SOCI Act for Critical Infrastructure Resilience

Critical infrastructure resilience - SOCI compliance

Practical approaches to achieving strategic and operational outcomes through strong risk, resilience and compliance management that goes beyond compliance for critical infrastructure operators

Cybersecurity
Cybersecurity services
Cyber governance & compliance

Thales supports critical infrastructure achieve positive business outcomes beyond compliance through tailored cyber advisory, risk management and compliance solutions.

What do you need to know about SOCI?

Check asset status

Review your current asset portfolio relative to the SOCI requirements and Cyber and Infrastructure Security Centre (CISC) guidance, consider if anything has changed over the last 12 months.
Identify critical assets

The Cyber and Infrastructure Security Centre will not engage with you directly to advise entities that they are critical infrastructure in most cases. You need to review the critical infrastructure asset rules to see if any of your assets are critical.
Prepare for attestation

Consider your timeframe for attestation and whether you have reviewed your assets, updated your risk management plan and have prepared your Board for attestation by 28th September 2025.

Annual attestation - Knowing your obligations

The Security of Critical Infrastructure Act 2018 (SOCI Act) imposes security and risk management obligations on entities in designated critical infrastructure sectors. Regulated entities must adopt an “all hazards” approach and manage material risks across four domains: personnel, cyber, physical and supply chain.

Entities must also complete an annual attestation on the adequacy of their Critical Infrastructure Risk Management Program (CIRMP). The next attestation is 28 September 2026; preparation should include reviewing CIRMP design and operating effectiveness and confirming Board oversight to support timely completion.

SOCI Act: Key considerations checklist for attestation

Learn more

Understanding Australia’s security of critical infrastructure requirements

The Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act) introduced sweeping reform to the way Australia both views and manages its critical infrastructure assets. Since its inception the SOCI Act has continued to evolve to continue strengthening how we view and manage our critical infrastructure.

In 2021 and 2022 the SOCI Act was amended significantly to strengthen protections for Australia’s critical infrastructure amid an evolving threat landscape. This saw the SOCI Act expand its coverage of defined critical assets, introduced enhanced cybersecurity obligations, positive risk management obligations and a requirement to better understand internal and external supply chains and personnel. Importantly, it also enhanced cross-industry and industry – government collaboration

The 2021 and 2022 amendments saw the number of industries captured by SOCI, expand, these are noted below.

Communications
Financial services and markets
Data storage or processing
Defence industries
Higher edication and research
Energy
Food and grocery
Healthcare and medical
Space and technology
Transport
Water and sewerage

Strategically, these sectors have been identified as those physical facilities, supply chains, information technologies and communication networks, which if destroyed, degraded or rendered unavailable for an extended period, would significantly impact the social or economic wellbeing of the nation, or affect Australia’s ability to conduct national defence and ensure national security.

Source: Cyber and Security Infrastructure Security Centre, Security of Critical Infrastructure Act 2018 (SOCI)

Not all organisations within these sectors will have critical infrastructure assets, however all should have an understanding of why they do or do not. Importantly, all organisations within these sectors should have an understanding of their supply chains and the material risks to their strategic and operational objectives.

This point is of increased relevancy following 2024 amendments to the SOCI Act that see secondary assets that hold business critical data of primary assets captured, while also extending the obligations of telecommunication asset owners.

In November of 2024 the CISC commenced audits over Australia’s Critical Infrastructure asset operators, including those operators who it deemed to be critical, regardless of whether they have identified themselves as having critical infrastructure assets.

It is expected that these audits will become common place for entities in what is already a complex regulatory landscape with many competing priorities. Integrating and optimising Critical Infrastructure Risk Management Programs can simplify this compliance burden.

Penalties and enforcement options vary under the SOCI Act depending on the severity of the incident or contravention, however can go up to 250 civil penalty units.

The CISC may also compel entities to vary their critical infrastructure risk management programs, while also holding a range of other powers enabling their intervention in direct response to cyber security incidents. This may occur in instances where the impacted entity is unable or unwilling to address the issue themselves, however these intervention powers are reserved for emergency circumstances only

Practical approaches to performing positive security obligations

Meeting the requirements of the SOCI Act - including Positive Security Obligations (PSOs) and Enhanced Security Obligations (ESOs) - can be complex, especially given how deeply these rules impact the entire organisation.

A successful approach starts with clear stakeholder mapping and strong executive sponsorship to align security and business priorities. Understanding who the obligations apply to - from technical teams to business leaders - is key to building an effective, compliant security program.

SOCI Act: Practical Approaches to Performing Positive Security Obligations

SOCI Act: Practical approaches to performing positive security obligations

Learn more

SOCI data amendments

The Security of Critical Infrastructure Act 2018 (Cth) (SOCI) was amended in late 2024 to capture the data storage systems that hold business critical data of those organisations captured under the Critical Infrastructure regime. In practice, this will also require entities to consider the risks to those data storage systems that are holding business critical data as part of their CIRMP, according to guidance from the Cyber and Infrastructure Security Centre this must occur before 28 May 2025.

Obligation under SOCI Act	Practice Performance	Key Stakeholders
Asset Registration (Part 2)	The asset registration process requires details of the assets’ ownership, location and operation to be lodged with the regulator through a web portal. Changes to ownership or operation require the portal record to be re-submitted within 6 months of the change.	GRC Site/Facility managers CEO/CFO Legal CISO/CIO* *Asset details should be identified to the SOC to support them in determining which assets are critical assets that have been registered to support cyber notification processes.
Protected Information (Part 2) and Business critical data	Entity information security policy and information classification requirements should describe a process for defining, determining and managing protected information and business critical data and for engaging SOCI stakeholders if either data set is affected in an incident. For less mature organisations a definition of what constitutes these information types will be of value if policy does not already provide a table for information classification specifically covering these.	CISO/CIO GRC Site/Facility managers
Data provider notifications (12F((3))	Business critical information to be defined. GRC to notify data centres that they hold critical infrastructure asset data/business critical information.	GRC CISO/CIO

Obligation under SOCI Act

Practice Performance

Key Stakeholders

Asset Registration

(Part 2)

The asset registration process requires details of the assets’ ownership, location and operation to be lodged with the regulator through a web portal. Changes to ownership or operation require the portal record to be re-submitted within 6 months of the change.

GRC

Site/Facility managers
CEO/CFO
Legal
CISO/CIO*

*Asset details should be identified to the SOC to support them in determining which assets are critical assets that have been registered to support cyber notification processes.

Protected Information (Part 2) and Business critical data

Entity information security policy and information classification requirements should describe a process for defining, determining and managing protected information and business critical data and for engaging SOCI stakeholders if either data set is affected in an incident. For less mature organisations a definition of what constitutes these information types will be of value if policy does not already provide a table for information classification specifically covering these.

CISO/CIO
GRC
Site/Facility managers

Data provider notifications (12F((3))

Business critical information to be defined. GRC to notify data centres that they hold critical infrastructure asset data/business critical information.

GRC
CISO/CIO

High level guidance

The Security of Critical Infrastructure Act 2018 (Cth) (SOCI) was amended in late 2024 to capture the data storage systems that hold business critical data of those organisations captured under the Critical Infrastructure regime. In practice, this will also require entities to consider the risks to those data storage systems that are holding business critical data as part of their CIRMP, according to guidance from the Cyber and Infrastructure Security Centre this must occur before 28 May 2025.

Data storage systems

Review data storage systems to understand which systems are business critical, undertaking a gap analysis between your existing requirements and amended SOCI requirements and SOCI to understand any uplift requirements.
Business-critical systems

Review the risk environment surrounding your business-critical systems, including recent incidents, control testing and assurance reports, risk registers and outcomes of BCP testing, uplifting through risk workshops as required.
Business-critical data

Adopt a low compliance risk appetite approach and develop or redevelop your CIRMP, aligning with better practice across CI entities. Review your current definition and application of ‘Business Critical Data’ against the legislative definition found in Section 5 of SOCI.

Thales is a sovereign critical infrastructure entity with a long-standing record of delivering national security outcomes for Australia and, through the legacy of Australian Defence Industries, has supported sovereign capability for the ADF for more than 100 years; under the Deed, Thales and the Commonwealth share responsibility for sustaining industrial capability, strategic facilities and the secure handling of critical intellectual property in support of Australia’s defence and national security, positioning Thales to advise on tailored, outcomes-focused SOCI solutions that protect value without unnecessarily constraining value creation.

Our solutions to meet SOCI obligations

Understand how your organisation is prepared to address the requirements of the SOCI Act. Our experts will review your end-to-end operations to identify how your current practices either meet the requirements of the SOCI Act or how they will be required to change.

From our SOCI Readiness Assessment you are provided with a clear roadmap to achieve compliance, supporting your uplift to achieve compliance.

Our experts have extensive experience in the development and uplift of Critical Infrastructure Risk Management Programmes, having worked closely with entities across Australia to develop compliant, business outcome aligned CIRMP’s that support the protection, creation and optimization of value across your business.

Supply chains are becoming increasingly complex as global supply chains are strained as a result of geopolitical changes. As organisations grapple with trying to understand their second, third and fourth order suppliers, our teams bring expertise to help you identify, understand and manage the risk across your supply chain, promoting risk informed business decision making.

The development and operationalisation of your CIRMP cannot be done in isolation of well established and understood risk and compliance frameworks that are aligned to strategic and operational outcomes. Thales teams are well versed in transforming risk, resilience and compliance practices, improving maturity and in turn organisational outcomes.

With the evolving threat landscape, both cyber and physical faced by organisations across Australia, it is only a matter of when, not if, a crisis impacts an organisation. Preparing for a crisis is important, but so is knowing who you can call on for immediate support when things go astray. Our experts are well versed in responding to crisis, providing you with surge support, expertise and insights on how to best respond to the crisis at hand.

Organisational and cyber resilience doesn’t occur by accident, it comes from proper prior preparation through well understood business continuity plans. Further, the importance of thinking outside the box and challenging the status quo cannot be an after thought as organisations continue to face into ever changing threats and hazards that were previously unheard of. Our experts are well placed to support your business continuity journey from start to finish and anywhere in between.

In complex operating environments with competing regulatory requirements, competing risk priorities and business trade offs, how we obtain assurance effectively and efficiently is important to help us stay on track. Understanding the different methods and approaches to obtaining an assurance is important in helping to maintain comfort across operating environment. Thales teams are experts in the development and operationalisation of assurance maps across critical infrastructure entities.

Contact us for more information about our solutions

Frequently asked questions

The Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act) establishes positive and enhanced risk and security obligations over 11 industry sectors that have been deemed critical in providing services to Australians. These obligations, when correctly followed, improve the resilience of businesses that operate critical infrastructure assets. This is achieved through an “all hazards” risk approach, requiring entities to capture and consider risks across four key domains of personnel, cyber, physical and supply chain related issues.

A system of national significance (SONS) may be declared by the Minister who will notify the responsible entity in writing. In determining whether an asset is a SONS the Minister will give consideration to the impact on Australia’s national security, defence, or the social and economic stability of the country or our people should an asset be impacted.

The Minister may also identify an asset as a SONS where they become aware of interdependencies.

If your asset(s) are declared to be a SONS you will have increased obligations under the SOCI Act.

Requirements vary dependent on industry and asset criticality, however generally speaking they fall under the following areas:

Positive Security Obligations (PSO): Mandates risk management programs, cyber incident reporting, and critical asset registration.
Enhanced Cyber Security Obligations (ECSO): Applies to systems of national significance, requiring ongoing threat monitoring, vulnerability assessments, and incident response planning.
Government Assistance: Grants intervention powers for the government to respond to serious cyber threats impacting national security.

Compliance with these measures is essential to mitigating risks and ensuring resilience.

Development of a CIRMP: The CIRMP establishes the framework for how the entity will manage the risks related to their CI assets across the four SOCI domains. The CIRMP should be aligned and integrated into an entities established risk and resilience practices.

SOCI introduces positive enhanced cyber security obligations on responsible entities. Importantly, this includes the requirement to report cyber security incidents and where business critical data is processed or stored by a third party on a commercial basis, take reasonable steps to inform the third party that they are doing so.

Where an asset has been identified as a SONS, additional cyber security obligations will be required under Part 2C of the SOCI Act.

Critical infrastructure resilience - SOCI compliance

Critical infrastructure resilience - SOCI compliance

Practical approaches to achieving strategic and operational outcomes through strong risk, resilience and compliance management that goes beyond compliance for critical infrastructure operators

What do you need to know about SOCI?

Check asset status

Identify critical assets

Prepare for attestation

Annual attestation - Knowing your obligations

Understanding Australia’s security of critical infrastructure requirements

Background on Australia’s critical infrastructure landscape

What is captured as “critical infrastructure”?

CISC auditing

Enforcement & penalties:

Practical approaches to performing positive security obligations

SOCI data amendments

High level guidance

Data storage systems

Business-critical systems

Business-critical data

Our solutions to meet SOCI obligations

SOCI readiness assesssment

SOCI assurance

CIRMP development

Supply chain analysis & mapping

Cybersecurity services including maturity uplifts, Pentesting and systems integration and development

Risk, resilience & compliance transformations

Crisis management support

Business continuity testing and other scenario based resilience activities

Assurance mapping

Related solutions

Contact us for more information about our solutions

Frequently asked questions

What is the SOCI Act and why is it important?

Who does the SOCI Act apply to?

What is a system of national significance?

What are the main compliance requirements under the SOCI Act?

How does the SOCI Act impact cybersecurity practices for critical infrastructure?

Where can I find official guidelines and resources on SOCI compliance?