The Security of Critical Infrastructure Act has a way of arriving on an executive agenda suddenly. A contract asks for evidence of compliance, a regulator letter lands, or the board reads about an incident and asks where the organisation stands. Then someone discovers the Act is long, the definitions are technical, and most of the commentary assumes you already understand the regime.
Here is the plain-English version: what SOCI means, who it captures, what it requires, what changed in 2026, and where the real work sits. It is a starting map, not legal advice.
What SOCI means
SOCI stands for Security of Critical Infrastructure. It refers to the Security of Critical Infrastructure Act 2018 and the rules made under it, which set security obligations for the assets Australia depends on to keep running: power, water, payments, hospitals, ports, data centres and more. The Cyber and Infrastructure Security Centre, part of the Department of Home Affairs, is the main regulator. About the SOCI Act.
Who the Act captures
SOCI does not apply to every organisation in its eleven sectors. It defines 22 classes of critical infrastructure asset, and obligations depend on the asset and your organisation’s role in relation to it. The definitions are more specific than most people expect: for hospitals, having a general intensive care unit is part of the test. Two organisations doing similar work can sit on opposite sides of the line.
A customer asking you to meet SOCI-related requirements does not, on its own, mean you are directly regulated. It may mean they are managing their supply chain risk. Establish which situation you are in before you scope the work.
What captured entities actually have to do
The obligations arrive in layers, and not every layer applies to every asset.
- Register the required information and report changes within 30 days.
- Tell your data providers. Notify external providers storing or processing business critical data for your asset.
- Run a risk management program covering cyber and information security, personnel, supply chain, and physical and natural hazards, with a board-approved annual report due within 90 days of the financial year’s end.
- Report cyber incidents fast. An incident with a significant impact on the asset’s availability must be reported to the Australian Signals Directorate’s Australian Cyber Security Centre within 12 hours. Other reportable incidents have 72 hours. Incident reporting guidance.
- Systems of national significance can carry additional obligations, such as incident response planning, exercises and vulnerability assessments.
Those reporting timeframes deserve a second look. Someone has to recognise the incident, assess its impact and get it to a person who can act. If your process cannot do that on a bad night, that is a gap in itself.
What changed in 2026
Enhanced risk management rules commenced on 10 June 2026 for nine asset classes: electricity, gas, liquid fuels, energy market operators, water, broadcasting, domain name systems, freight infrastructure and freight services. For assets already captured, compliance is staged:
- 10 June 2027: additional material risks, specified cyber risks and personnel access management.
- 10 June 2028: the remaining measures, including phishing-resistant multi-factor authentication, lateral movement controls, worker suitability checks, supply chain mapping and Essential Eight maturity level two where that framework is chosen.
Check the dates against your own assets. CISC implementation factsheet, Enhanced CIRMP rules.
What happens if you do not comply
Civil penalties apply to most obligations, and the regulator can direct an entity to fix a risk management program it considers seriously deficient. For most boards, though, the sharper pressure is commercial. Plenty of businesses first meet SOCI as a clause in a customer contract.
Where organisations actually struggle
The hard parts are rarely the paperwork. They are the questions underneath it.
Who has access, and why? Personnel risk comes down to whether access matches someone’s role and is removed when they leave. If joiner, mover and leaver processes run on tickets, spreadsheets and memory, you cannot give the board a reliable answer, and for the nine asset classes above it is now a deadline. This is the centre of our identity and access management work.
Which suppliers can reach your systems? Vendor access builds up quietly. A useful board question is: if we asked for a list of every vendor with remote access to our operational systems today, could anyone produce it?
What sits outside the corporate IT estate? Building systems, sensors and plant equipment can be essential to operations and still get less scrutiny than laptops. We explore this in why OT and IoT security can no longer sit outside your identity program.
A sensible sequence
Confirm which assets are captured and which obligations and dates apply. Baseline honestly, with operations, technology, security and procurement in the same room. Rank the gaps by consequence and give each one an owner. Then report to the board in terms of the material risks and the decisions needed.
If SOCI has landed on your agenda, talk to us. If access controls are your immediate concern, our identity and AI access health check is a good place to start.
Common questions about the SOCI Act
What does SOCI stand for?
Security of Critical Infrastructure, from Australia’s Security of Critical Infrastructure Act 2018.
Who has to comply?
Entities responsible for, or holding certain interests in, assets that meet one of the 22 asset class definitions. Being in a listed sector is not enough on its own.
How quickly must a cyber incident be reported?
Within 12 hours for an incident with a significant impact on availability, and 72 hours for other reportable incidents.
Is SOCI the same as the Essential Eight?
No. SOCI is legislation; the Essential Eight is a cyber security framework. The enhanced rules specify maturity level two for entities that use it.