Australia · Cyber and Infrastructure Security Centre (CISC) · CIRMP

Critical Infrastructure Risk Management Program

The risk-management program responsible entities must set up under the SOCI Act, covering cyber, personnel, physical and supply-chain hazards.

What it is

The CIRMP Rules put the SOCI Act's Risk Management Program obligation into practice. Responsible entities must set up, maintain and review a program that identifies and reduces material risks across four hazard types - cyber, personnel, physical and supply chain. The cyber element must align with a permitted framework: AESCSF, Essential Eight ML1+, NIST CSF, ISO 27001 or an equivalent. Annual board-approved attestation is required.

Who it applies to

Responsible entities for critical-infrastructure assets under the CIRMP Rules - including water, energy, financial services, data storage and processing, food and grocery, healthcare and transport.

Critical Infrastructure Risk Management Program

Requirements

Cyber hazards

Use and maintain a permitted cybersecurity framework - AESCSF, Essential Eight ML1+, NIST CSF, ISO 27001 or an equivalent.

Personnel hazards

Reduce insider and contractor risk through vetting, access management and ongoing suitability checks.

Physical hazards

Identify and reduce natural hazards and hostile physical acts that could disrupt the asset.

Supply chain hazards

Understand the asset's supply-chain dependencies and how they could be exploited or disrupted.

Annual attestation

Review the program annually and send a board-approved attestation to the Department of Home Affairs.

Sources

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.