Key takeaways
- A note on sourcing: this guide's direct fetch of the regulator's own site (cisc.gov.au) returned an access error rather than page content.
- The Act commenced 11 July 2018 covering only electricity, gas, water and maritime ports.
- The Minister can declare an asset a System of National Significance (SoNS) under Part 6A where the national consequences of its compromise would be especially severe.
- NIS2 (EU) — mandatory risk-management and incident-notification regime for "essential" and "important" entities across a similarly broad sector list, with a 24-hour early-warning / 72-hour full-notification sequence.
Australia's Security of Critical Infrastructure Act 2018 (SOCI Act) is the Commonwealth's framework for protecting critical infrastructure — originally a narrow 2018 law covering four sectors, now, after two major rounds of amendment, a broad regime spanning 11 sectors, mandatory risk management programs, cyber incident reporting with 12-hour/72-hour clocks, and Enhanced Cyber Security Obligations for the most sensitive assets. It is Australia's closest analogue to the EU's NIS2 Directive and the US's CIRCIA — a mandatory, regulator-facing incident reporting and risk-management regime for critical infrastructure operators, rather than a voluntary or product-focused scheme.
A note on sourcing: this guide's direct fetch of the regulator's own site (cisc.gov.au) returned an access error rather than page content. The obligations below are drawn from the Federal Register of Legislation's consolidated Act text and cross-checked against Wikipedia's technical summary and a Department of Home Affairs independent review report, which agree on every fact used here. Section numbers are indicative pending direct re-verification against the current consolidated text; confirm exact section numbers and current asset-class thresholds against legislation.gov.au and cisc.gov.au before relying on them in a compliance submission.
From four sectors to eleven
The Act commenced 11 July 2018 covering only electricity, gas, water and maritime ports. Two amendment Acts broadened it substantially:
- 2021 — the Security Legislation Amendment (Critical Infrastructure) Act extended the sectoral scope and introduced new regulatory mechanisms.
- 2022 — the Security Legislation Amendment (Critical Infrastructure Protection) Act added the Critical Infrastructure Risk Management Program obligation, mandatory cyber incident reporting, and the Enhanced Cyber Security Obligations framework for Systems of National Significance.
The Act now covers 11 critical infrastructure sectors: communications, financial services and markets, data storage or processing, defence industry, higher education and research, energy, food and grocery, healthcare and medical, space technology, transport, and water and sewerage — spanning roughly 22 defined asset classes. A further amendment in 2024, the Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act, extended protections further, including around data storage.
The Critical Infrastructure Risk Management Program (CIRMP)
Part 2A requires a responsible entity for an applicable asset to maintain a written risk management program covering material risks — cyber and information security among them, alongside personnel, supply chain and physical/natural hazard domains per secondary summaries. This obligation only became live once supporting rules were made: the Security of Critical Infrastructure (Critical Infrastructure Risk Management Program) Rules 2023 (LIN 23/006) apply CIRMP duties to 13 prescribed asset classes (telecommunications assets sit under a separate risk-management framework instead). Governance matters here, not just documentation: the program needs board-level review and approval, and an annual CIRMP report is due to the Cyber and Infrastructure Security Centre (CISC) by 28 September each year, with the underlying asset register updated within 30 days of any material change.
Mandatory cyber incident reporting: 12 hours or 72 hours
Separately from CIRMP, responsible entities for in-scope asset classes must report cyber security incidents to the Australian Signals Directorate (ASD) within a timeframe set by severity:
| Incident type | Reporting deadline | Trigger |
|---|---|---|
| Critical cyber security incident | 12 hours | Significant impact on the availability of the asset's essential goods or services |
| Other reportable cyber security incident | 72 hours | A relevant but lesser impact than the critical-incident threshold |
Mandatory reporting under this regime took effect 8 July 2022, applying across 21 defined asset classes in each of the 11 sectors except space technology and defence industry, which were not brought into the reporting obligation at that stage. This reporting duty is separate from — and should not be confused with — the distinct 72-hour ransomware-payment reporting obligation that exists under Australia's separate Cyber Security Act.
Enhanced Cyber Security Obligations and Systems of National Significance
The Minister can declare an asset a System of National Significance (SoNS) under Part 6A where the national consequences of its compromise would be especially severe. Declared SoNS then face Enhanced Cyber Security Obligations under Part 2C, which per secondary summaries include maintaining incident response plans, undertaking cyber security exercises, providing vulnerability assessments on request, and additional system information reporting. The Act also gives the Commonwealth government assistance and intervention powers in exceptional circumstances — including the ability to direct or directly assist an entity's response to a serious cyber incident that threatens national security or essential services — powers that go well beyond what applies to the baseline population of in-scope entities.
How it compares to NIS2 and CIRCIA
- NIS2 (EU) — mandatory risk-management and incident-notification regime for "essential" and "important" entities across a similarly broad sector list, with a 24-hour early-warning / 72-hour full-notification sequence.
- CIRCIA (US) — a statute that, as of this guide's research, still has no binding reporting rule in force; CISA's final rule remains in regulatory review.
- SOCI Act (Australia) — already fully operational: CIRMP, 12/72-hour cyber incident reporting and Enhanced Cyber Security Obligations have all been in force since 2022, making it, of the three, the regime with the least regulatory uncertainty left to resolve.
A workable starting point
Confirm whether your asset actually meets a prescribed asset-class definitionSector membership alone doesn't trigger obligations — check the specific asset-class thresholds in the Act and its rules, or with CISC directly. Build the CIRMP as a living, board-governed program, not a one-off documentThe annual 28 September report and 30-day register-update deadline assume ongoing maintenance, not a document written once and filed away. Pre-build the 12-hour reporting path before an incident happensA 12-hour clock for critical incidents leaves no time to design an ASD reporting process from scratch during an active incident — this needs to exist beforehand, integrated with a PSIRT or incident response function. Check SoNS exposure early if your asset is unusually consequential nationallyEnhanced Cyber Security Obligations carry meaningfully higher operational overhead (exercises, vulnerability assessments on request) than baseline CIRMP/reporting duties. Re-verify every section number and threshold against the current Act and rulesLegal text summarized here should be confirmed against legislation.gov.au and cisc.gov.au before being relied on in a compliance submission.
SoftWSP's PSIRT setup work can help build the incident intake, triage and reporting workflow a SOCI-covered entity needs to meet 12-hour/72-hour ASD reporting deadlines: see PSIRT services.
This guide summarises the Security of Critical Infrastructure Act 2018 as reflected in the Federal Register's consolidated text and independent secondary legal summaries; it is not a substitute for the Act's own current text, the CIRMP Rules, or legal advice, and compliance decisions should be confirmed against the current official text before being relied on.
Sources
- Federal Register of Legislation: Security of Critical Infrastructure Act 2018 (Cth), consolidated text
- Wikipedia: Security of Critical Infrastructure Act 2018 — sectors, amendment timeline, CIRMP, incident reporting, Enhanced Cyber Security Obligations
- Department of Home Affairs: Independent Review of the Security of Critical Infrastructure Act 2018 (final report, PDF)
- Cyber and Infrastructure Security Centre (CISC) — regulator for the SOCI Act (program site; this guide's direct fetch of cisc.gov.au pages returned an access error, so content is cross-checked via the Federal Register text and independent secondary legal summaries instead)
Frequently asked questions
What is the SOCI Act and who does it apply to?
The Security of Critical Infrastructure Act 2018 (Cth) is an Australian Commonwealth law establishing a national framework to identify, manage and reduce security risks — including cyber risks — to the country's critical infrastructure. It received royal assent on 11 April 2018 and commenced 11 July 2018, originally covering only four sectors (electricity, gas, water, maritime ports). Amendments in 2021 (the Security Legislation Amendment (Critical Infrastructure) Act) and 2022 (the Security Legislation Amendment (Critical Infrastructure Protection) Act) expanded coverage to 11 sectors: communications, financial services and markets, data storage or processing, defence industry, higher education and research, energy, food and grocery, healthcare and medical, space technology, transport, and water and sewerage. Being in one of these sectors doesn't automatically make an organisation a 'responsible entity' — only assets meeting specific asset-class definitions and thresholds set out in the Act and its rules are actually captured; the Act defines roughly 22 asset classes across the 11 sectors.
What is the Critical Infrastructure Risk Management Program (CIRMP)?
The CIRMP, set out in Part 2A of the Act, requires a responsible entity for an applicable critical infrastructure asset to establish, maintain and comply with a written risk management program addressing material risks across hazard domains that per secondary legal summaries include cyber and information security, personnel, supply chain and physical/natural hazards. The obligation became operational through the Security of Critical Infrastructure (Critical Infrastructure Risk Management Program) Rules 2023 (LIN 23/006), which applies CIRMP duties to responsible entities across 13 prescribed asset classes (telecommunications assets are instead subject to a separate risk management framework). An annual CIRMP report, reviewed and approved at board level, is due to the Cyber and Infrastructure Security Centre (CISC) by 28 September each year, and the asset register itself must be updated within 30 days of a material change.
What are the mandatory cyber incident reporting timeframes?
Per secondary legal and industry summaries of the Act's cyber incident reporting provisions (sections in and around 30BC/30BD), responsible entities for in-scope asset classes must notify the Australian Signals Directorate (ASD) of a cyber security incident within one of two timeframes depending on severity: 12 hours for a 'critical' cyber security incident — one that has had, or is having, a significant impact on the availability of the asset's essential goods or services — and 72 hours for other reportable cyber security incidents with a lesser but still relevant impact. Mandatory reporting under this regime took effect 8 July 2022, applying across 21 defined asset classes spanning each of the 11 sectors except space technology and defence industry, which were carved out at that stage. This guide has not independently verified the exact current section numbers against the consolidated Act text on the Federal Register of Legislation; treat them as indicative and confirm against legislation.gov.au before relying on them in a compliance submission.
What are the Enhanced Cyber Security Obligations (ECSO), and what is a System of National Significance?
Part 2C of the Act establishes Enhanced Cyber Security Obligations that apply to assets the Minister formally declares a 'Systems of National Significance' (SoNS) under the separate declaration power in Part 6A — these are the most critical of Australia's critical infrastructure assets, where the consequences of compromise would be especially severe nationally. Per secondary summaries, ECSO duties for declared SoNS include developing and maintaining incident response plans, undertaking cyber security exercises, and providing vulnerability assessments on CISC's request, plus additional system information reporting duties. The Act also grants the Commonwealth government assistance and intervention powers — including, in defined and exceptional circumstances, directing or directly assisting an entity's response to a serious cyber incident threatening national security or essential services — that go beyond the baseline obligations applying to all in-scope entities. The regime was further amended in 2024 by the Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act, which (per secondary summaries) extended data storage protections, among other changes.
In this cluster
