CIRMP checklist: what a SOCI Act risk management program must contain

This checklist follows the order of the CIRMP Rules (LIN 23/006) 2023 as compiled on 10 June 2026. Each line is either something the program must contain or a matter the entity must have regard to when it adopts, reviews or varies the program (section 30AKA of the SOCI Act). Tick each one against a named document, an owner and a piece of evidence.

1.The four duties behind every line

The Act gives a responsible entity four continuing duties for its critical infrastructure risk management program (CIRMP), each with a maximum civil penalty of 200 penalty units:

• Adopt and maintain a program that applies to the entity (section 30AC).
• Comply with the program as adopted or varied (section 30AD).
• Review it on a regular basis (section 30AE).
• Keep it up to date by taking all reasonable steps (section 30AF).

Section 30AH sets the purpose: for each asset, identify each hazard where there is a material risk of a relevant impact, minimise or eliminate those risks so far as reasonably practicable, and mitigate the impact of each hazard. When an asset first becomes a critical infrastructure asset, the Rules allow six months before Part 2A applies (section 4(2)).

2.General and all-hazards items (section 7)

Section 6 lists the material risks every program must consider: a stoppage or major slowdown for an unmanageable period; loss of access to, or manipulation of, a critical component; interference with operational or communications technology, such as a SCADA system; storage, transmission or processing of sensitive operational information (layout diagrams, schematics, geospatial and configuration data, and the like) outside Australia; remote access to operational control or monitoring systems; and impacts on data storage systems holding business critical data.

3.Cyber and information security hazards (section 8)

• A process to minimise or eliminate the material risk of a cyber and information security hazard and to mitigate its impact (8(2)).
• Within 12 months after the grace period ends, compliance with one of these frameworks and its condition, or with an equivalent framework (8(3)-(5)):
  • AS ISO/IEC 27001:2015;
  • the ASD Essential Eight Maturity Model, at maturity level one;
  • the NIST Framework for Improving Critical Infrastructure Cybersecurity;
  • the US Department of Energy Cybersecurity Capability Maturity Model, at Maturity Indicator Level 1;
  • the 2020-21 AESCSF Framework Core, at Security Profile 1.
• A description of the cyber and information security hazards that could have a relevant impact on the asset (8(6)).

4.Personnel hazards (section 9)

• A process to identify the entity's critical workers (9(1)(a)).
• Access to critical components only for critical workers assessed as suitable (9(1)(b)).
• Measures for risks from malicious or negligent employees and contractors, and from the off-boarding of outgoing staff (9(1)(c)).
• A list of critical workers and a description of the personnel risks (9(6)).

5.Supply chain hazards (section 10)

• Measures for each of six risks: unauthorised access, interference or exploitation of the supply chain; misuse of privileged access by a provider; disruption from a supply chain issue; threats to people, assets, equipment, products, services, distribution and intellectual property; risks from major suppliers; and failure or lowered capacity of other entities in the chain (10(1)(a)).
• Measures to mitigate the impact of a supply chain hazard (10(1)(b)).
• A list of major suppliers, meaning vendors whose product or service gives them significant influence over the security of the asset (10(2)(a)).
• A description of the supply chain hazards that could affect the asset (10(2)(b)).

The hardware in the asset's networks and control systems is part of this. CISC's CIRMP guidance suggests recording the provenance of critical components and checking components before they are reintegrated after maintenance or repair. Evidence can come from inspection records such as the per-device logs, seal numbers and re-checks after repairs that BoardSafe keeps. The supply chain guide maps these records to each rule.

6.Physical security and natural hazards (section 11)

• Identify the asset's physical critical components (11(1)(a)).
• Minimise physical security hazards to those components and natural hazards to the asset (11(1)(b)). Natural hazards include fire, flood, cyclone, storm, heatwave, earthquake, tsunami, space weather and biological health hazards such as a pandemic.
• Respond to incidents of unauthorised access (11(1)(c)).
• Restrict access to critical workers or accompanied visitors (11(1)(d)).
• Test that security arrangements can detect, delay, deter, respond to and recover from a breach (11(1)(e)).
• Describe the critical components, physical and natural hazards and security arrangements in the program (11(2)).

7.Extra lines for enhanced assets

If the asset is a critical broadcasting, domain name system, electricity, energy market operator, freight infrastructure, freight services, gas, liquid fuel or water asset, the enhanced rules that commenced on 10 June 2026 add sections 6A, 8A, 8B, 8C, 9A, 10A and 11A. Where a baseline and an enhanced requirement conflict, the enhanced requirement applies (section 4A(4)). The enhanced CIRMP guide lists the extra items and the 2027 and 2028 deadlines. Critical telecommunications assets follow separate rules, the Telecommunications Security and Risk Management Program Rules.

8.Keeping the program current

• A CIRMP can be several documents. CISC's guidance says to keep a record of which document meets each requirement.
• CISC considers that the whole program should be reviewed at least every 24 months.
• Record what triggered each review and what changed, because the annual report must state whether the program was up to date at 30 June (see the annual report guide).
• Keep evidence that controls operate, not only that policies exist. CISC's guidance recommends that an "up to date" statement be supported by evidence of review.

General information, not legal advice. Based on the CIRMP Rules, Compilation No. 2 (10 June 2026), and CISC's CIRMP guidance.

Questions and answers

Does a CIRMP have to be a single document?

No. CISC's guidance says a CIRMP can be a collection of policies, procedures and supporting documents, as long as the entity keeps a record of which document meets each requirement of the Rules.

Which cyber frameworks satisfy section 8 of the CIRMP Rules?

AS ISO/IEC 27001:2015, the Essential Eight at maturity level one, the NIST Framework for Improving Critical Infrastructure Cybersecurity, the US C2M2 at Maturity Indicator Level 1, the 2020-21 AESCSF at Security Profile 1, or an equivalent framework. Enhanced assets need higher levels.

How often must a CIRMP be reviewed?

The Act requires review on a regular basis and reasonable steps to keep the program up to date. CISC's guidance says the whole program should be reviewed at least every 24 months.

What is a critical worker?

The Act defines the term, and the CIRMP Rules require the entity to identify its critical workers, list them in the program and allow them access to critical components only once assessed as suitable.

Other guidance notes

• SOCI Act supply chain hazards: what sections 10 and 10A require, and where hardware fits
• SOCI Act annual report and board attestation: what is due by 28 September
• Which assets does the SOCI Act cover? The 11 sectors and 22 asset classes
• SOCI Act penalties and enforcement: what non-compliance can cost
• Enhanced CIRMP Rules 2026: what changed on 10 June and the 2027 and 2028 deadlines
• Selling to critical infrastructure: what the SOCI Act and CIRMP mean for suppliers