AS ETSI EN 303 645:2025 Australian STANDARD STANDARDS ETSI EN 303 645 V3.1.3 (2024-09) CYBER; Cyber Security for Consumer Internet of Things: Baseline Requirements This Standard is an identical adoption of ETSI EN 303 645 V3.1.3 (2024-09). Copyright in this ETSI adoption remains with ETSI. AS ETSI EN 303 645:2025 This Australian Standard? was prepared by IT-012, Information security, cybersecurity and privacy protection. It was approved on behalf of Standards Australia's Standards Development and Accreditation Committee on 1 September 2025 This Standard was published on 5 September 2025. The following are represented on Committee IT-012: Australasian Society for Computers and Law Australian Industry Group AustralianInformationIndustryAssociation Australian Information Security Association Australian Signals Directorate Business Continuity Institute Australasia Consumers' Federation of Australia CSIRO Energy Networks Australia Engineers Australia ISACA Melbourne ISACA Sydney JointAccreditationSystemofAustralia&NewZealand OfficeoftheVictorianInformationCommissioner University of Wollongong This Standard was issued for comment as DR AS ETSI EN 303 645:2025 Keeping Standards up-to-date Ensure you have the latest versions of our publications and keep up-to-date about Amendments, Rulings, Withdrawals and new products by visiting: www.standards.org.au ISBN:9781761753596 AS ETSI EN 303 645:2025 ETSI EN 303 645 V3.1.3 (2024-09) Australian Standard? CYBER; Cyber Security for Consumer Internet of Things? Baseline Reguirements First published as AS ETSI EN 303 645:2023. Second edition 2025. @ ETSI 2025—All rights reserved StandardsAustralia Limited2025 All rights are reserved. No part of this work may be reproduced or copied in any form or by any means, electronic or mechanical, including photocopying, without the written permission of the publisher, unless otherwise permitted under the Copyright Act 1968 (Cth). AS ETSIEN303645:2025 Preface This Standard was prepared by the Australian members of the Joint Standards Australia/Standards New AS ETSIEN 303 645:2023. The objective ofthis documentis to specify high-level security and data protection provisions for consumer IoT devices that are connected to network infrastructure (such as the Internet or home network) and their interactions with associated services. A non-exhaustive list of examples of consumer IoT devices includes the following: (a) Connected children's toys and baby monitors. (b) Connected smoke detectors, door locks and window sensors. (c) IoT gateways, base stations and hubs to which multiple devices connect. (d) Smart cameras, smart speakers and smart televisions together with their remote controls. (e) Wearable health trackers. (f) Connected home automation and alarm systems, especially their gateways and hubs. (g) Connected appliances, such as washing machines and fridges. (h) Smart home assistants. This document addresses security considerations specific to constraints in device resources. This document provides basic guidance through examples and explanatory text for organizations involved in the development and manufacturing of consumer IoT on how to implement those provisions. Devices that are not consumer IoT devices, for example those that are primarily intended to be used in manufacturing, healthcare or other industrial applications, are not in scope of this document. This document has been developed primarilyto help protect consumers; however, other users of consumer IoT devices equally benefit from the implementation of the provisions set out here. This document is identical to, and has been reproduced from, ETSI EN 303 645 V3.1.3 (2024-09), CYBER; As this document has been reproduced from an international document, the following apply: (i) In the source text "the present document" is to be read as "this document" (ii) A comma is to be read as a full point when referring to a decimal marker. Australian or Australian/New Zealand Standards that are identical