Meet the IoT Code of Practice principles with less manual effort

The IoT Code of Practice, formally the Code of Practice: Securing the Internet of Things for Consumers, is voluntary Australian Government guidance published in 2020. Developed by the Department of Home Affairs with the Australian Cyber Security Centre, it sets 13 security principles that the government recommends as the minimum standard for consumer IoT devices, covering passwords, vulnerability disclosure, updates, data protection, communication security and resilience.

No, the code itself is voluntary, and organisations may comply with all or only some principles, stating which ones they meet. However, its three priority principles are now reflected in the mandatory Cyber Security (Security Standards for Smart Devices) Rules 2025, made under the Cyber Security Act 2024. Those Rules apply to most consumer smart devices manufactured on or after 4 March 2026.

The code is designed for an industry audience: device manufacturers, IoT service providers, mobile application developers and retailers of internet-connected consumer devices in Australia. Each principle states which of these parties it primarily applies to. For example, no default passwords mainly applies to manufacturers, while personal data protection applies to manufacturers, service providers, app developers and retailers.

The 13 principles are: no duplicated default or weak passwords; implement a vulnerability disclosure policy; keep software securely updated; securely store credentials; ensure personal data is protected; minimise exposed attack surfaces; ensure communication security; ensure software integrity; make systems resilient to outages; monitor system telemetry data; make it easy to delete personal data; make installation and maintenance easy; and validate input data.

The Australian Government recommends prioritising the first three principles: no duplicated default or weak passwords, implementing a vulnerability disclosure policy, and keeping software securely updated. It considers action on these areas to bring the largest security benefit in the short term. These three areas also match the obligations in the mandatory smart device security standards that commenced on 4 March 2026.

The Australian code aligns with and builds on the UK Government's Code of Practice for Consumer IoT Security, and its 13 principles closely mirror the UK's 13 guidelines. The UK guidance also informed the European standard ETSI EN 303 645. Manufacturers already working to the UK code or ETSI EN 303 645 will find most of the Australian principles familiar.

The code focuses on device and service security, while ISO 27001 is a management system standard for information security across an organisation. Many backend controls overlap, such as access control, encryption, secure development and vulnerability management. Principle 5 also requires personal data to be handled in line with the Privacy Act 1988 and the Australian Privacy Principles, so privacy compliance supports the code.

Yes. OneClickComply supports the IoT Code of Practice today, mapping its 13 principles to a shared control set so evidence also counts towards frameworks such as ISO 27001 and SOC 2. The platform automates evidence collection, generates policies and monitors backend controls. As the code is voluntary, there is no certification; OneClickComply helps you show which principles you meet.