SOCI CIRMP compliance in 2026: a guide for asset owners

Published 16 October 2026 · Updated 30 October 2026

The Security of Critical Infrastructure Act 2018 (the SOCI Act) requires the responsible entity for 13 classes of critical infrastructure asset to adopt, follow, review and report on a critical infrastructure risk management program (CIRMP). Since 10 June 2026, owners of nine of those classes must also meet enhanced requirements: a higher cyber framework, phishing-resistant sign-in, segregated critical systems, vetted critical workers and a mapped supply chain.

This guide sets out who is covered, what the rules ask and by when, and where the evidence usually breaks down. It is general information, not legal advice: the rules themselves and the Critical Infrastructure Security Centre (CISC) are the authority.

Who needs a CIRMP

Part 2A of the SOCI Act applies to the asset classes listed in section 4 of the CIRMP Rules:

• broadcasting, domain name systems, and critical data storage or processing;
• electricity, the energy market operator, gas and liquid fuel;
• water;
• designated hospitals, and food and grocery;
• freight infrastructure and freight services;
• financial market infrastructure that is a payment system.

A data storage system that holds business critical data for one of these assets, and meets the Act's tests, is treated as part of the asset. Critical telecommunications assets have their own rules, the Telecommunications Security and Risk Management Program, and are not covered here.

Who the enhanced rules apply to

Section 4A applies the enhanced requirements to nine classes: broadcasting, domain name systems, electricity, the energy market operator, freight infrastructure, freight services, gas, liquid fuel and water. They also apply to an asset the Minister declares subject to the program under section 51 of the Act, unless the declaration was made before 10 June 2026.

They do not apply by default to critical data storage or processing, designated hospitals, food and grocery, or payment systems. An enhanced asset must meet both the baseline and the enhanced requirements, and where the two conflict, the enhanced requirement applies.

The four hazard domains

Every CIRMP must identify the asset's operational context and material risks, minimise or eliminate those risks as far as reasonably practicable, mitigate the impact of each hazard, and be reviewed and kept up to date (section 7). The rules then set requirements in four hazard domains:

• Cyber and information security (section 8): a process to minimise and mitigate cyber hazards, and compliance with one of the listed cyber frameworks.
• Personnel (section 9): identify critical workers, give them access to critical components only once they are assessed as suitable, and manage the risks of malicious or negligent staff and of people leaving.
• Supply chain (section 10): manage the risks of unauthorised access, misuse of privileged access by providers, disruption and major suppliers, and list your major suppliers.
• Physical security and natural hazards (section 11): identify physical critical components, control and test access to them, and respond when unauthorised access happens.

The material risks the rules name include remote access to operational control or monitoring systems, and storing or processing sensitive operational information outside Australia, such as layout diagrams, schematics and configuration information (section 6).

The cyber framework you must meet

Every CIRMP must comply with one of five frameworks, at the level listed. Enhanced assets must meet the higher bar.

A baseline asset may instead comply with any equivalent framework. An enhanced asset may substitute an equivalent framework only for the Essential Eight, C2M2 or the AESCSF (section 8A(4)).

The Australian Signals Directorate published ASD Essentials on 15 October 2026. Its first chapters are Essentials for enterprise IT, an evolution of the Essential Eight, plus Essentials for operational technology and Essentials for cloud. ASD will maintain both frameworks during the transition. The rules still name the Essential Eight Maturity Model, so check the CISC's guidance on the transition before you plan around either.

What the enhanced rules add

For the nine enhanced classes, sections 6A to 11A add the following.

Additional material risks (section 6A)

Impairment that could prejudice Australia's social or economic stability, national security or defence; compromise linked to foreign ownership, control or influence (FOCI); and offshore or remote access to critical components or to business critical data.

Patching, legacy and emerging technology (section 8A)

A process to minimise the risks of failing to patch in time, of keeping redundant, unsupported or obsolete components without adequate mitigation, and of advanced or emerging technology deployed in, or used against, the asset.

Phishing-resistant sign-in (section 8B)

Unless your chosen framework already requires it: phishing-resistant multi-factor authentication for access to internet-connected computers and critical systems, for privileged and unprivileged access to critical components, and for remote access, with successful and failed attempts centrally logged, monitored and reviewed.

Segregating critical systems (section 8C)

An inventory of critical systems and how they connect to each other and to other computers; plans to recover them and keep the asset available meanwhile; and network segregation, including critical systems that can keep operating for at least three months while other computers are restored, access controls and central logging on the paths between them, and least privilege.

Critical workers (section 9A)

Controls over unsupervised access, credential misuse, access by people who are not critical workers, and workers joining or leaving. A critical worker may access critical components only after an AusCheck background check and the entity's own assessment, repeated at least every five years for ongoing access, or while holding a Negative Vetting 1 or higher security clearance. Where neither is possible, the program must record the risk and how it is managed.

Supply chain mapping and vendor assessment (section 10A)

A map of the supply chain for major suppliers and critical components, the maximum acceptable outage for the asset and its critical components, and an assessment of each major supplier: the FOCI-related legal obligations it is subject to, any sanctions or restrictions, and the access, influence and control it has over the asset.

Physical security and natural hazards (section 11A)

Central management of physical and natural hazards: where the site is and who owns it, which areas hold critical components or business critical data, access controls and continuous monitoring, and the physical consequences of every other hazard, cyber included.

Deadlines

For an asset that was already a critical infrastructure asset when the enhanced rules began on 10 June 2026:

• From 10 June 2027: the additional material risks (section 6A), patching, legacy and emerging technology (section 8A(2)) and personnel access management (section 9A(2)).
• From 10 June 2028: everything else, including the higher cyber framework, phishing-resistant sign-in, segregation, worker suitability checks, supply chain mapping and vendor assessment, and the enhanced physical security measures.

An asset that becomes a critical infrastructure asset later has 12 and 24 months from that date (section 4A(6)). The baseline requirements keep applying in the meantime.

The annual report

Within 90 days after the end of each financial year, so by 28 September, the responsible entity must give the regulator a report in the approved form (section 30AG of the Act). It must state whether the program was up to date at the end of the financial year and, if a hazard had a significant relevant impact on the asset during the year, identify the hazard, evaluate how well the program mitigated it and outline any changes made as a result. If the entity has a board, council or other governing body, that body must approve the report.

The CISC has said it has no ability to extend the deadline or grant an exemption, and that a late report may lead to compliance or enforcement action. The report for 2026-27 is due by 28 September 2027.

Penalties and enforcement

Failing to adopt, comply with, review or update a CIRMP carries a civil penalty of up to 200 penalty units for each contravention (sections 30AC to 30AF of the Act), and not giving the annual report up to 150 (section 30AG). A penalty unit is $364 for conduct from 1 July 2026, and a company can face up to five times the figure: up to $364,000 and $273,000 respectively. Infringement notices are also available.

In September 2026 the CISC said it is giving greater focus to non-compliance, may issue infringement notices for serious or persistent breaches, and will consider further options, including court action, where an issue is not resolved.

Where CIRMP evidence usually breaks down

A program can read well and still fall over when someone asks to see the evidence behind it. The common gaps:

• The inventory stops at the switch. Section 8C asks for critical systems and how they connect. Asset registers often list the systems but not the cabling, VLANs and subnets between them, and leave OT devices out altogether.
• Firmware and support dates are unknown. Section 8A(2) asks about patching and legacy components. For PLCs, RTUs, UPS units and switches, the running firmware and the vendor's end-of-support date are often recorded nowhere.
• Suppliers live in contracts, not in the asset record. Mapping major suppliers to critical components (section 10A) is hard when nobody can say which vendor supports which device.
• Changes are not attributable. Section 9A(2) covers misuse of credentials and privileged access. When configuration is changed directly on devices, there is no record of who changed what, or who approved it.
• Physical dependencies are guesswork. The maximum acceptable outage (section 10A) and the physical consequences of other hazards (section 11A) depend on knowing what a lost power feed would take down, cooling included, and for how long.

How Cofferdam helps, and where it stops

Cofferdam is Trificta's data centre infrastructure management software, built for IT and OT estates. It gives you supporting evidence for parts of a CIRMP from the data it holds. It is not a risk management program, and it does not make an asset compliant.

• Critical systems and how they connect (section 8C(2)(a)). Racks, devices, cabling, IP ranges and VLANs in one record, with OT and corporate address ranges labelled and a device polled over an industrial protocol on a corporate range flagged on its page. It shows where things sit; your firewalls still do the segregating.
• Patching and legacy components (section 8A(2)). Each asset's vendor, model, firmware and end-of-support date on record, and its firmware matched against published advisories including CISA's ICS advisories once an administrator switches matching on (Professional edition).
• Misuse of credentials and privileged access (section 9A(2)). New configuration Cofferdam pushes to a device needs a second person's approval, and remote SSH sessions run through Cofferdam are recorded (both Enterprise edition). Sign-ins, failed sign-ins with the reason, approval decisions and every change a person makes in Cofferdam's web interface or API are written to a signed, hash-chained audit log.
• Outage tolerance and physical consequences. The feed-loss what-if above, with alerts when a rack's A and B feeds could not carry it alone or share an upstream panel. Time to the thermal limit needs the Professional edition.
• The annual report. Once switched on, the SOCI CIRMP catalogue (Enterprise edition) checks 17 of its 19 controls every day against the data Cofferdam holds, signs each day's result, and exports it as an evidence pack: a report with the evidence and traceability behind each result. It is supporting evidence for your report, not the report.

Cofferdam does not vet workers, assess who owns your suppliers, enforce phishing-resistant sign-in, monitor natural hazards, or manage physical access beyond door-sensor alerts. Those parts of the program need other controls, and we will tell you plainly where they are.

Sources

• Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023, as amended to 10 June 2026
• Security of Critical Infrastructure Act 2018, sections 30AC to 30AG
• CISC enhanced CIRMP implementation factsheet
• CISC, SOCI: evolving regulatory posture, 24 September 2026
• CISC annual report form
• ASD, ASD Essentials: evolving our approach to cyber security resilience, 15 October 2026