Assess · Critical infrastructure
If you are a responsible entity for a critical infrastructure asset, the SOCI Act requires a risk-management program that addresses cyber, physical, personnel, and supply-chain hazards, with annual board sign-off and mandatory incident reporting. We assess the program you have against the program the Act expects, and ground the cyber domain in a recognised ACSC baseline.
Scope agreed in writing before any work. No obligation.
Successive amendments have expanded the asset classes the SOCI Act covers, and you may be a responsible entity without having built for it. The first task is confirming exactly which obligations apply to you, before assuming the worst or the least.
You have a risk-management program on paper, but it has not been tested against the four hazard domains the rules require, and the annual board attestation is approaching. You need to know it holds before you sign it.
The rules contemplate meeting the cyber hazard through a recognised framework, and you need an honest read of where your Essential Eight or ISM maturity actually sits against that bar.
The method
Before any assessment, we establish which of your assets are captured, which obligations attach, and whether the enhanced obligations for systems of national significance apply. Scoping the duty correctly is half the value.
The Critical Infrastructure Risk Management Program is reviewed across the cyber and information-security, physical and natural, personnel, and supply-chain hazard domains, because the rules treat them as one program and so should you.
The rules contemplate addressing the cyber hazard through an established framework. We assess that domain against the ACSC Essential Eight, or the broader Information Security Manual where it applies, so the cyber posture is measured, not asserted.
We test your readiness against the mandatory incident-reporting timeframes and prepare the program for its annual board attestation, so the obligations that carry the sharpest consequences are the ones you are most ready for.
What you are commissioning
This page is backed by two named engagements from the Assess track: a readiness review of your Critical Infrastructure Risk Management Program, and the Essential Eight maturity assessment that grounds its cyber hazard domain. Each is scoped on its own.
Assess trackTypically 3–5 weeks
Stand up the risk-management program the SOCI Act requires, across all four hazard domains.
Best for responsible entities for assets covered by the SOCI Act.
Includes
Deliverables
Assess trackTypically 2–3 weeks
Know your Essential Eight maturity level, and what it takes to reach the next one.
Best for Australian teams holding themselves to the ACSC baseline.
Includes
Deliverables
The foundation
The risk-management program spans four domains, but cyber is where most operators carry the most exposure and the most scrutiny. We ground it in a baseline you can evidence.
Questions
That is the first thing we establish. The Act covers defined asset classes across the critical-infrastructure sectors, and the obligations that attach, from the risk-management program to enhanced duties for systems of national significance, depend on which class you fall in. We confirm your status before assessing against duties you may not carry.
The Critical Infrastructure Risk Management Program: the program the rules require responsible entities to adopt and maintain, identifying and mitigating material risks across four hazard domains, cyber and information security, physical and natural, personnel, and supply chain, with annual board approval.
Because the cyber hazard domain has to be met against a recognised standard, and the Essential Eight is the baseline most Australian operators reach for. Grounding the cyber domain in a scored maturity assessment turns an assertion in the program into evidence behind it.
Critical infrastructure assets carry mandatory cyber-incident reporting to the Australian Government, with a 12-hour timeframe for incidents having a significant impact and 72 hours for a relevant impact. We test that you can actually meet those clocks, not just that a policy names them.
Where your obligations extend to the Information Security Manual, we assess against it, and we scope and prepare you for an IRAP assessment where one is required. The formal IRAP assessment itself is conducted by an endorsed assessor, the same separation of builder and judge we keep everywhere.
One conversation, then the scope and the price in writing. Your enquiry arrives already marked for soci & critical infrastructure.