SOCI Act compliance: critical infrastructure risk management program

The Security of Critical Infrastructure Act 2018 requires responsible entities for critical infrastructure assets to adopt, maintain and comply with a written risk management program and to report on it to the regulator every year. Aegentra helps you decide whether the obligation applies, build the program across the four hazard domains the Rules name, choose and evidence a cyber security framework, and prepare the annual report your board must approve.

Critical infrastructure in the energy sector, one of the eleven sectors the Act covers. The program is answered per asset, not per organisation.

A program across all four hazard domains, written so the board can approve it.

The SOCI Act requires responsible entities to adopt, maintain and comply with a written critical infrastructure risk management program and to report on it to the regulator every year. We help you decide whether the obligation applies, build the program across the four hazard domains the CIRMP Rules name, choose and evidence a cyber security framework from the list the Rules allow, and prepare the annual report and the board paper behind it. The work is readiness and program support, not legal advice and not a regulator determination.

At a glance

• 4 hazard domains the CIRMP Rules name: cyber and information security, personnel, supply chain, and physical security and natural hazards
• 11 sectors the Act covers, from communications and energy to healthcare, transport, and water and sewerage
• 5 cyber security frameworks the Rules list, each with a stated condition, or an equivalent: AS ISO/IEC 27001, the Essential Eight Maturity Model, NIST CSF, C2M2 and the AESCSF
• 90 days after the end of the financial year to submit the annual report, approved by the board, council or governing body

Four hazard domains the CIRMP Rules name, each with its own requirements.

A program that only addresses cyber does not meet the Rules. We scope all four domains unless you already have evidenced arrangements for some of them.

Cyber and information security: A framework from the list the Rules allow

The program must comply with a listed cyber security framework at its stated condition, or an equivalent; for enhanced assets, credential compromise and lateral movement hazards carry their own expectations.

Personnel hazards: Critical workers and insiders

Identifying critical workers, assessing their suitability before they access critical components, and managing malicious or negligent insiders and off-boarding.

Supply chain hazards: Interdependencies and suppliers

The Rules require the program to address supply chain hazards, and the regulator expects it to describe interdependencies with other assets and the positions responsible for it.

Physical security and natural hazards: The asset and its surroundings

Physical security hazards and natural hazards are the fourth domain; the material risks the Rules list include stoppage of the asset’s function and interference with operational technology.

What the SOCI Act requires

The Security of Critical Infrastructure Act 2018 (the SOCI Act) sets out the legal obligations of entities that own, operate or have direct interests in critical infrastructure assets across eleven sectors: communications, financial services and markets, data storage or processing, defence industry, higher education and research, energy, food and grocery, healthcare and medical, space technology, transport, and water and sewerage. The Act defines each class of critical infrastructure asset, and the responsible entity for each asset class is defined in section 12L. The Cyber and Infrastructure Security Centre (CISC) administers the regime.

• Notify data storage or processing providers that hold business critical data for the asset (subsection 12F(3)); applies to all critical infrastructure assets
• Provide operational and ownership information to the Register of Critical Infrastructure Assets (Part 2)
• Report cyber incidents that have a relevant or significant impact on the asset (Part 2B)
• Adopt, maintain and comply with a written critical infrastructure risk management program, a CIRMP (Part 2A)
• Systems of National Significance carry four enhanced cyber security obligations in addition: incident response plans, cyber security exercises, vulnerability assessments and system information

Does the obligation apply to you?

The obligations depend on whether you are a responsible entity or a direct interest holder, and on the asset class. A direct interest holder holds a direct or joint interest of at least 10% in the asset, or an interest that lets it influence or control the asset, and its obligation is to register. The responsible entity carries the risk management program. The first piece of work is therefore a documented determination: which assets you hold, which class each falls into, who the responsible entity is, and which parts of the Act and the Rules apply.

• Asset identification against the class definitions in the Act, recorded with the reasoning
• Responsible entity and direct interest holder roles confirmed per asset
• Whether the asset falls under the enhanced CIRMP requirements the Rules apply to specified asset classes, which carry additional material risks and a higher cyber maturity condition
• Register, incident reporting and data service provider notification obligations mapped alongside the CIRMP
• A written position you can show the regulator if the determination is ever questioned

The program across four hazard domains

The Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023 set out what the program must contain. A responsible entity must establish and maintain a process or system to identify the operational context of the asset, identify the material risks, minimise or eliminate those risks and mitigate the impact of each hazard as far as reasonably practicable, review the program and keep it current. The Rules then specify requirements for four hazard domains.

• Cyber and information security hazards, including a cyber security framework and, for enhanced assets, credential compromise and lateral movement hazards
• Personnel hazards: identifying critical workers, assessing their suitability before they access critical components, and managing malicious or negligent insiders and off-boarding
• Supply chain hazards
• Physical security hazards and natural hazards
• The Rules also list the material risks to be addressed, such as stoppage of the asset’s function, interference with operational technology, sensitive operational information stored outside Australia and remote access to operational control systems
• The regulator expects the program to describe interdependencies with other assets, the positions responsible for it, a risk management methodology and when the program is reviewed

Choosing and evidencing the cyber security framework

For cyber and information security hazards the Rules require the program to comply with a framework from a listed document, meeting any stated condition, or an equivalent framework. The choice is a decision with consequences for evidence, audit and cost, and we help you make it against what you already run rather than starting from the framework a vendor prefers.

• Listed for standard assets: AS ISO/IEC 27001:2015; the Essential Eight Maturity Model published by ASD at Maturity Level One; the NIST Framework for Improving Critical Infrastructure Cybersecurity; the US Department of Energy Cybersecurity Capability Maturity Model at Maturity Indicator Level 1; and the 2020-21 AESCSF Framework Core at Security Profile 1
• Listed for assets under the enhanced requirements: AS ISO/IEC 27001:2023; the Essential Eight at Maturity Level Two; NIST CSF 2.0; C2M2 version 2.1 at Maturity Indicator Level 2; and the 2023 AESCSF Framework Core at Security Profile 2
• An equivalent framework is allowed where it achieves the same level of security, including the stated conditions
• Where ISO 27001 is chosen, our ISO 27001 implementation and internal audit services produce the management system and its evidence; where the Essential Eight is chosen, our Essential Eight assessment records the maturity level per strategy
• For enhanced assets the Rules add phishing-resistant multi-factor authentication expectations for credential compromise hazards and network segregation elements for lateral movement hazards, which we map to the chosen framework

The annual report and board attestation

A responsible entity must submit an annual report on its program to the relevant regulator within 90 days of the end of the Australian financial year, using the CISC form. The report must be approved by the entity’s board, council or other governing body. We prepare the program so that the report can be written from its records, and we prepare the board paper that supports the approval rather than asking directors to attest to something they have not seen evidenced.

• A report calendar working back from the 90-day deadline, with evidence owners named
• The board paper: what the program covers, what changed, what the evidence shows and what the governing body is being asked to approve
• A record of the program version, review dates and material changes so next year’s report starts from a known position
• Where a hazard domain is thin, the gap is stated in the board paper with the plan to close it rather than hidden

The frameworks the Rules list, with the condition each must meet.

For cyber and information security hazards the program must comply with a framework from a listed document, meeting any stated condition, or an equivalent framework that achieves the same level of security.

How the engagement runs

Named steps, each with what happens and what you receive.

Determine: Decide whether the obligation applies, asset by asset

Each asset you hold is identified against the class definitions in the Act, the responsible entity and direct interest holder roles are confirmed, and whether the enhanced CIRMP requirements apply is recorded with the reasoning.

What you receive:

• A written applicability determination with the reasoning
• Register, incident reporting and notification obligations mapped alongside the program
• A fixed-fee quote for the program work that follows

Assets you hold → Class definitions in the Act and the Rules → Reasoned determination

Design: Build the program across the four hazard domains

The program establishes the process to identify the operational context and material risks of the asset, minimise or eliminate those risks and mitigate the impact of each hazard as far as reasonably practicable, and keep the program current, with the specific requirements for cyber and information security, personnel, supply chain, and physical security and natural hazards.

What you receive:

• The program document and its supporting processes
• Interdependencies, responsible positions and the risk management methodology described
• Thin domains stated as gaps with a plan to close them, not hidden

Operational context and material risks → Four hazard domains → Program document

Framework: Choose and evidence the cyber security framework

The Rules require the cyber domain to comply with a listed framework at its stated condition, or an equivalent. The choice is made against what you already run; where ISO 27001 is chosen our implementation and internal audit services produce the management system and its evidence, and where the Essential Eight is chosen our assessment records the maturity level per strategy.

What you receive:

• The framework decision recorded with its reasons
• An evidence plan for the chosen framework
• For enhanced assets, credential compromise and lateral movement expectations mapped to it

Frameworks the Rules list → Decision against what you run → Evidence plan

Report: Prepare the annual report and the board paper

The annual report is due to the relevant regulator within 90 days of the end of the financial year on the CISC form and must be approved by the board, council or other governing body. We prepare it from the program’s records and write the board paper so directors see what they are approving.

What you receive:

• A report calendar with evidence owners named
• The annual report drafted from the program records
• A board paper: what the program covers, what changed, what the evidence shows and what is being approved

Program records → Annual report on the CISC form → Board approval, your governing body

Maintain: Keep next year’s report starting from a known position

The program version, review dates and material changes are recorded so the program stays current and the following year’s report starts from a known position rather than a reconstruction.

What you receive:

• A record of program version, review dates and material changes
• Review triggers tied to changes in the asset, the ownership or the Rules
• Operation of the program stays with your positions, as the Rules expect

Approved program → Reviews and material changes recorded → Next year’s report

Who it applies to

The obligations depend on whether you are a responsible entity or a direct interest holder, and on the asset class, so the question is answered per asset.

• Entities that own or operate an asset meeting one of the critical infrastructure asset class definitions in the Act, in one of the eleven sectors
• Responsible entities, defined per asset class in section 12L, which carry the risk management program
• Direct interest holders with at least a 10% interest or the ability to influence or control the asset, whose obligation is to register
• Assets under the enhanced CIRMP requirements, which carry additional material risks and a higher cyber maturity condition
• Systems of National Significance, which carry four enhanced cyber security obligations on top of the program

What we deliver

The first piece of work is a documented, reasoned determination; the program and the annual report are built on it.

• Asset identification against the class definitions in the Act, with the responsible entity and direct interest holder roles confirmed per asset
• A written applicability position you can show the regulator, with register, incident reporting and data service provider notification obligations mapped beside the program
• The program across the four hazard domains, including critical worker identification, supply chain and physical security processes, interdependencies, responsible positions, a risk management methodology and review dates
• The cyber security framework decision made against what you already run, with the evidence plan that follows from it
• For enhanced assets, the phishing-resistant multi-factor authentication and network segregation expectations mapped to the chosen framework
• A report calendar working back from the 90-day deadline, the annual report drafted from the program’s records, and the board paper that supports approval

What we do not do

The regulator’s view of your asset remains the regulator’s, and the service does not include legal advice.

• No determination that binds the regulator, and no guarantee of compliance
• No legal advice: where the determination turns on a legal question we say so and recommend you take advice
• We do not operate the program, the register entries or the incident reports on your behalf; we define who does and what triggers it
• ISO 27001 implementation, Essential Eight assessment, penetration testing, physical security assessments and background checking are separate scopes
• Protected information under the SOCI Act is handled only under the arrangements agreed at scoping

Frequently asked questions

Which organisations are responsible entities under the SOCI Act?

An entity that owns or operates an asset that meets one of the critical infrastructure asset class definitions in the Act, in one of the eleven sectors the Act covers. The responsible entity for each asset class is defined in section 12L of the Act and varies by class, so the question is answered per asset rather than per organisation. We document the determination with the reasoning so it can be revisited if the asset, the ownership or the Rules change.

What must a critical infrastructure risk management program contain?

Under the CIRMP Rules, a process or system to identify the operational context and material risks of the asset, to minimise or eliminate those risks and mitigate the impact of each hazard as far as reasonably practicable, and to review the program and keep it current, with specific requirements for cyber and information security, personnel, supply chain, and physical security and natural hazards. The Rules also expect the program to describe interdependencies, name the responsible positions, state a risk management methodology and say when it will be reviewed.

Which cyber security framework should we adopt?

The Rules list AS ISO/IEC 27001, the Essential Eight Maturity Model at Maturity Level One, the NIST framework, the US Department of Energy C2M2 at Maturity Indicator Level 1 and the AESCSF at Security Profile 1, or an equivalent framework; assets under the enhanced requirements face higher conditions, such as the Essential Eight at Maturity Level Two and NIST CSF 2.0. The right choice depends on what you already run, what your customers and insurers ask for and what your sector regulator expects. We assess the options against your environment and record the decision.

When is the annual report due and who signs it?

Within 90 days of the end of the Australian financial year, submitted to the relevant regulator using the Cyber and Infrastructure Security Centre’s form. The report must be approved by the entity’s board, council or other governing body. We prepare the report from the program records and a board paper that shows directors what they are approving.

What are the enhanced CIRMP requirements?

The Rules apply additional requirements to specified asset classes: further material risks such as foreign ownership, control or influence and offshore access to critical components and business critical data, a higher cyber security framework condition, and specific requirements for credential compromise hazards, including phishing-resistant multi-factor authentication, and lateral movement hazards, including network segregation of critical systems. Whether your asset is one of those classes is part of the applicability determination.

Is ISO 27001 certification required under the SOCI Act?

No. AS ISO/IEC 27001 is one of the frameworks the Rules list for the cyber and information security hazard domain, and the Rules require a process or system to comply with the framework rather than a certificate. Many entities choose it because the management system produces the evidence the annual report needs and because customers ask for it anyway. If you choose it, our ISO 27001 implementation service builds the ISMS and certification remains a separate decision by an accredited certification body.

Does the program only cover cyber security?

No. Cyber and information security is one of four hazard domains. The Rules also require processes for personnel hazards, including identifying critical workers and assessing their suitability before they access critical components, supply chain hazards, and physical security and natural hazards. A program that only addresses cyber does not meet the Rules, and we scope all four domains unless you already have evidenced arrangements for some of them.

Can you tell us definitively whether the Act applies to us?

We give you a documented, reasoned determination against the Act’s definitions and the Rules, which is what the regulator will want to see. We are not lawyers and the service does not include legal advice; where the determination turns on a legal question we say so and recommend you take advice. The regulator’s view of your asset remains the regulator’s.

What about the register, incident reporting and data service provider notification?

They are separate obligations that sit beside the program. We map them in the applicability work so you know which apply, and the program can reference the incident reporting process. Operating the register entries and making the reports is your responsibility; we help you define who does it and what triggers it.

How does this relate to your ISO 31000 risk management review?

The CIRMP Rules require a risk management methodology, and ISO 31000 is the guidance standard most organisations use for one. An ISO 31000 review assesses how your organisation governs risk in general; the SOCI service builds the specific program the Act requires for the asset. Entities often use the review to settle the methodology and governance, then build the program on it.

What does SOCI Act compliance support cost?

It is scoped and quoted as a fixed fee after a scoping call. The drivers are the number of assets, whether the enhanced requirements apply, the state of your existing risk management, the cyber security framework chosen and how much of the four hazard domains is already evidenced. Framework implementation, assessments and testing are quoted separately so each part is visible.

Scope and boundaries

Readiness and program support, not legal advice and not a regulator determination.

We give you a documented, reasoned determination against the Act’s definitions and the Rules, which is what the regulator will want to see. The regulator’s view of your asset remains the regulator’s, the service does not include legal advice, and operating the program, the register entries and the incident reports stays with your positions, as the Rules expect. Protected information under the SOCI Act is handled only under the arrangements agreed at scoping.

Start with the determination.

Tell us the sector, the asset you believe is captured, whether you are the responsible entity and which cyber security framework you already run. A practitioner replies with the program scope and a fixed fee; framework implementation, assessments and testing are quoted separately so each part is visible.

Where the service fits

Related Aegentra services

• ISO 31000 risk management review
• ISO 27001 consulting and implementation
• Essential Eight maturity assessment and uplift plan

Related PECB courses

• PECB ISO 31000 Risk Manager course
• PECB NIST Cybersecurity Framework Lead Implementer course

Training, implementation, internal audit and independent certification have separate scopes and fees.

The risk management methodology the Rules expect is usually settled through an ISO 31000 risk management review. Where the cyber security framework chosen is AS ISO/IEC 27001, our ISO 27001 consulting and implementation service builds the management system; where it is the Essential Eight Maturity Model, the Essential Eight maturity assessment records the level per strategy.

Where we work

Teams in Melbourne and Sydney. Delivered across all Australian states and territories, remotely or onsite by arrangement. New Zealand and Asia Pacific by arrangement.