Source of Law / Policy · SOCI Act stream
SOCI Act 2018 + CIRMP
Regulator: Home Affairs / CISC · Legislation
The Security of Critical Infrastructure Act 2018 (SOCI) regulates defined classes of critical infrastructure asset across 11 sectors. Responsible entities for high-risk classes must maintain a Critical Infrastructure Risk Management Program (CIRMP) addressing four hazard vectors: cyber and information security, personnel, supply chain, and physical and natural hazards. The Enhanced CIRMP Rules 2026 (LIN 26/075) were registered on 9 June 2026 and commenced 10 June 2026, replacing the previous principles-based approach with prescriptive requirements for nine high-risk asset classes. AI deployed in operational technology is a material change that must be carried into the CIRMP.
Key obligations
- Confirm whether each asset crosses the SOCI definition and threshold (e.g. ≥30 MW electricity generation).
- Establish, maintain, review and comply with a written CIRMP.
- If you are in one of the nine high-risk classes, meet both the baseline and the enhanced requirements — including the new credential compromise and lateral movement hazard categories.
- Treat new AI in OT as a material risk — update the CIRMP and run hazard analysis across all four vectors.
- Submit annual CIRMP reports approved by the board (or equivalent) to the CISC.
- Notify cyber incidents within statutory timeframes (12 hours for significant incidents, 72 hours otherwise).
- Report any ransomware payment within 72 hours under the Cyber Security Act 2024 (in force since 30 May 2025) — separate from SOCI reporting.
Key dates
- 17 Aug 2024Full compliance with the 2023 CIRMP Rules required (grace period ended).
- 30 May 2025Ransomware payment reporting commenced under the Cyber Security Act 2024.
- 10 Jun 2026Enhanced CIRMP Rules commenced for nine high-risk asset classes.
- Jun 2027 / Jun 2028Enhanced requirements phase in over 12 or 24 months from commencement, depending on the requirement.
- AnnualBoard-approved CIRMP report due each financial year.
Who is affected
- Responsible entities for the defined CI asset classes — energy, water, communications, data storage and processing, transport, food and grocery, defence industry, financial services, health care, higher education and space.
- The nine enhanced classes: water, electricity, gas, liquid fuel, energy market operator, broadcasting, domain name systems, freight infrastructure and freight services.
- Direct interest holders (≥10% interest) and certain operational service providers.
- Asset thresholds matter — sub-threshold assets are not caught.