What is the SOCI Act?

The risk management program rules under the SOCI Act changed on 10 June 2026. Nine asset classes now carry enhanced requirements, due on 10 June 2027 and 10 June 2028. Every section number below comes from the Act as compiled on 4 June 2026 (compilation 9), the CIRMP Rules as compiled on 10 June 2026 (compilation 2) and the Application Rules as compiled on 4 April 2025 (compilation 1).

The error repeated most often is about the board. Two of the explainers read for this guide say the board approves the risk management program. The Act asks for something narrower and more useful: the board, council or other governing body approves the annual report on the program (s30AG(2)(f)), and that report states whether the program was up to date at the end of the financial year. No provision requires the board to approve the program itself.

Three terms carry the rest. A responsible entity is the business the Act holds to account for an asset, defined class by class in s12L; for a water utility, it is the utility that holds the licence to provide the service. A relevant impact is a direct or indirect impact on the availability, integrity or reliability of the asset, or on the confidentiality of information about it or stored in it (s8G(2)). A CIRMP is the critical infrastructure risk management program, the written program Part 2A requires.

Why the SOCI Act matters

The Act's object is "to provide a framework for managing risks relating to critical infrastructure" (s3), and the framework reaches further than its title suggests. Section 8D lists eleven sectors, from communications and energy to food and grocery and defence industry. Section 9(1) defines 22 classes of critical infrastructure asset across them, and the Minister can declare more (s51).

Within each class, the Act binds more than the operator. A direct interest holder, an entity that with its associates holds 10% or more of the asset or can influence or control it (s8(1)), gives interest and control information to the register. A provider that stores or processes business critical data for a responsible entity on a commercial basis must be told so (s12F(3)). Business critical data includes personal information about at least 20,000 individuals and "information relating to risk management and business continuity (however described)" about the asset (s5), so the program and the continuity plans count. And since 20 December 2024, the entity's own data storage system holding that data can be part of the asset itself (s9(7)).

The government's hand is heavier than in most compliance regimes. The Minister can direct an entity where there is a risk of an act or omission prejudicial to security, and the direction prevails over an inconsistent program (ss32 and 35AAA). In a serious incident, the Minister can authorise the Secretary of Home Affairs to give information-gathering and action directions and, for a cyber incident, to request intervention by the Australian Signals Directorate (ASD) (ss35AA and 35AB). Since 20 December 2024, an official who finds a serious deficiency in a program can direct the entity to vary it (s30AI).

The regulator's posture is moving too. The independent review tabled on 24 March 2026 recommended that the Cyber and Infrastructure Security Centre (CISC), the regulator inside Home Affairs, "move from a 'light touch' compliance approach with a focus on administration and documentation to that of a penalty-based risk management process with the real enforcement of penalties". CISC's regulatory philosophy, updated on 24 September 2026, now says it will "escalate proportionately and deploy enforcement when necessary", including "the issuing of infringement notices as required".

Penalties are set in penalty units: 50 for each register filing and incident report, 150 for the annual report, 200 for each program duty, 250 for a direction to vary a program, and 1,500 for the telecommunications security duty. A court can order a body corporate to pay up to five times the specified amount (Regulatory Powers Act s82(5)), and a duty with a deadline is contravened again on each day after it passes (s93).

The last reason to read a current guide is that the duties keep moving. They changed in December 2024, April 2025 and June 2026, and a consultation on 21 further reforms closed on 31 July 2026.

The outlined cards are the dates duties fell due for assets covered when each rule began. The two sand cards are the review and the consultation, and nothing in them binds anyone yet. For the Australian obligations that sit beside this Act, from APRA's standards to the Privacy Act, see Alvor for Australian organisations.

How the SOCI Act works, step by step

The Act is a set of duties that attach to an asset class. The first job is classification, because whether an asset carries the register, incident reporting or a program is decided by rules made under the Act, class by class. Then come the standing duties, and then the program.

What the Act asks, and of whom

CISC calls the register, incident reporting and the risk management program the three positive security obligations. Narrower duties sit above them and two universal ones below, and the government's powers sit beside all of it.

Which asset classes carry which duty

Two instruments decide the matrix. The Application Rules (LIN 22/026) specify the classes that carry the register (s4) and incident reporting (s5). The CIRMP Rules (LIN 23/006) specify the classes that carry the program (s4) and, since 10 June 2026, the enhanced requirements (s4A). The four classes the Act covered in 2018, electricity, gas, water and ports, stay on the register through s18A(1)(c).

Three rows surprise readers. Banks, insurers and superannuation funds whose assets are critical infrastructure assets report cyber incidents under Part 2B, but the rules specify them for neither the register nor the program. Their operational risk and information security are governed by APRA's CPS 230 and CPS 234, and What is APRA CPS 230? covers the first. Every critical hospital carries the register and incident reporting, but only the hospitals named in Schedule 1 of the CIRMP Rules carry a program. And data storage or processing assets carry all three positive security obligations but not the enhanced requirements; the physical security rules for data centres walk through what section 11 of the CIRMP Rules asks of them.

A newly covered asset gets three months before incident reporting applies and six months before the register and the program (Application Rules ss4(3) and 5(5); CIRMP Rules s4(2)), and 12 and 24 months for the two enhanced groups (s4A(6)).

The ten steps

Run in order, the duties make ten steps. Each one names the section behind it and leaves a dated record.

Reporting a cyber incident within 12 or 72 hours

Once a responsible entity is aware of a cyber security incident (s12M), a single test decides which clock runs. The 12-hour clock in s30BC applies to an incident that has occurred or is occurring and has had, or is having, a significant impact on the availability of the asset. Section 30BEA defines significant impact tightly: it exists "if, and only if" the asset is used to provide essential goods or services and the incident has materially disrupted their availability, or circumstances in the rules exist. The 12-hour clock is about essential services going down. It is not a severity rating.

Every other incident that has occurred, is occurring or is imminent, and has had, is having or is likely to have a relevant impact on the asset, runs on the 72-hour clock in s30BD. A report can be made orally, with a written record in the approved form to follow. An entity that complies in good faith is protected from actions for damages, and so are its officers and contracted service providers (s30BE).

One neighbouring clock sits in a different Act. Under the Cyber Security Act 2024, the responsible entity for an asset to which Part 2B applies is a reporting business entity whatever its turnover (s26(2)(b)), and must report a ransomware payment within 72 hours of making it or becoming aware it was made (s27(1)).

What a critical infrastructure risk management program contains

Section 30AH(1) gives the program one purpose in three verbs: identify each hazard where there is a material risk that it could have a relevant impact on the asset; so far as reasonably practicable, minimise or eliminate that risk; and so far as reasonably practicable, mitigate the relevant impact. In judging material risk, the entity has regard to the likelihood of the hazard and its relevant impact (s30AH(7)).

The CIRMP Rules turn that purpose into five sets of requirements. Section 6 says what material risk includes, from a stoppage for an unmanageable period to interference with operational technology such as SCADA, sensitive operational information held outside Australia, and remote access to control systems. Section 7 is the all-hazards section: operational context, material risks, interdependencies with other assets, a risk methodology and the responsible positions. Then come four hazard sections: cyber and information security (s8), personnel (s9), supply chain (s10), and physical security and natural hazards (s11).

Three defined terms carry those sections. A critical component is a part of the asset whose absence, damage or compromise would prevent its proper function or could cause significant damage. A critical worker is an employee, intern, contractor or subcontractor whose absence or compromise would do the same, and who has access to or control of a critical component (s5). A major supplier is any vendor whose product or service gives it a significant influence over the asset's security (Rules s3).

For the nine enhanced classes, sections 6 and 8 to 11 each gained an enhanced partner on 10 June 2026 (ss6A, 8A, 9A, 10A and 11A); the all-hazards section in s7 has none. Where a baseline and an enhanced requirement conflict, the enhanced one prevails (Rules s4A(4)). Two further sections, ss8B and 8C, are new hazard vectors. Credential compromise (s8B) applies only where the chosen framework does not require phishing-resistant multi-factor authentication (MFA). It covers access to internet-connected computers and critical systems, privileged and unprivileged access to critical components, and remote access. Implementing phishing-resistant MFA across all of that, with successful and unsuccessful attempts centrally logged, monitored and routinely reviewed, is taken to discharge the risk. Lateral movement (s8C) asks for an inventory of critical systems and how they connect, and the ability to recover them while keeping the asset available. Segregation that meets six listed elements is taken to discharge it, and one of the six is hard: critical systems that keep operating for at least three months while other computers are restored.

Running the program is four more duties: comply with it (s30AD), review it on a regular basis (s30AE), keep it up to date (s30AF), and give an annual report within 90 days after the end of the financial year (s30AG). The report states whether the program was up to date, evaluates any hazard that had a significant relevant impact during the year, and is approved by the board, council or other governing body. It goes to the relevant Commonwealth regulator where one has security functions for the asset (the Reserve Bank, for payment systems), and otherwise to the Secretary. For a 30 June year end the window closes on 28 September, and the report is not admissible against the entity in civil penalty proceedings (s30AG(3)).

The cyber framework a program must follow

Within 12 months after its grace period ends, an entity must comply with one of five documents listed in Rules s8(4), at the condition each one carries, or with a framework equivalent to one of them (s8(5)). For assets covered when the rules began, that date was 17 August 2024. The nine enhanced classes have a second list in s8A(3), with newer editions and higher conditions, due by 10 June 2028 for assets already covered.

Three details decide most programs. The equivalence route is narrower on the enhanced list: s8A(4) accepts a framework that achieves a level of security equivalent to the Essential Eight at maturity level two, the C2M2 at MIL2 or the AESCSF at SP-2, so equivalence cannot be argued against AS ISO/IEC 27001:2023 or NIST CSF 2.0. The rules write "AS ISO/IEC 27001:2023", while Standards Australia publishes the standard as AS/NZS ISO/IEC 27001:2023 (15 September 2023), its identical adoption of ISO/IEC 27001:2022; the rules ask for compliance with it, not certification. And ASD's Information Security Manual is on neither list. On the baseline list an entity can argue it is equivalent to any of the five (s8(5)); for an enhanced asset, the entity has to show it is equivalent to one of those three frameworks at its level (s8A(4)).

The Act lets the rules incorporate these documents as in force from time to time (ss30AN(3) and 30ANA), so check which edition of the Essential Eight Maturity Model ASD publishes when you assess. The Essential Eight page covers the maturity model and ASD's planned successor, and the ISO 27001 page covers the standard.

Systems of national significance

The Minister can declare a critical infrastructure asset a system of national significance, having regard to the consequences of a hazard for social or economic stability, defence or national security, and to its interdependencies (s52B). The entity gets notice and a chance to make submissions first (s52C), and the Act's outline describes the declaration as private (s4).

A declared system can then be required, by notice, to carry the four enhanced cyber security obligations in Part 2C: an incident response plan with a copy to the Secretary (ss30CB to 30CH), a cyber security exercise on at least 30 days' notice (ss30CM and 30CN), a vulnerability assessment (s30CU), and system information reports to ASD, or software that produces them (ss30DB, 30DC and 30DJ). The July 2026 consultation paper proposes replacing the plan with asset-specific resilience planning and repealing the system information obligation. That is a proposal.

A worked example: a regional water utility's year under the SOCI Act

Kestrel Valley Water is a regional water corporation in Victoria with about 410 staff. It supplies 148,000 water connections and 131,000 sewerage connections across 22 towns. The names and figures are fictional; the sections are not.

The asset and its duties. Its water and sewerage networks are one critical water asset, because a single water utility manages them and they serve more than 100,000 connections (s5). The utility holds the licence, so it is the responsible entity (s12L(9)). Water was one of the four classes in 2018, so the register applies through s18A(1)(c), incident reporting through Application Rules s5(1)(t), the program through CIRMP Rules s4(1)(m), and since 10 June 2026 the enhanced requirements through s4A(1)(i). Its customer billing database, run in its own data centre, holds personal information about some 210,000 customers, which is business critical data. Section 9(7) makes the billing system part of the asset because all four of its conditions hold: the utility operates it, it is used in connection with the water asset, it holds business critical data, and there is a material risk that a hazard affecting it could have a relevant impact on the asset, because it sits on the corporate domain that links into the SCADA historian.

The history. The program was adopted by 17 August 2023, and the Essential Eight at maturity level one was met by 17 August 2024 under s8(4) item 2.

A natural hazard. From 18 to 22 February 2026, river flooding cut the raw water intake at the Ashby treatment plant for 41 hours and inundated sewage pump station SPS-07. Supply held from treated storage, and two towns ran on restrictions for two days. The program was varied in April 2026: a second intake pump, and the SPS-07 control panel raised above the flood level.

The enhanced rules arrive. Twenty days after they commenced, the utility's risk and compliance lead dated a gap analysis against each enhanced section. Three items fall due on 10 June 2027 and six on 10 June 2028.

The framework choice came first. The utility chose the Essential Eight at maturity level two over AS ISO/IEC 27001:2023, because its corporate IT is already assessed against the Essential Eight. That choice also decides whether s8B applies, since credential compromise is a hazard only where the chosen framework does not require phishing-resistant MFA, so the program records the answer. For s10A, chlorine became the first entry on the supply chain map: seven days of it are stored on site, so its maximum acceptable outage (Rules s3) is seven days.

A register change. On Wednesday 1 July 2026 Tamar Process Services began a new operations and maintenance contract for the Ashby wastewater treatment plant. Who operates part of the asset is operational information (s7(1)(e)), so the change was a notifiable event (s26), and the update was filed on Tuesday 21 July, inside the 30 days s24(2) allows.

A provider notice. A hosted document management service, holding the program and the continuity plans, went live on Tuesday 14 July 2026. Those documents are information relating to risk management and business continuity, which makes them business critical data, and the utility wrote to the provider that week under s12F(3).

An incident. At 06:40 on Monday 3 August 2026 the utility's security operations provider confirmed ransomware encrypting the billing and customer contact servers. At 07:05 the operational technology (OT) team cut the historian's link to the corporate domain under the incident plan, and the SCADA system ran on. That link was the path into the critical systems, and the map drawn for the s8C gap shows it.

Water and sewerage services were never disrupted, so the impact on availability was not significant in the s30BEA sense and the 12-hour clock never started. The billing system is part of the asset, and its integrity and availability were hit. That is a relevant impact, so the 72-hour clock in s30BD did start. The incident manager reported orally to ASD's Australian Cyber Security Centre (ACSC) at 11:15 on Monday and lodged the written record at 16:30 on Tuesday, inside the 48 hours s30BD(3) allows after an oral report. No ransom was paid, so the Cyber Security Act's ransomware payment report never arose.

The historian link became the first item in the s8C plan. Cutting it on the day was an incident response. Keeping it cut, and proving the OT network can run for three months while corporate IT recovers, is the program's work for the next 22 months.

The annual report. The Board approved the report for 2025-26 on Wednesday 2 September 2026, and it was given to the Secretary on Friday 18 September, ten days inside the 28 September limit. It states that the program was up to date at 30 June 2026, carries the flood with its evaluation and the April variation, and records that no s30AI direction was given. Every line in it could be checked against the review record and the dated variation before the Board approved it.

The ransomware incident falls in the 2026-27 year and will be weighed for the report due on 28 September 2027, alongside a gap plan of nine items against two deadlines.

Common mistakes

Most errors come from reading an explainer instead of the instrument. The expensive ones now are the board-approval error, the maturity level one assumption for enhanced assets, and treating "a recognised framework" as any framework.

1. Saying the board approves the program. The board, council or other governing body approves the annual report, which states whether the program was up to date at 30 June (s30AG(2)(c) and (f)). Give the board what it needs to stand behind that statement: the review record, the variations, and the hazards that struck during the year.
2. Writing the program as four hazard chapters. The Act asks for every hazard with a material risk (s30AH(1)(b)(i)), the rules start with an all-hazards section (s7), and nine classes gained two new vectors on 10 June 2026 (ss8B and 8C). Start from the operational context and the material risks, then write the specific sections.
3. Treating "a recognised framework" as any framework. The rules name five documents, each with a condition, or an equivalent, and the ISM is on neither list (ss8(4), 8(5), 8A(3) and 8A(4)). Name the framework and its level in the program, and if you claim equivalence, record the comparison.
4. Stopping at maturity level one. For the nine enhanced classes the condition is maturity level two, MIL2 or SP-2, by 10 June 2028 (s8A(3)). Plan the uplift now: the 24-month window has to hold procurement, outage windows and an assessment.
5. Reporting everything at 72 hours, or reading 12 hours as "high severity". The 12-hour clock turns on a material disruption to essential goods or services (s30BEA). Decide the test, the decision-maker and who calls ASD before an incident.
6. Filing the register once. A new operator, a new 10% investor or a new chief executive makes earlier information incorrect, and the update is due within 30 days (ss24, 26 and 7(1)). Tie contract, ownership and executive changes to a register check.
7. Forgetting the data. Your own data storage systems holding business critical data can be part of the asset (s9(7)), and an outside provider storing that data must be told (s12F(3)), including a provider holding your program. List those systems and providers, and date each notice.
8. Reading the reform proposals as law. The consultation paper says its proposals "are not yet law", including the 500 penalty unit maximum, independent assurance of programs and a "relevant operator" duty for outsourced operators. Build to the compiled Act and rules, and track the reform separately.

The SOCI Act compared with its neighbours

One test separates the SOCI Act from its neighbours: what makes each one bind you. The SOCI Act binds because of the asset you hold, APRA's standards because of the licence you hold, the ransomware payment report because of your turnover or your asset, and a framework because you chose it.

The ISM page and the NIST CSF page cover those two in their own right.

Standards and references

Security of Critical Infrastructure Act 2018, compilation 9 (4 June 2026). Law. Read s5 for the definitions, s9 for the asset classes, s12F for data storage providers, Parts 2, 2A and 2B for the positive security obligations, Part 2C for systems of national significance, and Parts 3 and 3A for the government's powers.

CIRMP Rules (LIN 23/006), compilation 2 (10 June 2026). Law. Read s4 and s4A for the classes and deadlines, ss6 and 6A for material risks, s7 for the all-hazards section, ss8 and 8A for the framework lists, ss8B and 8C for the new hazard vectors, and ss9 to 11A for the other hazards.

Enhanced CIRMP Rules (LIN 26/075), commenced 10 June 2026, with the Explanatory Statement. Law and explanation. The amending instrument behind every enhanced requirement; the Explanatory Statement names AI and post-quantum cryptography as examples of emerging technology.

Application Rules (LIN 22/026), compilation 1 (4 April 2025). Law. Section 4 lists the classes on the register and s5 the classes that report incidents.

Enhanced Response and Prevention Act 2024 (most schedules commenced 20 December 2024, Schedule 5 on 4 April 2025). Law. Data storage systems as part of the asset, serious incident powers, directions to vary a program, and telecommunications security.

Cyber Security Act 2024, ss26 and 27. Law. The ransomware payment report.

CISC, the SOCI Act page and the regulatory philosophy (both updated 24 September 2026), the enhanced CIRMP factsheet, and the s12F(3) factsheet. Guidance. The regulator's reading, its enforcement posture, the reporting periods, and a worked notice to a cloud storage provider.

Independent Review of the SOCI Act (Dr Jill Slay AM, tabled 24 March 2026) and the Home Affairs consultation paper (July 2026, closed 31 July 2026). Proposals. The review's six recommendations, accepted in principle, and the 21 reform measures. Neither changes the law on its own.

How Alvor helps

With Alvor, a responsible entity can keep the record each SOCI duty produces in one place, and show the board or the regulator the dated record behind the annual report.

You can add the SOCI obligations in Alvor with the framework builder: the Act's sections and the CIRMP Rules go into Compliance in their own wording, with owners and evidence against each requirement. For the cyber framework, the Essential Eight (every strategy at maturity levels one, two and three), ISO 27001:2022 (the text Standards Australia adopts as AS/NZS ISO/IEC 27001:2023) and NIST CSF 2.0 install from the framework library with their official text, and the C2M2 or the AESCSF go in through the framework builder. Evidence is uploaded or linked once, carries a valid-until date, and is reused across the controls it supports. Automated configuration checks against AWS, Okta, Entra ID, GitHub and GitLab set control status from per-resource findings.

The program's risks live in Risk Management. Each risk is scored on likelihood and impact from 1 to 5 against criteria you set, which is the record s30AH(7) asks you to have regard to, and gets a verdict against appetite. An accepted risk carries its conditions, scope and expiry. Continuity findings can be escalated onto the same register, and a design signed off with conditions in Secure by Design raises a linked risk.

The inventory s8C asks for lives in Asset Management. Every asset records its upstream and downstream dependencies on other assets, each with a criticality, so the historian and the corporate domain sit on one map with the link between them. Assets carry end-of-life and end-of-support dates, which puts the telemetry units in Kestrel Valley Water's s8A(2)(b) row on one filtered list. Each asset's data record holds its classification and geographic scope, which is where a team writes down where business critical data and sensitive operational information sit.

Major suppliers run through Third-Party Risk Management. A requester's intake gets a tier from a fixed scoring rule, and the tier sets the reassessment cadence. The vendor answers one questionnaire in the external portal, an analyst scores it, findings carry deadlines, and a named person decides on the residual risk. Vendor contracts record the incident notification hours, and a contract can be recorded as a data processing agreement. That is the record behind the s10(2) list of major suppliers and the s10A(4) assessment of each.

Recovery sits in Business Continuity. Each process's approved business impact analysis sets its tier, maximum tolerable period of disruption, RTO and RPO; plans take the strictest objectives from the processes they cover, and each asset shows the strictest objectives of the processes that depend on it. Exercises run from tabletop to full failover and record the achieved RTO and RPO. That is the record behind recovering critical systems and keeping the asset available while they are rebuilt (s8C(2)).

Security Management produces a board pack with the programs, current and target maturity, the top gaps and KPI status, so the board that approves the annual report sees the program it is reporting on. History is hash-chained, so the dates on reviews and variations (ss30AE and 30AF) stand up later.

Alvor runs as a dedicated single-tenant instance in the Sydney region (ap-southeast-2), on your own servers, or air-gapped, so the program and the data about your critical systems stay where your own material risk assessment says they should (regulated and sovereign environments). The AI Assistant is bring-your-own-model, including self-hosted models through vLLM, Ollama or any OpenAI-compatible endpoint, and a person accepts or rejects every change it proposes.

For the program itself, Alvor Advisory runs a SOCI Risk Management Program Readiness review, which confirms which assets are captured and which obligations attach, reviews the program against the rules including the enhanced requirements, and tests readiness against the 12 and 72 hour reporting times. An Essential Eight Maturity Assessment scores the cyber framework.