SOCI Act Readiness Self-Assessment

The Act applies to assets, not to companies. Section 9 lists the asset classes, and each has its own definition and threshold — and Rules can add or carve out specific assets. What's needed is a live mapping: every asset you own or operate, the definition it was tested against, the conclusion, and the date. Most compliance failures start here, because an asset was captured by a threshold change or an acquisition and nobody re-tested.

Different duties attach to different roles. The responsible entity (s 12L) carries the risk management program, incident reporting and annual report. A direct interest holder — broadly, someone with a 10% or greater interest, or influence or control (ss 8, 8A) — carries Register and notification duties instead. In group structures the responsible entity is often not the listed parent, and the duty ends up with an entity that has no compliance function.

Critical components are the parts of the asset whose compromise would stop it working or cause significant damage. Business critical data is defined in section 5 and includes personal information about 20,000 or more individuals, and certain research, risk-management and operational data. These two concepts drive who counts as a critical worker, which systems need segregation, and which suppliers matter — so getting them wrong distorts everything downstream.

The consultation paper proposes widening coverage: four new space asset classes, blood/pathology/laboratory functions in health, a research asset class replacing the university-based one, distributed energy and offshore electricity, broader freight nodes and logistics platforms, and an operator-facing model for data centres. If any of those describe you, you would move from unregulated to regulated when the Rules commence — with no grandfathering assumed.

Section 30AC requires a responsible entity to adopt and maintain a written program; section 30AD requires it to actually comply with that program. They are separate duties and separate contraventions. A CIRMP that sits in a document management system while the business operates differently satisfies neither. Tranche 2 proposes lifting the maximum penalty for this tier from 200 to 500 penalty units.

Section 30AG(2)(f) requires the annual report to be approved by the board, council or other governing body where one exists. In practice that pulls the CIRMP itself into board oversight, because a board cannot sensibly approve a report about a program it has never seen. Naming a single accountable executive matters too: shared ownership between security, risk and operations is a common reason nothing gets updated.

Sections 30AE and 30AF require regular review and updating so the program stays current. The Act does not currently fix an interval, which is why practice varies so widely. Tranche 2 proposes mandating review at least every 24 months and after significant incidents. A defensible position has both a calendar cycle and event triggers — material change to the asset, a significant incident, a change in ownership or threat picture.

There is no express reporting-to-board obligation beyond the annual report, but governance quality is what regulators infer capability from. A useful pack covers: obligations and whether each is met, hazards trending up or down, incidents reported and their outcomes, and deadlines approaching. If the board's only exposure to SOCI is a once-a-year approval, that is itself a finding.

Measure 15 proposes clarifying governance, review and currency obligations and introducing proportionate independent assurance over CIRMP design, implementation and effectiveness — risk-calibrated, so lower-risk entities may be able to use internal assurance. It also proposes removing the current restriction on annual reports being admissible in evidence. Decide now whether internal audit or an external provider would do this work, and what evidence they would need.

Part 2 requires reporting entities to give interest and control information and operational information for the Register (ss 23–24). The Register is not public (s 22). The common failure is assumption: an asset owner assumes the operator lodged, the operator assumes the owner did, and nothing was lodged. Confirm what was actually submitted, by which entity, and when.

Section 26 defines notifiable events — changes in interests, control, or operational information. Section 24 requires notification within set timeframes. These events are usually generated by corporate activity (a refinancing, a share transfer, a new operator) rather than by the security function, so the trigger has to live inside legal, treasury and corporate development processes, not in a security checklist.

Nothing requires an annual sweep, but drift is inevitable — directors change, shareholdings move, systems are replaced. An annual attestation alongside the CIRMP annual report is a cheap way to catch it and to demonstrate an organised approach if the Register is ever tested.

Measure 2 proposes restructuring Part 2 so the Act sets broad information categories and the Rules prescribe the actual fields, with notification triggered by prescribed change types and 'reasonable awareness' rather than by assessing whether earlier information is still accurate. Registrable information is proposed to expand to key systems, key suppliers and material dependencies — information most entities do not currently hold in a reportable form.

Section 30AH(1)(b) requires the program to identify hazards where there is a material risk that they could have a relevant impact — that is, an impact on the availability, integrity, reliability or confidentiality of the asset (s 8G). Materiality is assessed on likelihood and impact (s 30AH(7)). What gets tested is not the hazard list but the reasoning: how you decided what was material and what was not.

The Enhanced CIRMP Rules require alignment to one of five recognised frameworks: AS ISO/IEC 27001:2023, the Essential Eight Maturity Model at Maturity Level 2, NIST Cybersecurity Framework 2.0, C2M2 v2.1 at MIL2, or the 2023 AESCSF Framework Core at Security Profile 2. You pick one and meet it — you do not get to blend. Essential Eight ML2 in particular is a significant lift from ML1 for most operators, and OT environments usually drive the timeline.

Phishing-resistant means the authenticator cannot be replayed by an attacker who intercepts it — FIDO2 security keys, passkeys or certificate-based authentication. SMS codes, TOTP apps and push-approval prompts do not qualify. The requirement spans internet-facing systems, critical systems and remote access, which is where legacy and OT estates create the real work. This is a 24-month item, due 10 June 2028.

Logging alone is not the obligation. The Rules require central collection, monitoring, and routine review of both successful and failed authentication attempts. A defensible position has a named owner, a stated review cadence, a retention period, and evidence that reviews actually happened — not simply a SIEM with the data in it.

This is the hardest requirement in the Enhanced CIRMP Rules. It combines segregation to limit lateral movement with a resilience test: if you had to rebuild or restore critical systems, could the asset keep operating independently for at least three months? Design documents do not answer that. A restoration exercise, with the dependencies actually severed, does.

The critical systems inventory is what segmentation, monitoring and restoration priorities all reference. Tie it to the critical components list from the scoping step so there is one authoritative view rather than three that disagree. Currency matters more than completeness — an inventory eighteen months old is a description of a network that no longer exists.

The Rules require material risks from unpatched systems, legacy technology and end-of-life products to be addressed. What that looks like in practice is a legacy register with, for each item, an owner, the compensating controls in place, and a funded end date. This falls in the 12-month window, due 10 June 2027.

The Enhanced CIRMP Rules expressly bring the deployment or hosting of advanced, novel or emerging technology — including AI — into the hazard model. Separately, Measure 5 proposes confirming that an incident is not excluded from being a cyber security incident merely because it was caused by or through an automated system, software agent or AI-enabled tool, including where an authorised system is compromised or becomes materially uncontrolled.

Section 30EB imposes a duty on carriers and carriage service providers to do their best to protect networks and facilities from unauthorised interference or unauthorised access that would prejudice national security. It is an outcome-focused duty assessed on what you can demonstrate — the security capability, how it is governed, and how it is tested — rather than on a checklist.

Section 30EC requires notification of changes to a telecommunications service or system that are likely to have a material adverse effect on your capacity to comply with the section 30EB duty. The Secretary then assesses the change (s 30ED). Measure 4 proposes clarifying that this assessment is point-in-time and does not remove the obligation to re-notify when a project changes materially. The practical implication: the notification test belongs inside project and change governance.

Personnel hazards cover more than insider threat. The three to address explicitly are: malicious or negligent action by someone with trusted access; compromise of a person's credentials or identity; and dependency on a small number of individuals whose absence would stop the asset working.

Section 5 defines a critical worker as an employee, intern, contractor or subcontractor whose absence or compromise would prevent the proper function of the asset or could cause significant damage, and who has access to, or control and management of, a critical component. Note that it is built from actual access, not from job titles — and contractors and subcontractors are squarely inside it.

The Enhanced CIRMP Rules require critical workers to hold either an AusCheck background check or a Negative Vetting 1 security clearance, reassessed at least every five years. Lead times for both are long and largely outside your control, so this is a plan-backwards item: identify the population, sequence by access level, and start with the roles closest to critical components. Due 10 June 2028.

The obligation is not just to have a deprovisioning process but to know it works. The evidence that matters is a periodic reconciliation: take the critical worker register, sample recent leavers and role changes, and confirm privileged system access and physical access were actually removed and when. Stale privileged access is the single most common finding in this domain.

The Rules address the risk of credential compromise and of unauthorised access to critical components as distinct personnel hazards. Managing them means monitoring for exposed or compromised credentials, controlling privileged access, and having a documented response path — who is told, what is revoked, how quickly — when compromise is detected.

Measure 21 proposes replacing the current critical worker test with a four-limb model: security-sensitive access, operational authority, access to critical components, or a prescribed role. Only one limb needs to be satisfied. Rules could then create worker categories with proportionate checking, monitoring, training, supervision or access controls. Mapping your workforce against those four limbs now avoids re-baselining from scratch later.

A vendor list is not a supply chain hazard assessment. What the CIRMP needs is a dependency map: for each material supplier, what function they support, what breaks if they stop, how quickly it breaks, and what the fallback is. Concentration risk — several critical functions resting on one provider — is usually the finding that matters most.

The Enhanced CIRMP Rules require mapping of major suppliers and critical components, and identification of risks to component availability and data integrity. 'Major' is judged by materiality to the asset, not by contract value. Sub-tier dependencies matter where they are material — the fourth-party cloud region or the single-source component two layers down.

The Rules require assessment of each major supplier for foreign ownership, control or influence, sanctions exposure, level of access, and the material risks they present. This needs to be a repeatable method with a documented refresh cycle, not a one-off questionnaire — ownership and control change, and so do sanctions listings.

The Rules require cyber risk to be managed contractually with major suppliers, applied at contract entry, renewal or material change. Measure 19 proposes clarifying this further, including recognised certification or accreditation as evidence and documented exceptions where supply is genuinely constrained. Practically: draft a standard clause set, and decide in advance what you do when a critical supplier refuses it.

Measure 17 proposes a new relevant operator concept covering entities with material practical control over an asset or a critical function — managed service providers, O&M contractors, and similar. They would face targeted registration, a duty to cooperate with the responsible entity, notification duties, and direct enforcement. Identify who would be caught, on both sides of the relationship, and start the contractual conversation early.

Measure 18 proposes a limited cooperation duty for connected corporate-group entities where the responsible entity materially depends on them for CIRMP compliance — requiring reasonable cooperation, assistance, and notification of material events. Shared services, group IT, and offshore capability centres are the usual dependencies. An intra-group arrangement documenting who does what is the practical answer.

The Rules require identification and control of offshore or remote access to critical components and business critical data. The gap is usually vendor remote support and offshore managed services — pathways that were provisioned for convenience and never inventoried. This is a 12-month item, due 10 June 2027.

The CIRMP must cover both deliberate physical interference — unauthorised entry, tampering, sabotage — and natural hazards such as flood, fire, extreme heat and storm. The treatments need to be tied to specific critical components and their locations, not described at a site level in general terms.

The Enhanced CIRMP Rules require identification of the locations of critical components and of areas holding business critical data, and centralised management of physical security and natural hazards. Centralised means one accountable function with a single view — not each site running its own arrangements with its own standard.

Assess exposure using your actual geography and asset locations, then test the continuity and restoration plans against realistic scenarios for that exposure. Record the outcome, including what did not work. For many Australian operators this is the hazard class with the highest realised frequency and the least documented preparation.

Section 30BC: where a cyber security incident has had or is having a significant impact on the availability of the asset, the responsible entity must report to the relevant Commonwealth body as soon as practicable and within 12 hours of becoming aware. Twelve hours is a real constraint — it requires a pre-agreed decision-maker, a template, and after-hours coverage. Section 30BEA governs what 'significant impact' means.

Section 30BD: where an incident has had, is having, or is likely to have a relevant impact on the asset, the report is due as soon as practicable and within 72 hours. 'Relevant impact' (s 8G) covers availability, integrity, reliability and confidentiality — so it is much broader than an outage. Write the triage criteria in terms your on-call staff can apply at 2am without a lawyer.

Both reports may be given orally. If they are, a written record in the approved form must follow — within 84 hours for a critical incident (s 30BC(3)) and within 48 hours for other incidents (s 30BD(3)). This is the step most often missed, because it falls due after the immediate response has wound down and attention has moved on.

Section 30BF identifies the relevant Commonwealth body — in practice, the Australian Signals Directorate for most entities. The playbook should name it, name the person authorised to make the call, and set the escalation path. Then exercise it: run a tabletop that starts the 12-hour clock and ends with a submitted report. The gaps that surface are almost always about decision authority, not technology.

Measure 5 proposes refining the definition of cyber security incident so that unauthorised access, modification or impairment is not excluded merely because it was caused by or through an automated system, software agent, AI-enabled tool or comparable technology — expressly including where an authorised system is compromised or becomes materially uncontrolled. Ordinary software defects and routine outages stay out. The practical risk is triage filtering these out as 'a bug'.

Where an asset is declared a System of National Significance, Part 2C Division 2 requires the responsible entity to adopt an incident response plan, comply with it, review and update it, and give a copy to the Secretary (ss 30CD–30CH). The routine failure is divergence: the lodged version and the version the team actually uses drift apart after the first real incident.

Part 2C Divisions 3 and 4 allow the Secretary to require cyber security exercises and vulnerability assessments for a System of National Significance, with internal and external evaluation reports (ss 30CQ–30CS, 30DA). Track what has been required, what was done, and retain the evaluation reports as evidence.

Measure 6 proposes simplifying the SoNS framework: replacing statutory incident response planning with asset-specific resilience planning covering disruption management and service restoration; retaining cyber security exercises; making vulnerability assessments discretionary and all-hazards focused; repealing the system information obligation; and recognising equivalent existing arrangements.

Section 30AG requires the report within 90 days of the end of the financial year, in the approved form, stating whether the program was up to date, evaluating the program's effectiveness against any hazard that had a significant relevant impact, and — where the entity has one — approved by the board or governing body. Board approval is what really sets the deadline: work back to the board meeting, not to the 90 days.

Part 2A only applies where the Rules switch it on for your asset class (s 30AB(1)). Separately, an asset can be exempted where the responsible entity holds hosting certification (strategic level), or where a prescribed Commonwealth, State or Territory law covers the entity or asset (s 30AB(4)–(6)). Those are different positions with different consequences: if an exemption is the reason, section 30AQ still requires an annual report within 90 days, setting out why the exemption applies, addressing any significant hazard impact, and board-approved.

The purpose of the program under section 30AH(1)(b) is to identify hazards, minimise or eliminate material risks so far as reasonably practicable, and mitigate impacts. That is an effectiveness standard, not a documentation standard. Pick a small number of controls each cycle, test that they operate as described, and retain the evidence — that is what converts a compliance artefact into a defensible position.

Measure 15 proposes proportionate independent assurance over CIRMP design, implementation and effectiveness, risk-calibrated so that lower-risk entities may be able to rely on internal assurance. The way to prepare is to run the review yourself first, against those three dimensions, and close the evidence gaps before someone external documents them.

Measure 20 proposes allowing the Secretary to specify published risk, hazard, standards or guidance material that responsible entities must consider through their CIRMP processes. The entity assesses relevance, documents its response, and determines whether the CIRMP needs updating. It is not a directions power — but it does create a documented-consideration obligation, which needs an intake path and a record.