Australia · Cyber and Infrastructure Security Centre (CISC), Department of Home Affairs · SOCI Act

Security of Critical
Infrastructure Act

The law that sets cyber-security and risk-management obligations for responsible entities across 11 critical-infrastructure sectors.

What it is

The SOCI Act sets baseline obligations for Australia's 11 critical-infrastructure sectors: communications, data storage and processing, financial services, water, healthcare, higher education, food and grocery, transport, space, defence industry and energy. Key obligations: a register of critical-infrastructure assets, mandatory cyber-incident reporting, and a Risk Management Program (CIRMP). Systems of National Significance face enhanced cyber-security obligations agreed directly with the Minister.

Who it applies to

"Responsible entities" for assets across 11 critical-infrastructure sectors. "Systems of National Significance" is a separate class with added obligations.

Security of Critical Infrastructure Act

One failure can spread across critical services.

Critical infrastructure delivers the essential services Australians rely on, such as electricity, communications, transport and banking. We lean on these services more each year, and more of them are linked to each other.

Links without the right controls create serious risk. If one asset is compromised, the harm can flow on to other services and cascade from there.

The threats cover every kind of hazard. Some are natural, such as weather and climate events. Others are caused by people: unlawful interference, cyber incidents, espionage, chemical or oil spills and trusted insiders.

Most of this infrastructure is owned and run by private industry or by state and territory governments. So the way we keep it resilient must be clear, effective, consistent and proportionate.

Energy firms should also read the Australian Energy Sector Cyber Security Framework (AESCSF).

How Vectra helps you comply with the SOCI Act.

We have the people and skills to help you comply. We can:

  • Run a first SOCI gap assessment.

  • Help you put the right technical and organisational measures in place, including data protection policies, so you line up with the framework for managing risk to critical infrastructure.

  • Review what AESCSF compliance means for you.

  • Review the security of your SCADA systems.

  • Run penetration tests.

  • Review your infrastructure.

  • Review your application code.

  • Put security controls in place.

  • Give you ongoing monitoring and assurance.

Requirements

Register of critical-infrastructure assets

Give the CISC the asset's ownership and operational details for the Register.

Cyber-incident reporting

Notify the ACSC within 12 hours of a critical incident and 72 hours of any other reportable incident.

Risk Management Program (CIRMP)

Identify and reduce hazards across cyber, personnel, physical and supply-chain domains.

Enhanced cyber-security obligations

For Systems of National Significance only - vulnerability assessments, system-information periodic reporting, and cyber-security exercises.

Sources

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.