A CIRMP turns your SOCI obligations into day-to-day controls that protect a critical infrastructure asset and the supply chain behind it.
If you supply an operator, the law may not apply to you directly, but your customer can still ask you to prove how you manage access, vulnerabilities, incidents, and subcontractors.
That proof affects business as well as compliance. When your evidence is current, you can answer tender questions faster, reduce onboarding delays, and give customers a stronger reason to trust you with connected systems or project data.
This article shows you who carries the legal duty, what the rules require, and how to build a program that supports both resilience and contract assurance.
What Is a CIRMP?
A Critical Infrastructure Risk Management Program (CIRMP) is a written program for finding and managing hazards that could materially affect a critical infrastructure asset.
Part 2A of the Security of Critical Infrastructure Act 2018 (SOCI Act) requires an in-scope responsible entity to adopt, maintain, follow, review, and update its program.
Under a CIRMP, your program should connect:
- The asset’s critical functions and components
- Material risks, hazards, and interdependencies
- Controls, owners, review dates, and residual-risk decisions
- Monitoring, testing, incident, and recovery evidence
- Annual reporting to the governing body and regulator
The annual report is one program output. Your asset register, access reviews, supplier checks, treatment plans, and test results show how the program works between reporting dates.
Australia teams may call it a SOCI CIRMP or SOCI RMP, while the formal term remains Critical Infrastructure Risk Management Program.
Who Must Comply With the CIRMP Rules
The direct CIRMP duty applies to the responsible entity for a covered asset under Part 2A and the applicable Security of Critical Infrastructure Rules, which, depending on the asset class, may be:
- The owner
- The operator
- Another party defined by the SOCI Act
The baseline CIRMP obligation covers responsible entities for these prescribed asset classes:
- Broadcasting
- Domain Name Systems
- Data Storage or Processing
- Electricity
- Energy Market Operator
- Gas
- Liquid Fuels
- Financial Market Infrastructure (payment systems only)
- Food and Grocery
- Designated Hospitals
- Freight Infrastructure
- Freight Services
- Water
Critical telecommunications assets follow the separate Telecommunications Security and Risk Management Program Rules.
Your next step is to determine which of these three positions describes your business:
- Responsible entity: You must adopt, maintain, follow, review, update, and report on the CIRMP.
- IT, AEC, cloud, or specialist supplier: You may need to provide security evidence, accept contract controls, support incident response, and oversee your subcontractors.
- Supplier that is also a responsible entity: You carry the statutory duties for your asset alongside the assurance requirements set by your customers.
A customer questionnaire does not make you a responsible entity. It usually means the operator is checking whether your service, access, or product could create a material risk.
Confirm your legal scope against the current asset definitions and thresholds first. Then treat customer assurance as a separate commercial requirement because the quality of your evidence can affect whether you win the project, pass onboarding, or retain the contract.
Key Terms You Need to Read the Rules Correctly
Four definitions tell you what to assess, which outcomes matter, and how far treatment must go. Check them together because each one narrows the next decision.
What Counts as a Hazard
A hazard is a circumstance that could create a material risk to an asset’s availability, integrity, reliability, or confidentiality.
The baseline rules cover cyber and information security, personnel, supply chain, physical security, and natural hazards. Write hazards as usable scenarios.
For instance, “a supplier administrator is phished and uses remote access to alter an operational system” is specific enough to assess, control, and test.
What Counts as a Material Risk
A material risk is the risk that a hazard could have a relevant impact on the asset.
Your risk record should name the affected function, likely impact, current controls, residual risk, owner, and due date.
Material outcomes can include an unmanageable outage, loss of access to a critical component, interference with essential technology, or exposure of sensitive operational information.
What Counts as a Relevant Impact
A relevant impact affects the availability, integrity, reliability, or confidentiality of the asset, its systems, or related information. For an AEC supplier, that could mean:
- Unavailable building information models
- Altered engineering drawings
- Lost access to a common data environment
- Compromised credentials used to enter a client’s network.
Assess the effect on the operator, even when the affected system belongs to you.
What “So Far as It Is Reasonably Practicable” Means
“So far as it is reasonably practicable” requires a proportionate treatment decision based on the risk and your operating context.
Document the risk, suitable control options, expected risk reduction, delivery constraints, chosen treatment, and residual-risk approval.
Cost can shape the option you select, but it should be weighed against the exposure.
This record helps you explain why the decision fits the asset without treating the standard as an unlimited budget or a minimal-effort exception.
How to Comply With the CIRMP Rules Step by Step
If Part 2A applies to your asset, compliance with CIRMP is achieved by running five linked activities:
- Document the program
- Map material risks
- Treat each hazard
- Assign ownership
- Report through governance.
Each step should leave evidence your team can reuse for regulator, board, customer, and insurer questions.
Establish and Document the Program
Build a written program that defines the asset, critical functions, scope, risk method, hazard categories, governance, and review triggers.
Link each requirement to a control, owner, system, frequency, and evidence source.
That mapping keeps the main document usable and reduces repeated work across cybersecurity compliance, tenders, insurance reviews, and internal reporting.
Identify Material Risks and Asset Interdependencies
Map each critical function to the technology, data, people, sites, utilities, and suppliers it needs to keep operating. Then ask four practical questions:
- What stops or degrades if this dependency fails?
- How long can the asset operate without it?
- Who can access the component or business-critical data?
- Which fallback has been tested, and what assumption remains unproven?
In this phase, always include:
- Upstream and downstream assets
- Remote support paths
- Cloud regions
- Specialist applications
- Identity providers
- Subcontractors.
These dependencies often decide the real outage path.
Minimise or Eliminate Each Hazard
Treat each material risk with controls that remove the hazard where feasible or reduce its likelihood and impact as far as reasonably practicable.
For cyber risk, that may mean:
- Phishing-resistant MFA
- Patching
- Least privilege
- Central logging
- Segmentation
- Protected backups
- A tested incident workflow.
For supplier risk, you may need:
- Access limits
- Notification clauses
- Recovery obligations
- Alternate providers
- Scheduled reviews.
Give every action an owner, due date, success measure, and evidence source.
A completed restore test proves the backup can be recovered.
A reviewed supplier record shows whether the contract control works in practice.
Assign an Accountable Owner for the Program
Name the positions or people responsible for developing, maintaining, reviewing, and updating the CIRMP.
One program owner should coordinate technology, operations, procurement, people and culture, facilities, legal, and risk.
Control owners still run the work. Your governance record should show who accepts residual risk, who funds the fix, and who escalates overdue actions.
Submit the Board-Approved Annual Report to Your Regulator
If you are the responsible entity, submit the prescribed annual report within 90 days after the financial year ends, following approval by your board, council, or governing body.
The report addresses whether the program was current, significant hazards that had a relevant impact, how well the program managed them, and relevant variations.
Build it from quarterly metrics, incidents, tests, and approved changes so your governing body reviews an established record rather than a year-end reconstruction.
The Four Baseline Hazard Categories a CIRMP Must Address
The CISC guidance for CIRMPs groups the hazards your program must address into four categories:
- Cyber and information security
- Personnel
- Supply chain
- Physical security and natural hazards
Use each category to answer three questions:
- What could happen?
- Could it create a material risk to the asset?
- Could it affect the asset’s availability, integrity, or reliability, or expose confidential data?
Your CIRMP must then show how you will minimise or eliminate the material risk and mitigate any relevant impact so far as is reasonably practicable.
What that requires depends on the asset and your operating context.
Finally, check where the categories meet. A poorly managed contractor account can begin as a personnel or supply-chain weakness and become a cyber incident.
That overlap is why the discussion starts with cyber hazards and their framework requirement before turning to personnel, supply chain, and physical security and natural hazards.
Cyber and Information Security Hazards
Cyber and information security hazards cover events that could compromise the systems, data, or digital services needed to operate the asset.
Therefore, check whether your program produces current evidence for:
- Asset ownership, criticality, data flows, and external connections
- MFA, privileged access, approvals, and offboarding
- Vulnerability coverage, patching, exceptions, and overdue fixes
- Logging, alert triage, escalation, and incident exercises
- Segmentation, restore tests, backups, and recovery priorities
If you supply a critical infrastructure operator, include every system and connection your service relies on, such as:
- Cloud platforms
- Business applications
- Data environments
- Shared administration tools
- Operational technology
- Remote access paths.
Meeting the Cybersecurity Framework Requirement
If you are the responsible entity, you must adopt a recognised cyber security framework, or an equivalent framework, for the relevant asset, which the options include:
- ISO/IEC 27001
- The Essential Eight
- The NIST Cybersecurity Framework
- C2M2
- The Australian Energy Sector Cyber Security Framework.
The required version or maturity depends on whether the enhanced rules cover your asset.
But, consider using the Essential Eight Maturity Model, as it gives Australian teams a practical cyber security baseline.
Map it to your existing controls and evidence, then address the personnel, supplier, physical, and operational risks it does not cover.
Personnel Hazards
Personnel hazards arise when a worker’s access, conduct, suitability, or departure could affect the asset.
Start by identifying critical workers and approving access based on their roles.
Review privileged access and ongoing suitability where required, then adjust or remove access promptly when someone changes roles or leaves.
The same checks should cover contractors and supplier personnel who can access sensitive systems or data.
Consequently, security awareness training should match the work each person performs.
Someone who handles project data, uses privileged accounts, or connects remotely needs guidance built around those tasks.
Supply Chain Hazards
Supply chain hazards arise when a supplier, product, service, jurisdiction, or subcontractor could disrupt the asset or expose business-critical data.
Identify major suppliers by operational influence rather than spend.
For each one, record its access, data locations, subcontractors, ownership or control considerations, maximum acceptable outage, recovery plan, and replacement options.
High-impact suppliers may need contract controls, evidence reviews, incident timeframes, access limits, and tracked remediation.
If you are the supplier, keep one controlled evidence pack for tenders and renewals.
Include your framework mapping, access records, penetration testing summaries, insurance details, supplier controls, and time-bound remediation statements.
Physical Security and Natural Hazards
Physical security and natural hazards cover unauthorised site access, fire, flood, severe weather, power loss, and damage to critical equipment.
Map each asset function to the sites, utilities, communications, equipment, and people it relies on. This shows where a site event could interrupt operations or force temporary access arrangements.
Test how facilities, operations, and cyber teams respond together.
Also, keep evidence such as site-access logs, backup-power tests, environmental monitoring records, emergency plans, and recovery exercise results.
What the Enhanced CIRMP Rules Changed
The enhanced CIRMP rules commenced on 10 June 2026 and added deeper requirements for specified broadcasting, domain name system, electricity, energy market, freight, gas, liquid fuel, and water assets.
For assets already in scope at commencement, the CISC implementation factsheet sets two deadlines:
| Deadline | What must be in place |
|---|---|
| 10 June 2027 | New prescribed material risks under sections 6A, 8A(2), and 9A(2) |
| 10 June 2028 | Remaining enhanced measures under sections 8A, 8B, 8C, 9A, 10A, and 11A |
Those changes create six practical workstreams:
- Additional material risks: National, social, economic, defence, foreign ownership or control, and offshore or remote access risks.
- Cyber framework uplift: Updated frameworks, patching, legacy systems, and emerging technology risks.
- Credentials and lateral movement: Phishing-resistant MFA, central logging, least privilege, segregation, recovery, and three months of critical-system operation during restoration where the prescribed measure is used.
- Personnel: Stronger access, suitability, monitoring, and joiner-mover-leaver controls, including five-year AusCheck reassessment for relevant ongoing access unless an active qualifying clearance applies.
- Supply chain: Major-supplier and critical-component mapping, maximum acceptable outages, jurisdiction checks covering data sovereignty, and mitigations.
- Physical and natural hazards: Central management of physical risk and the physical consequences of other hazards.
We recommend treating June 2027 as a risk-definition deadline and June 2028 as the control-delivery deadline.
That’s why map dependencies and access first, approve the new risk view, then track control design, procurement, contract changes, testing, and evidence as one delivery plan.
Penalties for Non-Compliance
Part 2A breaches can attract civil penalties, while a seriously deficient CIRMP can lead to a direction requiring the responsible entity to vary it.
Under the SOCI Act, the applicable penalties include:
- 200 penalty units: Failing to adopt or maintain a CIRMP, follow the program, review it regularly, or keep it up to date.
- 150 penalty units: Failing to submit the required annual report.
- 250 penalty units: Failing to follow a direction to vary a seriously deficient CIRMP.
From 1 July 2026, each Commonwealth penalty unit is AU$364. Because this value is indexed, confirm the current amount and obtain legal advice when assessing your exposure.
Regulator scrutiny will also depend on the evidence your team can produce. Keep the following records ready:
- Risk decisions and approvals
- Control and recovery test results
- Overdue actions and their accountable owners
- Remediation records showing what your team fixed and when
What CIRMP Means for Australian SMBs in a Critical Infrastructure Supply Chain
For most Australian SMB suppliers, CIRMP appears through customer tenders, contracts, and assurance reviews rather than a direct statutory duty.
In layman’s terms, your customer wants to know whether your people, systems, suppliers, or recovery limits could create a material risk to its asset.
The following questions are likely to shape that review:
| Customer question | Evidence you can maintain |
|---|---|
| Who can access our systems or data? | Access matrix, MFA coverage, approval records, and offboarding evidence |
| Are vulnerabilities being fixed? | Asset inventory, scan coverage, remediation tickets, ageing, and approved exceptions |
| Can you detect and respond? | Log coverage, triage records, escalation paths, exercises, and incident contacts |
| Which suppliers do you depend on? | Supplier register, subcontractor terms, data locations, reviews, and contingency plans |
| Can your service recover on time? | Recovery priorities, restore tests, continuity exercises, and dependency assumptions |
Keep these records in one reusable evidence pack so your team can:
- Respond to tenders and renewals without rebuilding the same answers
- Reduce onboarding delays when a customer requests follow-up evidence
- Give customers, insurers, and advisers a consistent account of your controls
- Show who owns each gap and when the fix is due
A control crosswalk reduces repeated work by linking each requirement to the controls and records your team already maintains.
If you are choosing the framework behind that crosswalk, the Essential Eight and SMB1001 comparison can help you identify how their scope and maturity paths differ.
Once the controls are mapped, the same access, patching, incident, and recovery records can help answer security questions during a cyber insurance review.
You can then tailor that shared evidence pack to the service you provide:
- **Managed IT and cloud providers: **Privileged access, hosting locations, monitoring, subcontractors, and recovery
- Software and SaaS vendors: Vulnerability handling, software dependencies, support access, data flows, and incident response
- **Engineering, construction, and maintenance contractors: **Project data, site connections, specialist applications, remote access, and subcontractors
- Professional and workforce providers: Screening, device controls, access approvals, training, and offboarding
Separate legal duties still need their own assessment. The EU General Data Protection Regulation may apply when you handle relevant personal data, but it does not replace CIRMP.
Meet Your CIRMP Obligations With Redscale
As you might expect, your CIRMP evidence is tested when a critical infrastructure customer considers your tender or renewal.
If access reviews, patching records, and recovery plans are scattered across tickets and portals, your tender sits with procurement while your team rebuilds the proof.
At the next review, your team repeats the work, while customers, directors, and insurers may receive conflicting answers.
Redscale builds that proof into the security work:
- Our managed security services monitor systems, investigate alerts, and keep incident records current.
- Vulnerability management finds exposures, prioritises fixes, and tracks remediation.
Redscale testers with OSCP, CREST CPSA, and CREST CRT credentials assess the access paths described in your CIRMP evidence.
Book a free discussion with Redscale before your tender or customer review. Bring the questions your team cannot yet answer.
