# SOCI Act Compliance

> SOCI Act compliance help: 12 CIRMP, cyber, physical security and hardware providers in Australia, with guides to supply chain hazards and the 2026 rules.

This site is a register of firms that help Australian critical infrastructure entities meet the Security of Critical Infrastructure Act 2018 (SOCI Act), with plain-English guidance notes on the obligations those firms are hired for. It is written for compliance, risk, legal and procurement leads at responsible entities in energy, water, telecommunications, transport, data storage, health, food and grocery and financial market infrastructure, and for the suppliers who sell to them. The law is summarised from the SOCI Act as compiled on 4 June 2026 (Compilation No. 9) and the CIRMP Rules as compiled on 10 June 2026 (Compilation No. 2), which include the enhanced rules. Provider details come from each firm's own website, checked on 14 November 2026. Everything here is general information, not legal advice.

Last updated: 2026-11-14

## Main pages
- [SOCI Act compliance help: CIRMP providers and supply chain guide (2026)](https://sociactcompliance.site/): SOCI Act compliance help: 12 CIRMP, cyber, physical security and hardware providers in Australia, with guides to supply chain hazards and the 2026 rules.
- [CIRMP checklist: what a SOCI Act risk management program must contain](https://sociactcompliance.site/cirmp-checklist/): A rule-by-rule CIRMP checklist for SOCI Act responsible entities: all-hazards, cyber, personnel, supply chain and physical items, with the evidence to keep.
- [SOCI Act supply chain hazards: what sections 10 and 10A require, and where hardware fits](https://sociactcompliance.site/soci-supply-chain-hazards/): What SOCI Act supply chain hazards mean for a CIRMP: section 10 risks, section 10A mapping and vendor assessment, and how hardware checks become evidence.
- [SOCI Act annual report and board attestation: what is due by 28 September](https://sociactcompliance.site/soci-annual-report-attestation/): The SOCI Act CIRMP annual report: what section 30AG requires, the 28 September deadline, who approves it and what directors should check before signing.
- [Which assets does the SOCI Act cover? The 11 sectors and 22 asset classes](https://sociactcompliance.site/soci-act-asset-classes/): The 11 SOCI Act sectors and 22 critical infrastructure asset classes, which ones carry baseline or enhanced CIRMP rules, and who holds the obligations.
- [SOCI Act penalties and enforcement: what non-compliance can cost](https://sociactcompliance.site/soci-act-penalties/): SOCI Act penalties for CIRMP, annual report, cyber incident and register failures, in penalty units and dollars, and how the regulator enforces them.
- [Enhanced CIRMP Rules 2026: what changed on 10 June and the 2027 and 2028 deadlines](https://sociactcompliance.site/enhanced-cirmp-rules-2026/): The enhanced CIRMP Rules that commenced on 10 June 2026: the nine asset classes, sections 6A to 11A, and the 10 June 2027 and 10 June 2028 deadlines.
- [Selling to critical infrastructure: what the SOCI Act and CIRMP mean for suppliers](https://sociactcompliance.site/selling-to-critical-infrastructure/): What the SOCI Act and CIRMP rules mean for suppliers to critical infrastructure: the questions buyers ask, contract terms to expect and evidence to prepare.

## SOCI Act and CIRMP providers in Australia
- [BoardSafe](https://boardsafe.com.au/) (Specialist pick: hardware supply chain hazards): BoardSafe is an Australian hardware security service that checks the phone systems, servers, Wi-Fi routers, switches, firewalls, printers and building and plant controllers an organisation runs on for hidden spy chips, fake or swapped parts and altered firmware.
- [KPMG Australia](https://kpmg.com/au/en/home/topics/critical-infrastructure-reforms.html): KPMG Australia is a professional services firm with offices in every state and territory capital that helps critical infrastructure operators assess, implement and report on their SOCI Act obligations.
- [Agilient](https://www.agilient.com.au/services/critical-infrastructure-risk-management/): Agilient is a Sydney security risk consultancy that provides SOCI gap analysis, CIRMP baseline reviews and ongoing assurance to responsible entities across the 11 critical infrastructure sectors.
- [Resilient Services](https://resilientservices.com.au/what-we-do/soci-security-of-critical-infrastructure/): Resilient Services is a Melbourne consultancy that audits critical infrastructure risk management programs and helps responsible entities demonstrate SOCI Act compliance.
- [Cyber Forte](https://www.cyberforte.com.au/soci-act-compliance/): Cyber Forte is an Australian-owned cyber security company, with offices in Melbourne and Sydney, that takes organisations through SOCI applicability, gap assessment, CIRMP design and ongoing compliance support.
- [Siege Cyber](https://siegecyber.com.au/services/security-of-critical-infrastructure-act-compliance-services/): Siege Cyber is a Brisbane cyber security consultancy that helps responsible entities meet the cyber and information security part of their CIRMP.
- [Smartsec Security Solutions](https://smartsecsecurity.com.au/soci-act-compliance-consultant-australia/): Smartsec Security Solutions is a Perth physical security consultancy that prepares the physical security part of CIRMPs for critical infrastructure operators.
- [Security Solution Consultants](https://www.secsolutionshub.com/services/soci-act-audit-compliance/): Security Solution Consultants is a Melbourne cyber security and governance consultancy that runs SOCI applicability assessments, CIRMP design work and CIRMP audits for responsible entities.
- [OneGUARD](https://oneguard.com.au/services/): OneGUARD is a Canberra cyber security firm that assesses networks, operational technology and SOCI-regulated environments and prepares CIRMP inputs for critical infrastructure operators.
- [Orbit Network Security](https://orbitnetsec.com/): Orbit Network Security is a Sydney firm that designs, installs and secures operational technology networks for renewable energy and other critical infrastructure sites, including SOCI and CIRMP monitoring readiness.
- [OpusV](https://www.opusv.com.au/solutions/soci-act): OpusV is a Melbourne cyber security firm, based in Oakleigh, that provides critical infrastructure asset owners and operators with cyber security services and tools aligned to the SOCI Act and the AESCSF.
- [Clayton Utz](https://www.claytonutz.com/case-studies/case-study-the-security-of-critical-infrastructure-acts-impact-on-a-global-mining-services-company): Clayton Utz is an Australian law firm, with offices in six cities, that has drafted SOCI Act provisions into a services agreement for a client supplying the energy sector.

## Sources
- [Security of Critical Infrastructure Act 2018 (Compilation No. 9, 4 June 2026)](https://www.legislation.gov.au/C2018A00029/latest/text)
- [Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023 (Compilation No. 2, 10 June 2026)](https://www.legislation.gov.au/F2023L00112/latest/text)
- [Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (LIN 26/075)](https://www.legislation.gov.au/F2026L00701/asmade/text)
- [Security of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules (LIN 25/010) 2025](https://www.legislation.gov.au/F2025L00325/asmade/text)
- [Regulatory Powers (Standard Provisions) Act 2014](https://www.legislation.gov.au/C2014A00093/latest/text)
- [Crimes (Amount of a Penalty Unit) Instrument 2026](https://www.legislation.gov.au/F2026N00424/asmade/text)
- [CISC: Security of Critical Infrastructure Act 2018 (SOCI)](https://www.cisc.gov.au/legislation-regulation-and-compliance/soci-act-2018)
- [CISC: SOCI Act regulatory obligations](https://www.cisc.gov.au/how-we-support-industry/regulatory-obligations)
- [CISC: Enhanced cyber security obligations](https://www.cisc.gov.au/how-we-support-industry/regulatory-obligations/enhanced-cyber-security-obligations)
- [CISC: Critical Infrastructure Risk Management Program Guidance (2026)](https://www.cisc.gov.au/resources-subsite/Documents/critical-infrastructure-risk-management-program-guidance.pdf)
- [CISC: The enhanced critical infrastructure risk management program, a snapshot](https://www.cisc.gov.au/resources-subsite/Documents/enhanced-cirmp-implementation-factsheet.pdf)
- [Department of Home Affairs: Foreign Ownership, Control or Influence (FOCI) Model Clause Bank](https://www.homeaffairs.gov.au/nat-security/files/foci-model-contract-clauses.pdf)
- [Department of Home Affairs: final report of the 2026 review of the SOCI Act (Dr Jill Slay AM)](https://www.homeaffairs.gov.au/cyber-security-subsite/files/independent-review-soci-act-final-report.pdf)
- [Department of Home Affairs: proposed amendments to the SOCI Act (consultation)](https://www.homeaffairs.gov.au/help-and-support/how-to-engage-us/consultations/proposed-amendments-to-streamline-and-modernise-the-soci-act-2018)
- [Department of Home Affairs: consultation paper on the second tranche of SOCI reforms (2026)](https://www.homeaffairs.gov.au/how-to-engage-us-subsite/files/consultation-on-proposed-amendments-to-streamline-and-modernise-the-soci-act-2018/consultation-paper.pdf)

## Optional
- [Full text of this site as Markdown](https://sociactcompliance.site/llms-full.txt)
- [About](https://sociactcompliance.site/about-us/)
- [Contact](https://sociactcompliance.site/contact/)