Cyber Security Act 2024

If an entity must comply with an obligation in section 15 or 16 in relation to a relevant connectable product, the Secretary may engage an appropriately qualified and experienced expert to carry out an independent examination of the product to determine either or both of the following:

whether the product complies with the security standard for the class of relevant connectable product;

whether the statement of compliance for the product complies with the requirements of section 16.

The expert may examine the product, for example, by doing any of the following:

opening any package in which the product is contained;

operating the product;

testing or analysing the product, including through the use of electronic equipment;

if the product contains a record or document—reading the record or document either directly or with the use of an electronic device;

taking photographs or video recordings of the product.

For the purposes of the examination, the Secretary may request, by notice in writing, the entity to provide the product, or the statement of compliance for the product, or both.

The notice must:

specify the product; and

if the entity is not the manufacturer—specify the manufacturer of the product (if known); and

specify a reasonable period within which the entity must provide the notice; and

specify the period for which the product will be retained for testing; and

specify the requirements of the security standard that the product will be tested against; and

explain the kind of testing or analysis that will be done; and

explain what may happen if:

the entity does not comply with the notice; or

the entity does not comply with its obligations in section 15 or 16 in relation to the product; and

set out any other matters prescribed by the rules.

An entity is entitled to be paid by the Commonwealth reasonable compensation for complying with a request under subsection (3).