The 30-minute smart-home support audit

1. Build an honest inventory

Open your router’s connected-device view, then walk room by room. Record the router, hubs, cameras, doorbells, plugs, bulbs, screens, vacuums, and anything else tied to an app or account. Add the model, room, account owner, and approximate purchase date.

A family device may be attached to one person’s old email or phone. The goal is not a perfect spreadsheet; it is knowing who can reset, transfer, or cancel a service. If the home is left empty during travel, note what must remain online and what can be disconnected.

• Model and room
• Responsible app or account
• Cloud or subscription dependency
• Last known update and next review

2. Verify support at the source

Find the official support page for each exact model, not its retail listing. Record how it updates, any published minimum security-update period, and the release or advisory page. NCSC treats support end dates as important consumer information; UK rules have required covered manufacturers to state a minimum security-update period since 29 April 2024.

No visible policy does not automatically prove a device is unsafe, but it is a gap worth recording. Write “unconfirmed” instead of guessing, and contact the maker for a sensitive device. Policies vary by model and market, so never transfer a promise from a similar product.

3. Update the device and its app

An update check has layers: device firmware, the phone app, and the hub or router operating system. NCSC recommends automatic updates where available and prompt manual updates; the FTC notes that firmware checks may require the manufacturer’s site.

Update one device at a time when automations depend on it. Afterwards, test the essential function, manual control, and alerts. Never interrupt power or connectivity during a firmware update; follow the maker’s instructions. This guide does not provide electrical or installation steps.

• Note the version before and after
• Test the core function, not every novelty
• Record any new permission or subscription prompt

4. Treat accounts like house keys

Replace reused passwords with unique ones and enable two-step verification or MFA where offered—both NCSC and FTC recommend it. Review guest users, old phones, and integrations you no longer use.

Avoid sharing one master password in a family chat. Give each person named access where the platform supports it. For cameras and microphones, review viewers, retention, alerts, and remote access. NCSC suggests turning remote access off when it is not needed.

5. Decide: keep, reduce, disconnect, or replace

Sort devices into four states: supported and used; supported but unused; support unconfirmed; support ended. Disconnect what is unused and remove its integrations. The FTC recommends disabling unused features and disconnecting old devices; NCSC explains that unsupported products stop receiving new security fixes.

This does not mean buying the newest model immediately. Reduce access or remove the device from the network where practical, then plan replacement by impact and data sensitivity. An unsupported indoor camera deserves more urgency than a local-only bulb. That is an editorial prioritisation, not a professional cyber-risk assessment.

• Keep: supported, useful, understood
• Reduce: disable unnecessary cloud or remote access
• Disconnect: unused or account owner unknown
• Replace: unsupported with sensitive access

6. Review data, not just hardware

Open the privacy settings for each major app. Does it retain recordings? Do optional analysis features send data away? Can everyone tell when a microphone or camera is active? Do not assume settings stayed unchanged after a major app update.

Delete recordings or logs you no longer need using the service’s controls, and remove obsolete apps from phones. Before selling or giving away a device, follow the maker’s account-removal and reset instructions; NCSC recommends a factory reset before ownership changes.

7. Finish with one page and one date

Record the audit date, the three most important actions, and the next review three months away. Save official support links, never passwords. A small label on hubs and power adapters can make future maintenance much less ambiguous.

If the audit takes hours, the system may be carrying too much complexity. Next time, reduce apps, accounts, and integrations. A good smart home should not require a permanent technical hero; it needs a short record and decisions the household can understand.