SOCI Act compliance help: CIRMP providers and supply chain guide (2026)

This site is a register of firms that help Australian critical infrastructure entities meet the Security of Critical Infrastructure Act 2018 (SOCI Act), with plain-English guidance notes on the obligations those firms are hired for. It is written for compliance, risk, legal and procurement leads at responsible entities in energy, water, telecommunications, transport, data storage, health, food and grocery and financial market infrastructure, and for the suppliers who sell to them.

The law is summarised from the SOCI Act as compiled on 4 June 2026 (Compilation No. 9) and the CIRMP Rules as compiled on 10 June 2026 (Compilation No. 2), which include the enhanced rules. Provider details come from each firm's own website, checked on 14 November 2026. Everything here is general information, not legal advice.

SOCI Act and CIRMP providers in Australia

Twelve entries: a hardware integrity service, a national professional services firm, six consultancies that build, audit or support CIRMPs, three cyber security firms focused on networks and operational technology, and a law firm. Entry order is not a ranking. Each entry links to the firm's own SOCI or services page, which is where the facts in the entry come from.

1.Who the SOCI Act applies to

The SOCI Act applies to owners, operators and direct interest holders of critical infrastructure assets in 11 sectors: communications, data storage or processing, financial services and markets, water and sewerage, energy, health care and medical, higher education and research, food and grocery, transport, space technology and defence industry (section 8D). Section 9 names 22 classes of critical infrastructure asset across those sectors, and the Minister can declare other assets under section 51.

Which duties apply depends on the asset class and on your role. The Cyber and Infrastructure Security Centre (CISC) explains that the responsible entity for each asset class is defined in section 12L of the Act, and that a direct interest holder is an entity holding, with associates, at least 10% of the asset, or an interest that puts it in a position to influence or control the asset.

For the sector-by-sector table, including which classes carry the baseline and enhanced CIRMP rules, see the guide to SOCI Act asset classes.

2.The CIRMP in plain terms

A critical infrastructure risk management program (CIRMP) is a written program that, for each asset, identifies every hazard where there is a material risk of a relevant impact, minimises or eliminates those risks so far as it is reasonably practicable to do so, and mitigates the impact if the hazard occurs (section 30AH). Whether a risk is material depends on how likely the hazard is and what it would do to the asset (section 30AH(7)).

The CIRMP Rules set out what the program must contain. Section 7 deals with all hazards: the asset's operational context, its material risks, interdependencies with other assets, the positions responsible for the program, a risk management methodology and the circumstances that trigger a review. Four hazard categories then have their own sections:

A CIRMP does not have to be one document. CISC's CIRMP guidance says it can be a set of policies and procedures, provided the entity records which document meets each requirement. The same guidance calls compliance with the CIRMP obligation "the bare minimum of risk management". The CIRMP checklist turns every rule into a line item.

3.Supply chain hazards and hardware

The CIRMP Rules define a supply chain hazard as including malicious people, inside or outside the organisation, exploiting, misusing, accessing or disrupting the supply chain, as well as over-reliance on particular suppliers. Section 10 requires every responsible entity to minimise six risks: unauthorised access, interference or exploitation of the supply chain; misuse of privileged access by any provider; disruption caused by a supply chain issue; threats to people, assets, equipment, products, services, distribution and intellectual property; risks from major suppliers; and failure or lowered capacity of other entities in the chain.

Hardware sits inside that list. CISC's CIRMP guidance gives counterfeit components and hardware compromised with malicious code as examples of supply chain threats, and lists tampering with hardware during manufacturing, transit or delivery as a form of interference. It suggests recording the provenance of critical components and checking components before they are reintegrated after maintenance, repair or other time outside the entity's control. Its worked example of a CIRMP entry rates the residual risk from counterfeit parts as medium, partly because sophisticated counterfeits are hard to identify through visual inspection alone.

A device-level check addresses that gap. BoardSafe compares each circuit board in servers, routers, switches, firewalls, phone systems, printers and building controllers with its original design files, checks firmware against a known good version, seals devices that pass with a serial-numbered tamper-evident seal and records every inspection per device. Those records are evidence a CIRMP can point to under section 10; they do not replace supplier mapping, vendor assessment or the rest of the program. The supply chain hazards guide maps each record to a rule.

For the nine asset classes under the enhanced rules, section 10A adds supply chain mapping for major suppliers and critical components, a maximum acceptable outage, and a vendor assessment covering foreign ownership, control or influence (FOCI), sanctions and each supplier's access to the asset. Assets already covered before 10 June 2026 must meet section 10A by 10 June 2028.

4.If you supply critical infrastructure: what your customers will ask you

The SOCI Act generally places its obligations on the entity that owns or operates a critical infrastructure asset, as the Home Affairs consultation paper on the next round of reforms puts it, not on that entity's vendors. But a responsible entity's CIRMP must minimise risks arising from major suppliers and from misuse of privileged access by any provider in its supply chain, and must list its major suppliers (section 10 of the CIRMP Rules). Under the enhanced rules it must also assess each existing or proposed major supplier for foreign ownership, control or influence, sanctions, and the access and control the supplier has over the asset (section 10A). Those duties turn into questions, questionnaires and contract clauses for equipment suppliers, integrators, maintenance contractors and managed service providers.

CISC's CIRMP guidance says a vendor can be a major supplier because of what it supplies, not its size: for example, where it can introduce vulnerabilities, control critical functions or systems, or access business critical data. It suggests entities consider contract terms requiring suppliers to report changes of ownership or access, meet specified security and assurance requirements and take part in audits. Expect questions such as:

• Who owns and controls your business, and under which jurisdictions' laws and sanctions do you operate?
• What access will you need to our systems, data, components or sites, and from where?
• Who will touch critical components, and what checks have they had?
• How do we know the hardware you deliver or repair has not been tampered with?

A supplier that can answer the last question with documents gives the buyer something it can file straight against section 10. Per-device inspection records, numbered tamper-evident seals and re-checks after repairs from a service such as BoardSafe are that kind of evidence. No rule requires a supplier to hold them, but a bid that answers the buyer's CIRMP questions in advance is easier to approve than one that leaves them open. The guide to selling to critical infrastructure covers the full set of questions and contract terms.

5.Annual report and board attestation

A responsible entity that had a CIRMP during a financial year must give a report within 90 days after 30 June, which is 28 September (section 30AG). CISC's guidance says the report goes to the Reserve Bank of Australia for payment-system financial market infrastructure and to the Department of Home Affairs for other assets. It must be in the approved form, state whether the CIRMP was up to date at the end of the year and, if a hazard had a significant relevant impact, identify it and evaluate how well the program mitigated it.

If the entity has a board, council or other governing body, that body must approve the report. CISC's guidance recommends that the approval confirm the CIRMP was in place and maintained, that the information is accurate and complete, and that the governing body oversees the entity's risk management. The Act makes no provision for extensions, and failing to report carries up to 150 penalty units. CISC's enhanced CIRMP snapshot says no information about the enhanced rules is needed in the 2025-26 report; reporting on them starts with the 2026-27 report.

The annual report guide includes a pre-approval checklist for directors.

6.Penalties and enforcement

The CIRMP duties are civil penalty provisions. The maximums in the Act are:

The Crimes (Amount of a Penalty Unit) Instrument 2026 sets a Commonwealth penalty unit at $364 from 1 July 2026, and notes that this amount applies to offences committed on or after that date. Section 82 of the Regulatory Powers (Standard Provisions) Act 2014 lets a court order a body corporate to pay up to five times the specified penalty. On those figures the 200-unit maximum is $72,800 for an individual and $364,000 for a company; the amount for a particular contravention depends on when the conduct occurred.

Enforcement runs through the Regulatory Powers Act: civil penalty orders, enforceable undertakings, injunctions and infringement notices (sections 49 and 49C), backed by monitoring and investigation powers. CISC's SOCI Act page says that from 2026-27 it is changing its compliance posture in response to the threat environment and the 2026 statutory review of the Act, with a focus on measures to address non-compliance. A Home Affairs consultation in July 2026 proposed raising the core CIRMP penalties to 500 penalty units; that proposal is not law. The penalties guide has the dollar figures for each duty.

7.How to choose a SOCI or CIRMP provider

Most organisations end up with more than one provider, because few firms cover every hazard category. Use this checklist when comparing the firms in the register above.

1. Map scope to hazard categories. Write down who covers cyber, personnel, supply chain, and physical and natural hazards. Several firms say plainly where their scope ends: Siege Cyber concentrates on cyber and Smartsec on physical security.
2. Match the rule set. Confirm whether your asset is under the baseline rules, the enhanced rules that commenced on 10 June 2026, or the separate telecommunications rules, and ask for work done against that set.
3. Check framework fluency. Your cyber hazard section must follow one of five named frameworks or an equivalent. Energy operators often use the AESCSF; ask for experience with the one you have chosen and, for enhanced assets, the higher level it now requires.
4. Ask for evidence, not only documents. CISC's guidance recommends that an "up to date" statement in the annual report be backed by evidence of review. Prefer deliverables a board or auditor can test: control samples, inspection records and dated review minutes.
5. Ask where your data goes. Section 6(d) of the CIRMP Rules treats storing or processing sensitive operational information, including layout diagrams, schematics and configuration data, outside Australia as a material risk. Ask every provider whether your files leave your premises or Australia, and whether they are run through third-party AI tools.
6. Ask who will touch critical components. Access to physical critical components should be limited to critical workers or accompanied visitors (section 11(1)(d)). Ask about staff clearances and background checks.
7. Treat the provider as a supplier. A firm with privileged access to your systems may itself be a major supplier for section 10 purposes. Include it in your own supplier assessment.
8. Know what is legal advice. Consultancy reports are not legal advice. For contract clauses and questions of interpretation, use a law firm.

Guidance notes

What's new

Subscribe by RSS

Questions and answers

What does the SOCI Act require?

Depending on the asset class, the responsible entity must notify data service providers, give ownership and operational information to the Register of Critical Infrastructure Assets, report cyber security incidents within 12 or 72 hours, and adopt and comply with a written critical infrastructure risk management program (CIRMP) with an annual report. Systems of national significance can also carry enhanced cyber security obligations.

Who needs a CIRMP?

The responsible entity for an asset specified in the CIRMP Rules, or declared by the Minister. The Rules currently specify 13 classes, including critical electricity, gas, water, liquid fuel, data storage or processing, food and grocery, freight, broadcasting and domain name system assets and designated hospitals. Critical telecommunications assets have their own rules.

What hazards must a CIRMP cover?

All hazards that pose a material risk to the asset, with specific requirements for four categories: cyber and information security, personnel, supply chain, and physical security and natural hazards. Assets under the enhanced rules also have requirements for credential compromise and lateral movement hazards.

When is the CIRMP annual report due?

Within 90 days after the end of the financial year, which is 28 September. The Act does not provide for extensions, and the maximum civil penalty for not reporting is 150 penalty units.

Who has to approve the annual report?

If the responsible entity has a board, council or other governing body, that body must approve the report before it is given. Where there is more than one, CISC's guidance says the entity can choose the most appropriate body.

What changed on 10 June 2026?

Enhanced CIRMP Rules commenced for nine asset classes, including electricity, gas, water, liquid fuel and freight. They add new material risks, higher cyber framework levels, phishing-resistant MFA and network segregation requirements, AusCheck or clearance checks for critical workers, supply chain mapping and vendor assessment, and central management of physical security. Deadlines are 10 June 2027 and 10 June 2028.

What are the penalties for not having a CIRMP?

Up to 200 penalty units for failing to adopt, maintain, comply with, review or update a CIRMP. At $364 a unit, that is $72,800 for an individual, and a court can order a body corporate to pay up to five times as much, or $364,000.

Does the SOCI Act require an external audit of the CIRMP?

Not at present. The board approves the annual report, and CISC runs its own audit program. A Home Affairs consultation in July 2026 proposed periodic independent assurance at least once every three years, but that is not law.

How does hardware fit into SOCI supply chain obligations?

Section 10 of the CIRMP Rules covers threats to equipment and products in the supply chain, and CISC's guidance names counterfeit components and tampered hardware as examples. Inspection records for devices such as servers, switches and controllers, including re-checks after repair, are one form of evidence for that part of the program.

Does using a listed provider make us compliant?

No. The responsible entity remains responsible for its program and its annual report. Providers can build, audit or supply evidence for parts of a CIRMP, but none of them can make an entity compliant, and none of the services listed is a government approval.

How providers were selected

A firm is listed only if its own website has a page describing SOCI Act or CIRMP services, or SOCI work it has done, and that page was available when checked on 14 November 2026. Each entry uses facts from that page and the firm's contact or home page: where it is based, the services it names and who it says the work is for. Founding years, prices, client names and awards are left out unless the firm's own page states them, and no entry contains reviews or ratings.

Firms were left out where their SOCI page named no specific services, gave no location or described rules that have since been replaced. Entry order is not a ranking. The register is rechecked when the SOCI Act or CIRMP Rules change. To correct an entry, email hello@sociactcompliance.site.

Authorities and sources

1. Security of Critical Infrastructure Act 2018 (Compilation No. 9, 4 June 2026). Sectors, asset classes, CIRMP duties, annual report, cyber incident reporting, penalties and enforcement
2. Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023 (Compilation No. 2, 10 June 2026). What a CIRMP must contain, including the enhanced requirements
3. Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (LIN 26/075). The instrument that added sections 6A, 8A-8C, 9A, 10A and 11A
4. Security of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules (LIN 25/010) 2025. Separate risk management program rules for critical telecommunications assets
5. Regulatory Powers (Standard Provisions) Act 2014. Civil penalty orders, including the five-times maximum for bodies corporate (section 82)
6. Crimes (Amount of a Penalty Unit) Instrument 2026. Commonwealth penalty unit of $364 from 1 July 2026
7. CISC: Security of Critical Infrastructure Act 2018 (SOCI). The 11 sectors, positive security obligations and the 2026-27 compliance posture
8. CISC: SOCI Act regulatory obligations. Responsible entities, direct interest holders and which obligations apply
9. CISC: Enhanced cyber security obligations. Obligations for systems of national significance
10. CISC: Critical Infrastructure Risk Management Program Guidance (2026). Asset class table, supply chain controls, annual reporting and board approval
11. CISC: The enhanced critical infrastructure risk management program, a snapshot. Enhanced asset classes and the 10 June 2027 and 10 June 2028 compliance dates
12. Department of Home Affairs: Foreign Ownership, Control or Influence (FOCI) Model Clause Bank. Optional contract clauses for managing FOCI risk with suppliers
13. Department of Home Affairs: final report of the 2026 review of the SOCI Act (Dr Jill Slay AM). Findings and recommendations on enforcement, attestation and the CIRMP amendments
14. Department of Home Affairs: proposed amendments to the SOCI Act (consultation). Status of the second tranche of reforms
15. Department of Home Affairs: consultation paper on the second tranche of SOCI reforms (2026). Proposed measures, including CIRMP assurance, 500 penalty units and supplier cyber assurance