to your network, that’s the first thing worth fixing. All IT Services runs device audits and network segmentation for hospitality businesses so a compromised smart TV can’t become a path to your POS — see our cybersecurity and hospitality IT services pages, or get in touch.