The SOCI Act Explained: What Critical Infrastructure Operators Need to Know

Australia's Security of Critical Infrastructure Act 2018 (SOCI Act) was substantially expanded in 2022, extending mandatory cybersecurity obligations to 11 critical infrastructure sectors and introducing some of the most significant security requirements ever placed on Australian businesses.

If your organisation operates critical infrastructure, or provides services to those who do, here is what the Act requires.

Which sectors does the SOCI Act cover?

The Act covers assets in 11 sectors:

• Electricity
• Gas
• Water and sewerage
• Ports
• Airports
• Banking and financial services
• Superannuation
• Telecommunications
• Data storage and processing
• Defence industry
• Education
• Food and grocery
• Health care and medical
• Space technology
• Transport (road, rail, freight)
• Broadcasting

The Act applies to entities that own, operate or have direct interests in assets designated as critical infrastructure. The definition is broad and has captured organisations that did not initially expect to be in scope.

The Register of Critical Infrastructure Assets

Responsible entities must register their critical infrastructure assets with the Australian Signals Directorate (ASD). The register captures information about ownership, operational details, and direct interests in the asset.

Failure to register, or providing false or misleading information to the register, is a criminal offence.

Mandatory incident reporting

The SOCI Act imposes strict incident reporting timelines. For significant cyber security incidents affecting critical infrastructure assets, responsible entities must notify the ASD:

• Within 12 hours of becoming aware of an incident that has had, or is having, a significant impact on the availability of the asset
• Within 72 hours of becoming aware of an incident that has had, or is likely to have, a relevant impact on the asset

These are tight timelines that require organisations to have an established incident response capability and clear internal escalation processes before an incident occurs.

Risk management programs

Entities with enhanced cyber security obligations must develop, maintain and comply with a Critical Infrastructure Risk Management Program (CIRMP). The program must identify hazards to the asset, assess the risks those hazards pose, and implement mitigation measures.

The CIRMP must be reviewed annually and audited by an independent, qualified person. A board-level officer must provide an annual declaration that the program is compliant.

Government assistance powers

In the event of a significant cyber attack on critical infrastructure, the government can direct the entity to take specific actions and, as a last resort, authorise the ASD to intervene directly in the asset's systems. These are emergency powers intended for severe scenarios, but their existence reflects the seriousness with which the government views critical infrastructure risk.

What organisations need to do

If you operate a critical infrastructure asset, the priority steps are:

• Confirm whether your assets are in scope and register them if required
• Develop or review your Critical Infrastructure Risk Management Program
• Establish incident detection and response capabilities that can meet the 12 and 72-hour reporting timelines
• Review your third-party and supply chain risk management practices
• Prepare board-level reporting and annual compliance declarations

Find SOCI-experienced cybersecurity vendors on CyberAtlas

CyberAtlas lists Australian cybersecurity specialists with critical infrastructure and SOCI Act experience. Use the directory to find firms that can assist with CIRMP development, incident response capability, and independent auditing.