A data centre that the SOCI Act captures as a critical data storage or processing asset has to run a critical infrastructure risk management program, and section 11 of the CIRMP Rules is that program's physical security rule. The enhanced rules that commenced on 10 June 2026 did not add data centres to their list. They can still reach one, by declaration or through a customer's own systems, and an operator should know which applies before it plans the next two years.
Section numbers below are from the Security of Critical Infrastructure Act 2018 as compiled on 4 June 2026 and the CIRMP Rules (LIN 23/006) as compiled on 10 June 2026. For the Act's other duties and its general definitions, read What is the SOCI Act? first; this post stays with physical security.
When a data centre is a critical data storage or processing asset
The SOCI Act defines a data storage or processing service in s 5 as a commercial service that lets end-users store or back up data, a commercial data processing service using one or more computers, or a service the rules specify. A provider is an entity that provides one. Section 12F then decides which of a provider's assets are critical.
- 1Owned or operated by a data storage or processing providerSections 5 and 12F(1)
The entity provides a commercial data storage, backup or processing service. Whether space, power and cooling alone is such a service is the open question below.
- 2Used wholly or primarily for a service relating to business critical dataSection 12F(1)
Business critical data is personal information about at least 20,000 individuals, or information about a critical infrastructure asset's research and development, operating systems, operation, or risk management and business continuity.
- 3For the right end-userSection 12F(1) and (2)
A Commonwealth, State or Territory end-user, or a body corporate established under their laws (s 12F(1)); or the responsible entity for another critical infrastructure asset (s 12F(2)).
- 4The provider knowsSection 12F(3)
A responsible entity must take reasonable steps to tell its provider, as soon as practicable, that the service relates to business critical data. That notice is usually how the provider comes to know.
- 5Not another class of critical infrastructure assetSection 12F(1)
If the asset already falls in a different class, that class's rules apply instead.
Two words in that test do most of the work. "Wholly or primarily" looks at what the asset is mainly used for, so a facility whose main use is private hosting stands differently from one built for government customers; what counts as "the asset", a whole facility or one hall, is part of the legal question below. And "knows" means a provider can be outside the class until a customer's s 12F(3) notice arrives, then inside it from that day. Keep every s 12F(3) notice with the date it arrived: the program's six-month grace period runs from the day the asset became a critical infrastructure asset (CIRMP Rules s 4(2)).
What CIRMP section 11 requires
The CIRMP Rules, which commenced on 17 February 2023, apply Part 2A of the Act to 13 asset classes, and a critical data storage or processing asset is one of them (s 4(1)(c)). Section 11 is the physical security and natural hazards section. Subsection (1) asks for a process or system in the program for five things.
| Paragraph | What the rule asks for | What to show in a data centre |
|---|---|---|
| s 11(1)(a) | Identify the physical critical components of the asset | A dated list of halls, plant, security systems and pathways whose loss would stop the facility working |
| s 11(1)(b) | As far as reasonably practicable, minimise or eliminate the material risk, and mitigate the relevant impact, of a physical security hazard on a physical critical component and of a natural hazard on the asset | A hazard register naming each hazard, the component it reaches, and the measure in place |
| s 11(1)(c) | Respond to incidents where unauthorised access to a physical critical component occurs | A response procedure, who runs it, and records of its use |
| s 11(1)(d) | Control access to physical critical components, including restricting it to critical workers or accompanied visitors | Access lists, escort rules and the reviews that keep them current |
| s 11(1)(e) | Test that the security arrangements are effective and appropriate to detect, delay, deter, respond to and recover from a breach | A test plan and dated results for each of the five |
Subsection 11(2) lists what the entity must have regard to: whether the program describes the asset's critical components, the physical security hazards that could have a relevant impact on them, the security arrangements, and the natural hazards. Write those four descriptions into the program itself rather than leaving them in separate site documents, because they are what anyone reviewing the program reads first.
The rules define both hazards. A physical security hazard "includes the unauthorised access to, interference with, or control of CI assets, to compromise the proper function of the asset or cause significant damage to the asset". A natural hazard "includes fire, flood, cyclone, storm, heatwave, earthquake, tsunami, space weather or biological health hazard (such as a pandemic)".
Physical critical components
The rules leave the list to the entity. In a data centre, the components whose absence would stop the facility working sit mostly outside the data halls: power and generators, cooling, fuel, the meet-me room, the risers that carry cabling between floors, and the security control room that monitors everything else. A program that lists only the halls misses where a single breach does the most damage. The audit checklist groups these as "plant and pathways" for that reason.
Access for critical workers and accompanied visitors
Section 11(1)(d) restricts access to physical critical components to critical workers or accompanied visitors. A critical worker, defined in s 5 of the Act, is an employee, intern, contractor or subcontractor whose absence or compromise would prevent the proper function of the asset or could cause significant damage to it, and who has access to, or control of, a critical component.
That definition sorts a data centre's population cleanly. The facility engineers, the security officers in the control room and the generator maintenance contractor are likely critical workers. A tenant's engineer is not the operator's worker, so wherever the tenant's route crosses a physical critical component, such as a riser or the meet-me room, the program needs an escort rule. How tenant access to their own racks is treated is a design decision to record in the program, since the rules do not settle it.
Natural hazards
The rule asks the program to minimise the material risk of a natural hazard on the asset as a whole, not just on its critical components. For a data centre the list in the rules translates directly: flood reaches basement plant and fuel, heatwave reaches cooling, fire and earthquake reach the building, and a pandemic reaches the critical workers who run it. Write each one down with the component it reaches and the measure in place, because s 11(2)(d) asks whether the program describes them.
Testing the five verbs
Section 11(1)(e) is the strictest paragraph, because it asks for proof rather than description. The arrangements must be tested as effective and appropriate to detect, delay, deter, respond to and recover from a breach. Those are the same five verbs the Protective Security Policy Framework uses for its five layers of physical security, deter, detect, delay, respond and recover (PSPF Release 2026, s 23.2), so one layered design can answer both, and a data centre with government customers can test once against both.
- Walk the perimeter at night and record what a person outside can see and reach
- Trigger each alarm zone and time the alert in the control room
- Check that cameras cover every door into a critical component, and that someone watches them
- Time how long each boundary holds against a realistic attempt
- Compare that time with the measured response time
- Confirm doors into plant rooms fail secure, and record the exceptions fire safety requires
- Run an unannounced exercise from alarm to guard arrival
- Rehearse the s 11(1)(c) procedure with the people on the night roster
- Restore a failed access control head-end from backup and time it
Respond and recover are organisational capabilities. A fence cannot respond and a rack cannot recover, so those two tests are about people, rosters and procedures. Run them on night shifts and weekends, when the roster is thinnest.
Responding to unauthorised access
Section 11(1)(c) asks for a process to respond when someone reaches a physical critical component without authority. Write who is called, in what order, what is preserved for investigation, and when the customer is told. The cyber incident reporting clocks in the Act, 12 hours under s 30BC and 72 hours under s 30BD, are for cyber security incidents. A physical breach runs through this process, and any cyber security incident that follows is assessed against the reporting rules on its own terms.
When the June 2026 enhanced rules can reach a data centre
The Enhanced CIRMP Rules (LIN 26/075) were registered on 9 June 2026 and commenced on 10 June 2026. Section 4A(1) lists the nine classes that carry the enhanced requirements: broadcasting, domain name systems, electricity, energy market operator, freight infrastructure, freight services, gas, liquid fuel and water. Critical data storage or processing assets are not on the list. Commentary that describes the enhanced rules in general terms invites the opposite reading, so check the class list before you plan.
Two routes can still bring a data centre in.
- Critical data storage or processing assets are not one of the nine classes in s 4A(1)
- A captured data centre keeps the baseline rules, including s 11
- The enhanced rules apply to an asset brought under Part 2A by a s 51 declaration (s 4A(2)(b))
- Section 12 excludes declarations made before LIN 26/075 commenced
- So a data centre declared after 10 June 2026, with Part 2A applying, could be covered
- A critical infrastructure entity's own data storage system that meets s 9(7) is taken to be part of that entity's asset
- If that asset's class is one of the nine, the system is inside an enhanced asset
- A water utility's own data centre is one example
The grace periods for the enhanced requirements run 12 or 24 months depending on the provision (s 4A(6)), so an asset brought in by either route has time, but not much.
Section 11A as a benchmark
Section 11A is the enhanced version of the physical security rule. It does not apply to a data centre captured only as a critical data storage or processing asset, and it is still the best public description of what a data-centre-grade physical security plan contains.
It asks for physical security and natural hazards to be centrally managed, and for the program to outline the location, ownership and nature of the site, the critical components, and the areas that hold business critical data or contain critical components, including critical systems. It asks the entity to consider access controls that restrict critical components and critical systems to critical workers or accompanied visitors, surveillance and alarm systems that keep them under continuous monitoring, and specific measures for business hours and out of hours. And it asks for the physical consequences of every other hazard to be considered. The rules' own note gives the example of a malicious cyber incident that opens gates.
An operator that writes its program against s 11 and then checks it against s 11A has a plan that would survive a s 51 declaration without a rewrite, and a ready answer for any customer whose own asset sits in one of the nine classes.
Where an HCF Strategic certificate changes the duty
One certificate changes this whole picture. Under s 30AB(4), the CIRMP Part does not apply to an asset used to provide services covered by a Hosting Certification Framework Strategic certificate held by the responsible entity. Section 30AQ then asks for an annual report within 90 days of the end of the financial year, approved by the board where there is one. An Assured certificate has no such effect, and services outside the Strategic certificate stay under the program. The HCF guide covers the levels, the registration pause since 3 November 2025 and HCF 2.
The other SOCI obligations, briefly
The Cyber and Infrastructure Security Centre lists four obligations for the data storage or processing sector: notifying data service providers, giving information to the register, reporting cyber incidents, and adopting and complying with a CIRMP. The notification duty sits with the provider's customers under s 12F(3). Cyber incidents are reported within 12 hours for a critical incident (s 30BC) and 72 hours for other incidents (s 30BD), after the entity becomes aware. Assets declared systems of national significance may also face enhanced cyber security obligations. What is the SOCI Act? covers each of these, with the definitions behind them.
Where to start
Start with the capture question and the legal advice, then write the four descriptions s 11(2) looks for: critical components, physical security hazards, security arrangements and natural hazards. Map who reaches each critical component and how, and decide the escort rule for everyone who is not a critical worker. Then write a test plan with one dated test for each of the five verbs, and run it on a night shift.
The data centre physical security audit checklist turns that into one walk from site to rack, with the evidence to ask for at each boundary. If government customers also hold you to the PSPF, the PSPF security zones guide covers the zone they will expect. Our data centre physical security practice assesses a facility against the PSPF, the ISM, SOCI and customers' audits, designs the boundaries and prepares the evidence, and the SOCI readiness review confirms which assets are captured and which obligations attach.