If your business connects to Australian critical infrastructure, the SOCI Act requires you to register assets, manage all-hazards risks, and report major cyber incidents under strict deadlines.
These rules apply directly to asset owners and operators, but they also reach suppliers, contractors, and IT partners through security clauses and supply-chain requirements.
That’s why knowing your statutory role and identifying your specific assets provides a proper starting point for navigating the SOCI Act.
This article offers general information rather than legal advice.
So you should seek tailored guidance for your specific assets, operational roles, and business circumstances.
What Is the SOCI Act 2018?
The SOCI Act 2018 is Australia’s federal framework for protecting essential assets whose disruption would compromise national security, public safety, or economic stability.
It targets critical systems across physical, cyber, personnel, and operational environments to ensure vital services remain resilient during major emergencies.
How Does the SOCI Act Define Critical Infrastructure?
Under the SOCI Act, a critical infrastructure asset is a specific physical or digital facility, network, or service that meets statutory thresholds within a regulated sector.
Because regulatory coverage depends on asset thresholds rather than overall industry participation, you should evaluate your infrastructure using this sequence:
- Does the asset fit a class and threshold in the Act or rules?
- Are you the responsible entity, operator, or direct interest holder?
- Has a rule, declaration, or notice activated another duty?
Document your reasoning for each asset. If you alter operational capacity, acquire new infrastructure, or outsource core functions, re-evaluate your statutory status promptly.
Which Sectors and Asset Classes are Covered?
The Department of Home Affairs sets asset classes across 11 key national sectors to ensure targeted oversight of essential infrastructure:
- Communications: Broadcasting, domain name systems, and telecommunications.
- Financial services and markets: Banking, financial market infrastructure, insurance, and superannuation.
- Data storage or processing: Data storage or processing services and systems. Controls such as data loss prevention typically sit inside this asset class since they govern how information is retained and moved.
- Defence industry: Defence industry assets and critical infrastructure.
- Higher education and research: Higher education sector assets.
- Energy: Electricity, energy market operator, gas, and liquid fuel.
- Food and grocery: Food and grocery critical infrastructure.
- Healthcare and medical: Hospitals and healthcare critical assets.
- Space technology: A named sector; check whether rules or a declaration capture the specific asset.
- Transport: Aviation, freight infrastructure, freight services, port, and public transport.
- Water and sewerage: Water and sewerage services.
Working in one of these sectors does not automatically make every system you own a regulated asset.
Thus, check the asset’s function, capacity, location, and threshold before you decide which SOCI requirements apply.
Who Does the SOCI Act Apply to?
The SOCI Act applies to entities that hold specific legal, operational, or financial roles in relation to a critical infrastructure asset.
Your legal duties stem directly from how your organisation controls, operates, or owns the infrastructure, regardless of where your operational teams or parent companies reside.
Responsible Entities, Operators and Direct Interest Holders
Each legal role carries distinct statutory obligations under the Act, making clear internal assignment essential for compliance:
- Responsible entity: This is the party the legislation makes accountable for the asset. Depending on the class, it may need to provide Register information, maintain a CIRMP, and report cyber incidents.
- Operator: An operator does not automatically carry every duty. Check whether it also meets the responsible-entity definition or has received a relevant notice.
- Direct interest holder: This is generally a party with at least a 10 per cent direct or joint interest, including associates, or enough influence or control over the asset. CISC states that direct interest holders only have Register reporting duties, rather than every operational task under the Act.
Spell out these roles directly in your operational contracts so that incident escalation, log preservation, and regulatory reporting happen without delays.
Systems of National Significance
A system of national significance is a critical infrastructure asset designated by the government because its failure could trigger severe cascading damage across Australia.
If the Minister for Home Affairs declares your asset a system of national significance, the Secretary may issue targeted notices enforcing Enhanced Cyber Security Obligations, including:
- A cyber incident response plan;
- Cyber security exercises;
- Vulnerability assessments; or
- System-information reporting.
Thus, if you receive a notice, use its scope and deadline to set the work, budget, records, and executive reporting. Many entities meet these enhanced obligations by engaging managed security services to maintain the continuous monitoring and reporting a notice can require.
Does the SOCI Act Apply to Foreign-owned and Multinational Businesses?
Foreign ownership does not exempt your entity from SOCI obligations if you own or operate critical infrastructure located in Australia.
When offshore affiliates manage or access Australian critical systems, structure your internal governance to maintain local regulatory oversight:
- Identify the Australian legal entity and responsible entity
- Name the asset owner, operator, and direct interest holders
- List each offshore team or supplier with administrative access, and centralise password management for those accounts so you can audit who can reach the asset
- Record where business-critical data and incident evidence are stored.
Also, record where data and evidence sit, then agree prompt local access so local officers can act within the reporting window.
How the SOCI Act has Changed Since 2018
Amendments to the SOCI Act since 2018 have expanded its scope from basic asset registration to active all-hazards risk management and mandatory incident reporting.
Each reform added work that your team may now need to perform.
SLACI Act 2021
The SLACI Act 2021 expanded coverage to 11 sectors, established mandatory cyber incident reporting, and granted government intervention powers during critical events.
Commencing on 2 December 2021, these reforms required entities to establish rapid internal escalation pathways for cyber incidents affecting asset availability.
SLACIP Act 2022
The SLACIP Act 2022 introduced the Critical Infrastructure Risk Management Program (CIRMP) framework and Enhanced Cyber Security Obligations for key systems.
Commencing on 2 April 2022, it mandated structured risk programs addressing physical, cyber, personnel, and supply-chain threats across regulated entities.
Cyber Security Legislative Package 2024
The Cyber Security Legislative Package 2024 brought business-critical data into CIRMPs and strengthened regulator enforcement powers for deficient security programs.
These measures expand information-gathering authorities, update protection rules for sensitive data, and allow government directions when risk programs fail to meet basic statutory standards.
What is Changing in 2026?
Enhanced CIRMP rules took effect on 10 June 2026 for nine higher-risk classes:
- Energy market operator
- Electricity, gas
- Liquid fuel
- Water
- Broadcasting
- Domain name system
- Freight service
- Freight infrastructure.
If you run one, strengthen risk, worker, offshore-access, supplier, and system controls as the deadlines arrive:
- By 10 June 2027: Put the 12-month requirements in place.
- By 10 June 2028: Put the 24-month requirements in place.
- Newly captured assets: Count the deadline from the date the asset enters the regime.
Home Affairs confirms the rules are in effect in its 2026 CIRMP update. Proposed changes to ministerial direction powers are not current duties unless legislation is enacted.
What are the Obligations Under the SOCI Act?
The SOCI Act can require you to maintain the asset Register, run a CIRMP, report incidents, meet enhanced cyber duties, and follow government directions. The asset, your role, and any notice decide which duties apply.
Check the CISC SOCI Act 2018 overview against the Act and rules, then use this cybersecurity compliance guide to name who must act and which record proves it.
Register of Critical Infrastructure Assets
The Register of Critical Infrastructure Assets requires you to report asset ownership, control structures, and operational details within statutory timeframes.
Who submits each part depends on the role:
- Responsible entities provide operational information about the asset.
- Direct interest holders provide ownership, interest, and control information.
- Your Register owner should monitor acquisitions, divestments, outsourcing, licence changes, and asset commissioning so a change triggers review.
Initial submissions are due within 30 days of becoming subject to the rule. Always verify corporate structures and operational details before filing to ensure registry accuracy.
Critical Infrastructure Risk Management Program (CIRMP)
A Critical Infrastructure Risk Management Program (CIRMP) is a formal, written scheme designed to identify and manage material risks across all operational hazards.
Your CIRMP must show how you reduce hazards in four areas:
- cyber and information security;
- personnel security;
- physical and natural hazards; and
- supply-chain hazards.
Assign specific control owners, schedule routine effectiveness testing, and maintain audit evidence so your CIRMP operates as a functional daily control framework.
Mandatory Cyber Incident Reporting
Mandatory reporting rules require you to notify the government of critical cyber incidents within 12 hours and other reportable incidents within 72 hours.
Which clock applies depends on what the incident does to the asset:
- 12-hour window: Use this when the incident has a significant impact on the availability of the critical infrastructure asset.
- 72-hour window: Use this when the incident has had, is having, or is likely to have another relevant impact on the asset.
The reporting window starts the moment you become aware of an incident meeting the threshold.
Submit written confirmation within statutory follow-up timeframes after initial verbal reports.
That’s why, consider to designate incident leads, legal advisors, and escalation contacts in advance.
So your team can report promptly during emergency situations even with incomplete initial data.
Enhanced Cyber Security Obligations for systems of National Significance
Enhanced obligations allow the government to require specific cybersecurity measures tailored to assets declared as systems of national significance.
If directed, implement required incident plans, cyber exercises, or vulnerability assessments according to the specific schedule detailed in your ministerial notice.
Government Assistance and Last-resort Powers
Government assistance powers sit behind those duties.
When the Act’s conditions are met, the government can gather information, direct an entity, or request technical help during a serious incident.
These last-resort powers apply when existing response actions are insufficient.
Ensure your incident response plan enables full cooperation with official directions while maintaining independent recovery capabilities.
Penalties for Non-compliance with the SOCI Act
Failing to comply with SOCI Act duties exposes your organisation to civil penalties, regulatory action, and, for some failures involving government directions, criminal consequences.
The current 2026 SOCI Act text states penalties in units. From 1 July 2026, one Commonwealth penalty unit is A$364.
The following table applies that rate to three common breaches, although a court sets the final amount.
The Regulatory Powers Act 2014 generally allows a body corporate penalty of up to five times the listed individual amount.
| Example contravention | Units | Individual maximum | Body corporate maximum |
|---|---|---|---|
| Failure to provide certain Register information or report a notifiable change | 50 | A$18,200 | A$91,000 |
| Failure to submit an approved annual CIRMP report | 150 | A$54,600 | A$273,000 |
| Failure to adopt, maintain, follow, review, or update an applicable CIRMP | 200 | A$72,800 | A$364,000 |
However, in many cases, commercial costs may arrive first, like:
- Your customer can pause onboarding
- An insurer can seek records
- A tender panel can reject unsupported claims. Many buyers also expect proof of practical controls such as antivirus and endpoint hardening before they release payment milestones.
How to Become SOCI Compliant
To achieve SOCI compliance, you need a structured six-step process covering:
- Scope confirmation
- Asset registration
- Hazard assessment
- Risk program implementation
- Incident setup
- Governance reporting.
Do them in that order because each job depends on knowing which asset and entity carry the duty.
1. Confirm Whether You Hold a Critical Infrastructure Asset
Confirming your asset scope ensures you apply statutory controls accurately without wasting resources on non-regulated systems.
Always write down the four facts behind that decision:
- List the facilities, systems, data, and services that make up the asset;
- Name the owner, operator, responsible entity, and direct interest holders;
- Cite the rule or definition that brings the asset into scope; and
- Note any notice, declaration, exemption, or transition date that changes the duty.
Also, re-evaluate your statutory classification whenever you acquire assets, expand capacity, or make major changes to your operational outsourcing.
2. Register the Asset and Report Ownership and Control
Once you know the asset and role, submit Register information, then update it when ownership, control, or operations change to the Cyber and Infrastructure Security Centre (CISC).
Assign a single manager to oversee registry records, and require corporate secretarial and procurement teams to report operational or control changes immediately.
3. Assess Hazards Across Cyber, Physical, Personnel and Supply Chain
With the asset and Register details set, assess how each hazard could stop it, then prioritise controls that keep essential services running.
An outage can start with a system, site, worker, or supplier, so check:
- Cyber and data: Check exposed systems, privileged access, patching, logging, backups, and recovery dependencies. A vulnerability assessment can reveal weaknesses your team must fix or accept.
- Physical and natural: Test who can enter sensitive areas and how the asset would keep running through fire, flood, extreme heat, or a utility failure.
- Personnel: Review who needs critical-worker access, how you screen them, how role changes affect access, and how quickly you remove it.
- Supply chain: Find single-source providers, subcontractors, offshore administrators, and services whose failure would stop the asset.
For every material risk, name who acts, what they change, when it is due, and who can accept what remains.
4. Build, Adopt and Board-approve Your CIRMP
Adopting an approved CIRMP establishes your formal framework for managing hazards and maintaining operational resilience.
While board approval is legally required for the annual report, securing governing body approval for the program itself aligns risk tolerance, funding, and executive accountability.
For instance, where appropriate for your systems in scope, implementing the Essential Eight can improve patching, access, hardening, and recovery.
It supports the cyber work in your CIRMP but does not replace the legal test for your asset.
5. Stand Up Incident Detection and 12-hour and 72-hour Reporting
Establishing rapid incident detection and escalation mechanisms ensures you can meet mandatory 12-hour and 72-hour reporting deadlines.
Run a timed exercise that records:
- When the responsible entity first became aware?
- Which asset and service were affected?
- Whether the 12-hour or 72-hour threshold applied?
- Who authorised and submitted the report?
- What evidence and updates followed?
Test your incident escalation paths regularly using partial data scenarios to ensure rapid notification without waiting for complete forensic analyses. Regular table-top exercises also build the kind of cybersecurity awareness that helps staff flag a borderline incident sooner rather than later.
6. Review, Test and Submit Your Annual Report
Submitting an annual report approved by your governing body satisfies your ongoing reporting obligations and verifies risk program currency.
The report is generally due within 90 days after the end of the financial year. It must say whether the programme was current at year end.
If a hazard had a significant relevant impact, explain how the controls performed and what you changed.
Schedule continuous control testing throughout the year so your board has verified operational evidence before signing off on the annual report.
What the SOCI Act Means for Australian SMBs in the Supply Chain
Small and medium businesses frequently inherit SOCI obligations through customer contracts that enforce strict security controls and incident reporting requirements.
Your contract sets the work. The Essential Eight or SMB1001 can help you record and test what you do, while the buyer or insurer decides whether that proof is enough.
When a Non-regulated Business Inherits SOCI Obligations Through Contracts
Contractual security clauses impose legal obligations on suppliers to protect primary asset operators from supply-chain disruptions.
When checking your commercial agreements, look closely for specific operational clauses that might alter your obligations, particularly those covering:
- One-hour or two-hour customer notification windows;
- Audit and evidence rights;
- Log retention and incident co-operation;
- Limits on offshore access and subcontracting;
- Recovery, testing, and exercise duties; and
- Liability, indemnity, and insurance terms.
Review contract terms carefully before signing, and negotiate reporting timelines or security demands that exceed your technical capacity.
Using the Essential Eight and SMB1001 to Evidence Supply Chain Readiness
Implementing standards like the Essential Eight or SMB1001 provides practical framework alignment and proves your security posture to enterprise clients:
- The Essential Eight covers controls such as patching, multi-factor authentication, restricted privileges, application hardening, and recoverable backups.
- SMB1001 sets out bronze, silver, and gold tiers that small and medium businesses can follow as they improve and record their cybersecurity work.
Be aware: neither the Essential Eight nor SMB1001 satisfies the SOCI Act automatically, though knowing how the Essential Eight and SMB1001 differ helps you decide which one to lead with in a tender response.
They do give you a way to answer tenders with a defined scope, named owners, tests, fixes, and approved exceptions.
How SOCI-driven Due Diligence Affects Cyber Insurance and Tender Eligibility
Demonstrating robust cybersecurity controls is increasingly necessary to pass procurement screening and secure favourable cyber insurance terms.
When assessing your business’s supply-chain readiness, a reviewer will typically ask to see details such as:
- The systems and services in scope;
- Policies and named control owners;
- Records showing how you manage access, patch systems, test backups, and monitor alerts;
- Test results and which findings are fixed, open, or accepted;
- Incident contacts and exercise records; and
- Insurance documents and relevant certifications.
Once again; An insurer or buyer may ask for different records, and neither framework guarantees cover or a contract.
Meet your SOCI obligations with Redscale
When a customer asks for one-hour notice or tender evidence, your team must see the incident and know who owns it. The records must be ready while work continues.
The dilemma is that when alerts, remediation, and evidence sit with separate people or suppliers, work slows down.
As a result, onboarding stalls, contract conditions are missed, and the incident team wastes time chasing logs.
Redscale brings those jobs into one operating path. Our managed security services watch the systems supporting your asset, triage alerts, and escalate incidents.
Redscale’s vulnerability management service turns weaknesses into owned fixes and keeps evidence ready for customers, insurers, and advisers.
Our OSCP- and CREST-certified testers validate the controls behind that evidence when deeper testing is needed.
Book a free discussion session with our experts to map out your SOCI compliance roadmap and stay tender-ready.
