Who Must Comply · SOCI Act stream
Owners / operators of defined CI assets
Updated 2 Sept 2026
SOCI obligations attach to the responsible entity for a defined critical infrastructure asset — not to a whole sector. Whether you're caught depends on the asset class definition in the Definitions Rules and any quantitative threshold. An independent review of the SOCI Act reported in 2026 and the Government accepted its recommendations in principle, so the perimeter is likely to widen — but nothing further had been enacted as at September 2026.
Key obligations
- Register the asset with the CISC.
- Maintain a CIRMP if in a high-risk class, and meet the enhanced requirements if in one of the nine enhanced classes.
- Comply with cyber incident reporting (12 / 72-hour windows).
- Notify the CISC of changes in direct interest holders (≥10%).
Key dates
- OngoingRegistration and incident reporting are continuous.
- AnnualCIRMP report due each financial year.
- WatchSOCI reform consultation following the 2026 independent review — proposals include bringing more asset types into scope.
Who is affected
- Responsible entities for the defined CI asset classes across the 11 SOCI sectors.
- Direct interest holders ≥10%.
- Operational service providers materially involved in running the asset.