Australia Security of Critical Infrastructure Act 2018 (SOCI) & CIRMP Rules
Status: In force; annual CIRMP reporting cycle
Responsible entities for specified critical infrastructure assets must adopt, maintain and comply with a written Critical Infrastructure Risk Management Program (CIRMP) covering cyber/information, personnel, supply chain and physical hazards, and submit a board-approved annual report within 90 days after the end of the Australian financial year. The Cyber and Infrastructure Security Centre (CISC) regulates most asset classes.
Who it applies to
- Responsible entities for critical electricity, gas, water, liquid fuel, energy market operator, ports, freight, hospitals, data and other specified assets
Why it matters for OT
CIRMP cyber hazard section requires alignment with a recognised framework; the CIRMP guidance lists options such as the AESCSF and the Essential Eight (verify current list).
Controls affected & IEC 62443 mapping
| Requirement | Indicative IEC 62443 reference |
|---|---|
| CIRMP cyber and information security hazards (framework compliance) | IEC 62443-2-1 programme; 62443-3-2 risk assessment |
| Supply chain hazards | IEC 62443-2-4 |
IEC 62443 mappings are editorial and indicative.
Sources
- CISC – SOCI Act 2018 cisc.gov.au
- CISC – Guidance for the CIRMP (PDF) cisc.gov.au
- CISC – CIRMP annual report form cisc.gov.au
- Federal Register of Legislation – CIRMP Rules (F2023L00112) legislation.gov.au
Monitored for changes: cisc.gov.au. Data file: data/regulations/au-soci.yaml. Not legal advice.
Get SOCI changes in your inbox
What changed in OT/ICS regulation this week, who it applies to, the deadlines, and which IEC 62443 controls it touches — plus a short CISA ICS advisory digest. One email, every week. No spam.
Free. Unsubscribe any time. See privacy.