Mandatory Tools & Artefacts · SOCI Act stream
Critical Infrastructure Risk Management Program
Updated 2 Sept 2026
The CIRMP is the central artefact under SOCI for high-risk asset classes. Adoption of AI in operational technology counts as a material change and must be integrated across the four hazard vectors with board-level sign-off. Since 10 June 2026 the Enhanced CIRMP Rules layer prescriptive requirements over the original principles-based program for nine high-risk asset classes, with new hazard categories for credential compromise and lateral movement, and staged implementation over 12 to 24 months.
Key obligations
- Document AI use in OT and treat it as a material risk in the CIRMP.
- Address cyber and information security (including model integrity), personnel, supply chain, and physical and natural hazards.
- Adopt an approved cyber framework (e.g. ISM, Essential Eight ML2, NIST CSF, ISO 27001, AESCSF, IEC 62443).
- If in a high-risk class, meet the enhanced requirements as well — including the credential compromise and lateral movement hazard categories.
- Apply the ASD/CISA principles for secure integration of AI in operational technology (published 4 December 2025) when AI touches OT.
- Test, review and update the CIRMP at least annually.
- Submit the annual board-approved report to the CISC.
Key dates
- 17 Aug 2024Full compliance with the 2023 CIRMP Rules required.
- 4 Dec 2025ASD/CISA principles for secure AI integration in OT published.
- 10 Jun 2026Enhanced CIRMP Rules commenced.
- 12–24 monthsEnhanced requirements phase in from commencement, depending on the requirement.
- AnnualBoard-approved report due each financial year.
Who is affected
- Responsible entities for the high-risk SOCI asset classes captured by the CIRMP Rules.
- The nine classes now subject to the enhanced rules: water, electricity, gas, liquid fuel, energy market operator, broadcasting, domain name systems, freight infrastructure and freight services.
- Operational technology vendors and integrators — expect contractual flow-down.