Who must register as a responsible entity / direct interest holder under SOCI?

Captured critical-infrastructure assets must be registered with Home Affairs.

Part 2 of the Security of Critical Infrastructure Act 2018 (Cth) requires the Secretary of Home Affairs to keep a Register of Critical Infrastructure Assets, which is not made public. For each asset to which Part 2 applies (assets specified in the rules or declared by the Minister), the responsible entity must give operational information about the asset, and each direct interest holder must give interest and control information about itself and the asset. After the first lodgement, the reporting entity must notify any event that makes the registered information incorrect or incomplete, or that makes a new entity a reporting entity. The Cyber and Infrastructure Security Centre (CISC) administers the register as the first of the Act's positive security obligations, alongside cyber incident reporting and a risk management program.

Applies when the business has a critical infrastructure asset.

How the regulator frames it: The responsible entity for a critical infrastructure asset (defined for each asset class in s 12L), and direct interest holders: an entity, alone or with associates, holding a direct or joint interest of at least 10% in the asset, or an interest that puts it in a position to directly or indirectly influence or control the asset. Executors, liquidators and administrators must report for an entity that dies or fails; an agent may lodge on an entity's behalf.

What triggers it: Becoming a reporting entity for an asset to which Part 2 applies, or a notifiable event: a change that makes the operational or interest and control information held on the Register incorrect or incomplete.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires a critical infrastructure asset.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business operates a critical infrastructure asset: it then applies (operates a critical infrastructure asset (SOCI Act)).

When due

Initial information by the later of the end of the asset's grace period and 30 days after becoming a reporting entity (s 23). Notifiable events within 30 days after the event (s 24).

Frequency

When a triggering event occurs

Evidence to keep

Asset-class assessment against the CISC definition guidance; lodged operational information or interest and control information in the approved form and its acknowledgement; ownership and control register mapping 10% interests and associates; change-management trigger so notifiable events reach the register within 30 days; records of best endeavours where information could not be obtained (s 25).

Status

Current

Priority

High

Maximum penalty: Each of s 23 and s 24 is a civil penalty provision of 50 penalty units ($18,200). Under Regulatory Powers (Standard Provisions) Act 2014 s 82(5) a court can order a body corporate to pay up to 5 times that amount, $91,000. Civil penalty provisions of the SOCI Act can also be enforced by infringement notices, enforceable undertakings and injunctions.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

If this obligation applies to you, so do these 5: the engine uses the same rule for each.

• Report cyber security incidents to ASD (SOCI)
• Adopt and maintain a Critical Infrastructure Risk Management Program (CIRMP)
• Comply with SOCI Positive Security Obligation (PSO) per sector
• Government cyber incident reporting via ASD ACSC
• SoNS — Systems of National Significance (SOCI)

Rules Mate tracks 5 published obligations tagged "soci", 2 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated high priority, and is triggered by events.

Regulated by Cyber and Infrastructure Security Centre — Department of Home Affairs.

Home Affairs (SOCI): Administers the Security of Critical Infrastructure Act 2018 — registration, risk management programs, and mandatory cyber incident reporting for critical infrastructure assets.

• Cyber and Infrastructure Security Centre — Department of Home Affairs

SOCI Act: Federal critical infrastructure protection regime.

• Security of Critical Infrastructure Act 2018

Free tools that help with this obligation:

• Essential Eight maturity check
• Cyber incident notifications
• Ransomware payment reporting