Critical Infrastructure

The Security of Critical Infrastructure Act 2018 (SOCI Act) places security and risk management obligations on the owners and operators of critical infrastructure assets in Australia. It covers 11 sectors, including energy, water, transport, communications, health care, financial services, data storage and processing, and higher education.

A Critical Infrastructure Risk Management Program (CIRMP) is a written program that responsible entities must maintain under the SOCI Act. It identifies material risks across cyber and information security, personnel, supply chain and physical hazards, and sets out how those risks are minimised. Entities must also comply with a recognised cyber security framework and submit a board-approved annual report.

We help responsible entities assess their current position, close gaps against their chosen cyber security framework, test their defences and incident response, and put monitoring in place that gives a near real-time view of threats. We also provide managed services to keep those controls running between audits.

Yes. Amendments made in late 2024 mean data storage systems that hold business-critical data and are used in connection with a critical infrastructure asset can be treated as part of that asset. Those systems now need to be covered in the entity's CIRMP.

We assess OT environments for risk and vulnerabilities, monitor OT and IT systems together through observability platforms such as Splunk and Dynatrace, and secure privileged access to industrial control systems. We have done this work across transport, water, telecommunications, health and emergency services.

Critical cyber security incidents that have a significant impact on an asset must be reported to the Australian Signals Directorate within 12 hours of becoming aware of them. Incidents with a relevant impact must be reported within 72 hours.