When did the enhanced CIRMP Rules start?

They commenced on 10 June 2026, with grace periods ending on 10 June 2027 for the new material risks and 10 June 2028 for the other measures, for assets already covered at that date.

Do the enhanced rules apply to data centres?

No. Critical data storage or processing assets remain on the baseline CIRMP rules. The enhanced rules apply to nine classes in the energy, water, communications and freight areas.

Is Essential Eight maturity level two mandatory?

Only if the entity chooses the Essential Eight. Section 8A(3) offers five frameworks, each with its own condition, including AS ISO/IEC 27001:2023, NIST CSF 2.0, C2M2 version 2.1 at MIL2 and the 2023 AESCSF at Security Profile 2.

Must the 2025-26 annual report cover the enhanced rules?

No. CISC says responsible entities do not need to provide information about the enhanced material risks or measures in the 2025-26 reporting period.

SOCI Act Compliance › Guidance notes

Guidance note

Enhanced CIRMP Rules 2026: what changed on 10 June and the 2027 and 2028 deadlines

Last reviewed 2026-11-14

Summary

Enhanced CIRMP Rules commenced on 10 June 2026 for nine asset classes, including electricity, gas, water, liquid fuel and freight. New material risks apply from 10 June 2027 and other measures, including section 10A supply chain mapping and vendor assessment, from 10 June 2028; device checks such as BoardSafe hardware inspections can support the critical component side.

The Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (LIN 26/075) amended the CIRMP Rules and commenced on 10 June 2026. They build on the existing rules rather than replacing them: an enhanced asset must meet both the baseline and the enhanced requirements, and where the two conflict the enhanced requirement applies (sections 4A(3) and 4A(4) of the CIRMP Rules).

1.Which assets are covered

Section 4A(1) applies the enhanced requirements to nine classes:

critical broadcasting assets;
critical domain name systems;
critical electricity assets;
critical energy market operator assets;
critical freight infrastructure assets;
critical freight services assets;
critical gas assets;
critical liquid fuel assets;
critical water assets.

Critical data storage or processing assets, designated hospitals, critical food and grocery assets and payment-system financial market infrastructure stay on the baseline rules. Critical telecommunications assets have their own rules. An asset declared under section 51 before 10 June 2026 is not automatically subject to the enhanced requirements while that declaration remains in force (section 12).

2.Deadlines

Obligations	Sections	Comply by
New material risks	6A, 8A(2) and 9A(2)	10 June 2027
All other enhanced measures	8A (other than 8A(2)), 8B, 8C, 9A (other than 9A(2)), 10A and 11A	10 June 2028

These dates, from CISC's enhanced CIRMP snapshot, apply to assets that were critical infrastructure assets before 10 June 2026. An asset that becomes one on or after that date gets 12 or 24 months from the day it does (section 4A(6)). For annual reporting, no information about the enhanced rules is needed in the 2025-26 report. CISC's CIRMP guidance says the new material risks are first reported in the 2026-27 report, for 11 June to 30 June 2027, and the other measures in the 2027-28 report, from 11 June 2028.

3.What is new, section by section

Section	Hazard	Requirement
6A	All hazards	Minimise additional material risks: impairment that could prejudice Australia's social or economic stability, national security or defence; compromise linked to foreign ownership, control or influence (FOCI); offshore or remote access to critical components; and offshore or remote access to business critical data
8A	Cyber and information security	Minimise risks from failing to patch in a timely manner, failing to replace or mitigate legacy and unsupported components, and deploying, hosting or facing advanced, novel or emerging technology; comply with a framework at a higher level
8B	Credential compromise	Where the chosen framework does not require phishing-resistant MFA: set out where it is required, implement it, and centrally log, monitor and review MFA attempts
8C	Lateral movement	Keep an inventory of critical systems and their connections; recover and restore critical systems; segregate them so they can keep operating for at least three months while other computers are restored; apply least privilege
9A	Personnel	Manage unauthorised or unsupervised access, credential misuse, access by people who are not critical workers, and incoming and outgoing critical workers; assess suitability by AusCheck background check or a security clearance at Negative Vetting 1 or higher
10A	Supply chain	Map the supply chain for major suppliers and critical components, set maximum acceptable outages, and assess each major supplier, including FOCI and sanctions exposure
11A	Physical security and natural hazards	Manage physical security and natural hazards centrally; consider the physical consequences of every other hazard; outline sites, critical components, access controls, surveillance and out-of-hours measures

CISC's guidance describes credential compromise and lateral movement as two new hazard vectors.

4.The cyber framework step up

Framework	Baseline (section 8)	Enhanced (section 8A)
AS ISO/IEC 27001	2015 edition	2023 edition
Essential Eight Maturity Model	Maturity level one	Maturity level two
NIST	Framework for Improving Critical Infrastructure Cybersecurity	Cybersecurity Framework (CSF) 2.0
US DOE Cybersecurity Capability Maturity Model	Maturity Indicator Level 1	Version 2.1, Maturity Indicator Level 2
AESCSF Framework Core	2020-21, Security Profile 1	2023, Security Profile 2

Under section 8A(4), an equivalent framework may be used only if it matches the Essential Eight, C2M2 or AESCSF benchmarks, with their conditions.

5.Critical workers: AusCheck or clearance

Section 9A(4) allows a critical worker to be assessed as suitable only after an AusCheck background check followed by the entity's own suitability assessment, or if the worker holds a security clearance at Negative Vetting 1 or higher. Background checks for workers who need ongoing access to critical components must be repeated at least every five years, and a clearance must be revalidated, or an AusCheck check done, before it lapses. If a worker cannot meet these requirements, the CIRMP must record the risk and the actions taken to address it (section 9A(3)(a)(ii)).

6.Supply chain: mapping, outages and vendors

Section 10A requires a system or process to map the supply chain for major suppliers and critical components, identify risks to their availability, integrity, reliability or confidentiality, set a maximum acceptable outage, and assess each existing or proposed major supplier for FOCI-related legal obligations, sanctions, and its access, influence and control over the asset. The supply chain guide covers this in detail.

Critical components include the hardware that runs critical systems. For devices such as switches, firewalls, servers and building controllers, BoardSafe checks circuit boards against their design files and firmware against a known good version on site, and records each inspection. That gives an entity device-level evidence to sit alongside its mapping and vendor assessments. Section 6A's offshore access risks are also worth applying to any provider that will handle design files or configuration data.

7.Planning the two years

Before 10 June 2027, add the section 6A, 8A(2) and 9A(2) risks to the risk register, with treatment plans and owners.
Choose the framework the cyber hazard section will follow at the higher level, and budget the uplift.
Inventory critical systems and their connections (section 8C) and identify critical components (sections 10A and 11A).
Start AusCheck checks or clearance processes for critical workers early, so access is not interrupted.
Map major suppliers and set maximum acceptable outages; run vendor assessments as contracts come up for renewal.
By 10 June 2028, have every measure in place, with evidence ready for the 2027-28 annual report.

8.Background

The 2026 review of the Act by Dr Jill Slay AM recommended accepting the proposed amendments to the CIRMP Rules (Recommendation 6), describing them as including uplift to Maturity Level 2, supply chain mapping, personnel security with mandatory AusCheck background checking, and explicit FOCI risk management. The final report is published by Home Affairs. The baseline obligations are summarised in the CIRMP checklist.

General information, not legal advice. Based on the CIRMP Rules, Compilation No. 2 (10 June 2026), and CISC's enhanced CIRMP snapshot.

Questions and answers

When did the enhanced CIRMP Rules start?: They commenced on 10 June 2026, with grace periods ending on 10 June 2027 for the new material risks and 10 June 2028 for the other measures, for assets already covered at that date.
Do the enhanced rules apply to data centres?: No. Critical data storage or processing assets remain on the baseline CIRMP rules. The enhanced rules apply to nine classes in the energy, water, communications and freight areas.
Is Essential Eight maturity level two mandatory?: Only if the entity chooses the Essential Eight. Section 8A(3) offers five frameworks, each with its own condition, including AS ISO/IEC 27001:2023, NIST CSF 2.0, C2M2 version 2.1 at MIL2 and the 2023 AESCSF at Security Profile 2.
Must the 2025-26 annual report cover the enhanced rules?: No. CISC says responsible entities do not need to provide information about the enhanced material risks or measures in the 2025-26 reporting period.