Assess · Critical infrastructure
SOCI Act readiness across every material hazard.
If you are the responsible entity for a critical infrastructure asset covered by the risk management program rules, the SOCI Act requires a written program that covers every material hazard, with specific rules for cyber and information security, personnel, supply chain, and physical and natural hazards. You also give an annual report on the program, approved by your board, and report cyber incidents within set times. We assess the program you have against the rules, including the enhanced rules in force since 10 June 2026, and ground the cyber hazard in a framework the rules name.
Scope agreed in writing before any work. No obligation.
Three positions critical-infrastructure operators are in.
Newly captured by the regime
Successive amendments have expanded the asset classes the SOCI Act covers, and you may be a responsible entity without having built for it. The first task is confirming exactly which obligations apply to you, before assuming the worst or the least.
A CIRMP that needs proving
You have a risk management program on paper, but it has not been tested against the hazards the rules name, and the annual report your board must approve is due within 90 days after 30 June. You need to know the program holds before the board approves that report.
Cyber hazard maturity in question
The rules require the cyber hazard to be met through a framework they name or an equivalent, such as the Essential Eight at maturity level one, or level two for the nine asset classes under the enhanced rules. You need an honest read of where you sit against that bar.
The method
How we read you against the SOCI obligations.
Obligations confirmed first
Before any assessment, we establish which of your assets are captured, which obligations attach, and whether the enhanced obligations for systems of national significance apply. Scoping the duty correctly is half the value.
Every material hazard, not just cyber
The program is reviewed across cyber and information security, personnel, supply chain, and physical and natural hazards, because the rules treat them as one program and so should you. For the nine asset classes under the enhanced rules, the review adds credential compromise and lateral movement.
Cyber hazard on a recognised baseline
The rules require the cyber hazard to be met through a framework they name (AS ISO/IEC 27001, the Essential Eight, the NIST CSF, the C2M2 or the AESCSF, some at a stated level) or an equivalent. We assess that domain against the Essential Eight, at maturity level one or, for the nine asset classes under the enhanced rules, level two, so the cyber posture is measured, not asserted.
Ready for incident reports and the annual report
We test your readiness against the mandatory incident-reporting timeframes and prepare the annual report your board approves, so the obligations that carry the sharpest consequences are the ones you are most ready for.
What you are commissioning
The program and its cyber foundation.
This page is backed by two named engagements from the Assess track: a readiness review of your Critical Infrastructure Risk Management Program, and the Essential Eight maturity assessment that grounds its cyber hazard domain. Each is scoped on its own.
Assess trackTypically 3–5 weeks
SOCI Risk Management Program Readiness
Stand up the risk management program the SOCI Act requires, covering every material hazard.
Best for responsible entities for assets covered by the SOCI Act.
Includes
- Your obligations confirmed: which assets are covered, and whether enhanced obligations for systems of national significance apply
- A critical infrastructure risk management program reviewed across cyber and information security, personnel, supply chain, and physical and natural hazards
- Cyber hazard assessed against the Essential Eight, at maturity level one or, for the nine asset classes under the enhanced rules, level two
- Incident-reporting readiness against the mandatory 12-hour and 72-hour timeframes
Deliverables
Assess trackTypically 2–3 weeks
Essential Eight Maturity Assessment
Know your Essential Eight maturity level, and what it takes to reach the next one.
Best for Australian teams holding themselves to the ACSC baseline.
Includes
- Each of the eight mitigation strategies assessed against the ACSC Maturity Model, scored Maturity Level Zero to Three
- Evidence-based review across application control, patching, macro settings, application hardening, administrative privileges, MFA, and backups
- Alignment to the broader ACSC Information Security Manual where it applies to you
- A clear path to the target maturity level you actually need, not Level Three for its own sake
Deliverables
The foundation
A program is only as sound as its cyber hazard.
The risk management program spans every material hazard, and cyber is the one the rules tie to a named framework. We ground it in a baseline you can evidence.
- 1The CIRMP review reads every material hazard, typically in three to five weeks
- 2The Essential Eight assessment scores the cyber hazard on the ACSC maturity model
- 3Both resolve into one register and an annual report ready for board approval
Questions
What teams ask about this engagement.
How do we know if the SOCI Act even applies to us?
That is the first thing we establish. The Act covers defined asset classes across the critical-infrastructure sectors, and the obligations that attach, from the risk-management program to enhanced duties for systems of national significance, depend on which class you fall in. We confirm your status before assessing against duties you may not carry.
What is a CIRMP?
The critical infrastructure risk management program: a written program the responsible entity adopts, complies with, reviews and keeps up to date, identifying each hazard with a material risk to the asset and minimising it. The rules set specific requirements for cyber and information security, personnel, supply chain, and physical and natural hazards. Within 90 days of the end of the financial year the entity gives an annual report on the program, approved by its board if it has one.
What changed on 10 June 2026?
The Enhanced CIRMP Rules (LIN 26/075) commenced on 10 June 2026 for nine asset classes: broadcasting, domain name systems, electricity, energy market operators, freight infrastructure, freight services, gas, liquid fuel and water. They raise the cyber framework bar (the Essential Eight at maturity level two, AS ISO/IEC 27001:2023, NIST CSF 2.0, C2M2 version 2.1 at MIL2 or the 2023 AESCSF at SP2), add credential compromise and lateral movement as hazards, and add further requirements for personnel, supply chain and physical security. Assets already covered have until 10 June 2027 for some requirements and 10 June 2028 for the rest. We assess against the enhanced rules where they apply to you.
Why pair this with an Essential Eight assessment?
Because the rules require the cyber hazard to be met through a framework they name, and the Essential Eight is one of them: maturity level one, or level two for the nine asset classes under the enhanced rules. Grounding the cyber hazard in a scored maturity assessment turns an assertion in the program into evidence behind it.
What are the incident-reporting obligations?
Critical infrastructure assets carry mandatory cyber-incident reporting to the Australian Government, with a 12-hour timeframe for incidents having a significant impact and 72 hours for a relevant impact. We test that you can actually meet those clocks, not just that a policy names them.
Do you also handle IRAP or government assessments?
Where your obligations extend to the Information Security Manual, we assess against it, and we scope and prepare you for an IRAP assessment where one is required. The formal IRAP assessment itself is conducted by an endorsed assessor, the same separation of builder and judge we keep everywhere.
Scope it before you commit to it.
One conversation, then the scope and the price in writing. Your enquiry arrives already marked for soci & critical infrastructure.