The SOCI Act, as a project
What the Security of Critical Infrastructure Act 2018 asks of you, in plain language: who it applies to, the Register, the 12 and 72-hour cyber incident reporting clocks, the Critical Infrastructure Risk Management Program (CIRMP) and the 2026 Enhanced CIRMP Rules. Then a 12-month example project plan to meet them.
What the SOCI Act is
The Security of Critical Infrastructure Act 2018 (the SOCI Act) sets out the legal obligations of anyone who owns, operates or holds a direct interest in a critical infrastructure asset in Australia, and how government can step in when an incident affects one. It is administered by the Cyber and Infrastructure Security Centre (CISC) in the Department of Home Affairs.
It was expanded in 2021 and 2022, again by the Cyber Security Legislative Package in late 2024, and again in June 2026 by the Enhanced CIRMP Rules. The CISC has also said that from 2026-27 it will put more weight on dealing with non-compliance, after the 2026 independent review of the Act. If your programme was built for the 2023 rules, it is probably behind.
Does it apply to you?
The Act covers 11 sectors: communications; data storage or processing; financial services and markets; water and sewerage; energy; health care and medical; higher education and research; food and grocery; transport; space technology; and defence industry. Within them it defines 22 classes of critical infrastructure asset, from electricity, gas, water and ports to hospitals, banking, data storage or processing and domain name systems, each with its own definition and thresholds.
Two questions decide it:
- Do you own, operate or hold a direct interest in an asset that meets a class definition? A direct interest is generally 10% or more. If your sector is not one of the 11, the Act most likely does not apply to you.
- Which obligations apply to that asset class? Each obligation has its own list of classes. A bank, for example, must report cyber incidents but is not on the list for a CIRMP. Answer this per obligation, not once.
A data storage system you own or operate is treated as part of the asset when it holds business critical data and a hazard affecting it could have a relevant impact on the asset (added in December 2024). That pulls it into the Register, incident reporting and CIRMP.
Register
Changes within 30 days
Cyber incident
12 hours, or 72 hours
CIRMP annual report
Board-approved, by 28 September
Enhanced CIRMP Rules
10 June 2027 and 2028
The obligations at a glance
The CISC describes three positive security obligations that can apply to critical infrastructure assets depending on their class, a duty that applies to all of them, and four enhanced obligations for the few assets declared Systems of National Significance.
| Obligation | What you do | Deadline | Maximum civil penalty |
|---|---|---|---|
| Notify data service providers | Tell a data storage or processing provider that the data it holds for you is business critical data about a critical infrastructure asset. Applies to all critical infrastructure assets. | When the arrangement exists | See the Act |
| Register of Critical Infrastructure Assets | The responsible entity gives operational information (location, operators, CEO, data arrangements); direct interest holders give ownership and control information. | 6 months after the asset becomes covered; changes within 30 days | 50 penalty units |
| Mandatory cyber incident reporting | Report cyber security incidents to the Australian Signals Directorate's ACSC. | 12 hours for a significant impact on availability; 72 hours for a relevant impact | 50 penalty units |
| Critical Infrastructure Risk Management Program | Adopt, maintain, comply with, review and update a written all-hazards risk management program, and report on it each year. | Annual report by 28 September, board-approved | 200 penalty units (program); 150 (annual report) |
| Enhanced Cyber Security Obligations | Systems of National Significance only, on notice from the Secretary: incident response plans, cyber security exercises, vulnerability assessments and system information reporting. | Set by each notice, usually at least 30 days | 200 penalty units each |
| Government directions and assistance | Comply with a Ministerial direction about a security risk, and with information-gathering and action directions after a serious incident. | As directed | Up to 250 penalty units; some breaches are offences |
Penalty units are Commonwealth penalty units, indexed each July. Disclosing protected information about a critical infrastructure asset outside what the Act allows is a separate offence, even for the responsible entity.
The CIRMP: the heart of the Act
A Critical Infrastructure Risk Management Program (CIRMP) is a mandatory written risk management framework required for owners and operators of designated critical infrastructure assets in Australia. It is governed by Part 2A of the Security of Critical Infrastructure Act 2018 (SOCI Act).
The detail sits in the CIRMP Rules (LIN 23/006), in force since 17 February 2023. A responsible entity must adopt a CIRMP, comply with it, review it regularly and keep it up to date. Each of those is a separate duty carrying up to 200 penalty units.
Who needs one
The CIRMP Rules apply to 13 asset classes: broadcasting, domain name systems, data storage or processing, electricity, energy market operators, gas, designated hospitals, food and grocery, freight infrastructure, freight services, liquid fuel, payment system financial market infrastructure, and water. Telecommunications carriers and larger carriage service providers have had their own CIRMP rules since April 2025. Banking, superannuation, insurance, ports, aviation and education are not on the list.
What it must cover
The program must identify each hazard where there is a material risk that it could have a relevant impact on the asset, and minimise or eliminate that risk, or mitigate its impact, as far as reasonably practicable. It covers four hazard domains:
- Cyber and information security: comply with a recognised framework (below).
- Personnel: identify critical workers, assess their suitability, and manage the risk of malicious or negligent insiders. AusCheck background checks are optional for most assets and mandatory under the enhanced rules.
- Supply chain: unauthorised access, misuse of privileged access, disruption, and over-reliance on particular suppliers.
- Physical security and natural hazards: critical sites, access control and the risk from fire, flood, storms and other natural events.
Since April 2025 a risk to a data storage system holding business critical data is also a material risk the program must address.
The cyber framework
| Baseline CIRMP Rules (any one) | Enhanced CIRMP Rules, from June 2026 (any one) |
|---|---|
| AS ISO/IEC 27001 | AS ISO/IEC 27001:2023 |
| Essential Eight, Maturity Level 1 | Essential Eight, Maturity Level 2 |
| NIST Cybersecurity Framework | NIST Cybersecurity Framework 2.0 |
| C2M2, MIL 1 | C2M2 v2.1, MIL 2 |
| AESCSF Framework Core, Security Profile 1 | 2023 AESCSF Framework Core, Security Profile 2 |
| Or an equivalent framework | Or an equivalent to the Essential Eight, C2M2 or AESCSF options |
If you are already working to ISO 27001 or ASD Essentials, the CIRMP should sit inside that programme rather than beside it. Our integrated framework guide shows how.
The annual report
Within 90 days after the end of the financial year, so by 28 September, the responsible entity must give the relevant regulator (or the CISC where there is none) a report stating whether the CIRMP was up to date at the end of the year, and evaluating any hazard that had a significant relevant impact on the asset during it. The report must be approved by the board, council or other governing body. That makes it a board matter every year, not a compliance team form.
When the government can make you change it
Since December 2024, the Secretary of Home Affairs or the relevant regulator can direct you to vary your CIRMP if it has a serious deficiency that poses a material risk to national security, defence or social or economic stability. Ignoring a direction carries up to 250 penalty units.
The Enhanced CIRMP Rules (June 2026)
The Enhanced CIRMP Rules commenced on 10 June 2026. They sit on top of the baseline rules for nine asset classes: broadcasting, domain name systems, electricity, energy market operators, freight infrastructure, freight services, gas, liquid fuel and water. Where the two conflict, the enhanced rules win.
For assets that were already critical infrastructure assets on 10 June 2026:
- By 10 June 2027 (12 months): the new material risks, including foreign ownership, control or influence and offshore or remote access; patching, legacy technology and emerging technology, AI included; and access management for critical workers.
- By 10 June 2028 (24 months): everything else, including a higher cyber framework (table above); multi-factor authentication with central logging; an inventory of critical systems and how they connect; critical systems able to keep operating for at least three months while other systems are restored; mandatory AusCheck background checks (or an NV1 clearance or higher) for critical workers, repeated at least every five years; supplier mapping and due diligence on major suppliers; and a centralised physical security plan.
An asset that becomes a critical infrastructure asset later counts its 12 and 24 months from that date.
Cyber incident reporting: the two clocks
- 12 hours: a cyber security incident that has had, or is having, a significant impact on the availability of the asset, meaning it has materially disrupted the essential goods or services the asset provides. If you report by phone, a written report must follow within 84 hours.
- 72 hours: an incident that has occurred, is occurring or is imminent and has a relevant impact on the availability, integrity, reliability or confidentiality of the asset. A phone report must be followed in writing within 48 hours.
Reports go to the Australian Signals Directorate's Australian Cyber Security Centre, through cyber.gov.au or by phone on 1300 CYBER1. The clock starts when you become aware of the incident, not when you finish investigating it, so the decision about which clock applies has to be possible at 2am with half the facts. Write that decision into your incident plan, and practise it.
Other clocks may run at the same time: the Privacy Act's notifiable data breach scheme, APRA's CPS 234 72-hour notification, the ransomware payment reporting duty under the Cyber Security Act 2024, and your contracts. One incident process should carry all of them.
An example project plan
What meeting the Act looks like as a schedule: a mid-sized water, gas or electricity operator, already working to a cyber framework, bringing its programme up to the Enhanced CIRMP Rules, starting in November 2026. It runs through the first enhanced deadline (10 June 2027) and the next annual report (28 September 2027), as a work breakdown structure (WBS). If your assets are not in one of the nine enhanced classes, workstreams 4 and 5 shrink to whatever your gap assessment finds. Treat it as a shape to adapt, not a promise.
SOCI programme: example schedule
Task Workstream rollup MilestoneWeek 1 is the week of 2 November 2026. Workstreams overlap on purpose: reporting readiness comes first because an incident will not wait for the gap assessment, and the 24-month items start early because three months of isolated operation and five-yearly background checks take longest to stand up.
What is changing next
The 2026 independent review of the Act made six recommendations, accepted in principle. Home Affairs consulted on changes to the Ministerial directions powers (March to May 2026) and on a wider second tranche of reforms (to July 2026), including possible new asset classes for space, blood and pathology, a threshold for data centres, and a middle tier of penalties. None of it is law as at October 2026. Plan to the rules in force, and watch the CISC for a bill.
Need someone to run it?
A SOCI programme touches the board, operations, HR, procurement and security at once. Tell us where you are and we will reply within two business days, and can introduce you to an independent consultant who runs CIRMP, Enhanced CIRMP Rules and incident reporting programmes for critical infrastructure operators.
CISO AI may receive a fee from providers we introduce you to. Your details are used only for this enquiry; see our privacy policy.
Questions
Does the SOCI Act apply to my organisation?
Only if you own, operate or hold a direct interest (generally 10% or more) in a critical infrastructure asset in one of the 11 sectors, and the asset meets its class definition and thresholds. Each obligation then applies to a different list of asset classes, so check the Register, incident reporting and CIRMP separately. If your sector is not one of the 11, the Act most likely does not apply to you.
What is a CIRMP?
A Critical Infrastructure Risk Management Program is a mandatory written risk management framework required for owners and operators of designated critical infrastructure assets. It is governed by Part 2A of the SOCI Act and the CIRMP Rules, and must identify and minimise or mitigate material risks across four hazard domains: cyber and information security, personnel, supply chain, and physical security and natural hazards.
When is the CIRMP annual report due?
Within 90 days after the end of the Australian financial year, so by 28 September. It must be approved by your board, council or other governing body, and state whether the CIRMP was up to date during the year.
How fast must a cyber incident be reported?
Within 12 hours of becoming aware of an incident that is having, or has had, a significant impact on the availability of the asset, and within 72 hours for an incident with a relevant impact. Reports go to the Australian Signals Directorate's ACSC. An oral report must be followed by a written one within 84 hours (12-hour reports) or 48 hours (72-hour reports).
Do the Enhanced CIRMP Rules apply to us?
They apply to nine asset classes: broadcasting, domain name systems, electricity, energy market operators, freight infrastructure, freight services, gas, liquid fuel and water. They commenced on 10 June 2026. For assets that were already critical infrastructure assets then, some requirements are due by 10 June 2027 and the rest by 10 June 2028.
Which cyber framework does the CIRMP need?
Baseline assets must comply with one of: ISO/IEC 27001, the Essential Eight at Maturity Level 1, the NIST Cybersecurity Framework, C2M2 at MIL 1, the AESCSF at Security Profile 1, or an equivalent. Assets under the Enhanced CIRMP Rules need a higher bar: ISO/IEC 27001:2023, the Essential Eight at Maturity Level 2, NIST CSF 2.0, C2M2 v2.1 at MIL 2, the 2023 AESCSF at Security Profile 2, or an equivalent.
We are a bank or insurer regulated by APRA. Do we need a CIRMP?
Banking, superannuation and insurance assets are not on the list of asset classes the CIRMP Rules apply to, so the CIRMP obligation does not reach them, though cyber incident reporting does. Payment system financial market infrastructure is on the CIRMP list. Your security programme sits under APRA's CPS 234 and CPS 230; see our APRA guide.
Sources and where to go deeper
- CISC: Security of Critical Infrastructure Act 2018
- Security of Critical Infrastructure Act 2018, current compilation
- Security of Critical Infrastructure (CIRMP) Rules (LIN 23/006)
- Enhanced CIRMP Rules 2026 (LIN 26/075)
- Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024
Integrated security and AI governance framework: run the CIRMP, ISO 27001 and ASD Essentials as one programme.
ASD Essentials and AI: the Essential Eight's successor, mapped to the ISM.
APRA CPS 220, 230 and 234: for financial services assets outside the CIRMP.
This guide is general information, not legal advice. Check the Act and Rules in force, and your asset class definitions, before relying on it.