Who must adopt and maintain a Critical Infrastructure Risk Management Program (CIRMP)?

Covered critical infrastructure entities must adopt a CIRMP addressing cyber, physical, personnel, and supply-chain hazards.

Part 2A of the SOCI Act requires responsible entities for designated critical infrastructure assets to adopt, maintain, comply with, and annually review a written CIRMP. The program must identify hazards (cyber, personnel, physical/natural, supply chain) and document mitigations. Board-approved annual report due within 90 days of the end of each financial year.

Applies when the business has a critical infrastructure asset.

How the regulator frames it: Responsible entities for designated critical infrastructure assets within scope.

What triggers it: Being responsible for a designated critical infrastructure asset.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires a critical infrastructure asset.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business operates a critical infrastructure asset: it then applies (operates a critical infrastructure asset (SOCI Act)).

When due

CIRMP in place; annual report within 90 days of FY end.

Frequency

Annual

Evidence to keep

Written CIRMP, board approval, hazard register, annual report.

Status

Current

Priority

High

Maximum penalty: Civil penalties up to $364,000 (1,000 penalty units, body corporate) for CIRMP obligations; $273,000 for the annual report.

Self-assessment. Authority: Security of Critical Infrastructure Act 2018 (Cth) ss30AG, 30AH; CISC 'Responsible Entity CIRMP Annual Report' form.

Frequency: Annual report within 90 days after the end of the Australian financial year.

Who can perform it: Approved by the board, council or other governing body (an attestation). No statutory external audit; CISC describes an independent third-party audit as best practice.

• SOCI CIRMP annual board attestation: 28 September 2026 (annual). Annual CIRMP attestation by board to Home Affairs.

• SOCI CIRMP audit findings — first compliance phase 2025 (2025): Critical infrastructure entities must have mature CIRMP including cyber + supply chain controls.
• Home Affairs SOCI directions 2024 (2024): SOCI direction powers actively used; critical infrastructure must have robust CIRMP + cyber posture.
• Home Affairs SOCI mandatory cyber direction (illustrative) (2024): Critical infrastructure entities should expect ministerial direction powers to be exercised. CIRMP documentation must support rapid compliance responses.

If this obligation applies to you, so do these 5: the engine uses the same rule for each.

• Report cyber security incidents to ASD (SOCI)
• Register as a responsible entity / direct interest holder under SOCI
• Comply with SOCI Positive Security Obligation (PSO) per sector
• Government cyber incident reporting via ASD ACSC
• SoNS — Systems of National Significance (SOCI)

• Adopt Essential Eight Maturity Level 2 (federal subcontractors): Federal government contractors handling OFFICIAL: Sensitive must meet Right Fit For Risk (RFFR) including E8 ML2.
• Comply with APRA CPS 234 (Information Security): APRA-regulated entities must maintain information security capability commensurate with the size and extent of threats.
• ISO/IEC 27001 ISMS certification — increasingly customer-mandated: Information Security Management System per ISO 27001 increasingly required by customers + government.
• Report ransomware and cyber extortion payments within 72 hours: Businesses with turnover over $3M, and critical infrastructure responsible entities, must report any ransomware payment to the Government within 72 hours.

Rules Mate tracks 9 published obligations tagged "cyber", 4 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated high priority, and is a annual obligation.

Regulated by Cyber and Infrastructure Security Centre — Department of Home Affairs.

Home Affairs (SOCI): Administers the Security of Critical Infrastructure Act 2018 — registration, risk management programs, and mandatory cyber incident reporting for critical infrastructure assets.

• Cyber and Infrastructure Security Centre — Department of Home Affairs

SOCI Act: Federal critical infrastructure protection regime.

• Security of Critical Infrastructure Act 2018

Free tools that help with this obligation:

• Essential Eight maturity check
• Cyber incident notifications
• Ransomware payment reporting