Does the SOCI Act apply directly to suppliers?

Generally not. The Act places its obligations on the entity that owns or operates the asset. A supplier can carry duties of its own if it is the responsible entity for a critical infrastructure asset, including a data storage or processing asset under section 12F.

Do we need a certification to sell to critical infrastructure entities?

The CIRMP Rules do not require suppliers to hold a certification. The July 2026 consultation paper proposed recognising relevant supplier certifications as evidence, but that is not law.

Why are customers asking about our ownership?

Entities under the enhanced rules must assess each major supplier for foreign ownership, control or influence and sanctions exposure under section 10A, and CISC suggests contract terms requiring suppliers to report ownership changes.

SOCI Act Compliance › Guidance notes

Guidance note

Selling to critical infrastructure: what the SOCI Act and CIRMP mean for suppliers

Last reviewed 2026-11-14

Summary

The SOCI Act generally puts CIRMP duties on the critical infrastructure entity, not its suppliers, but those duties include managing risks from major suppliers and from any provider with privileged access, so buyers pass questions and contract terms down the chain. Suppliers that can hand over evidence, such as per-device inspection records and tamper-evident seals from BoardSafe, make those questions easier to answer.

If you sell equipment, software, maintenance or managed services to an electricity network, water utility, gas pipeline, freight operator or data centre, the SOCI Act will usually reach you through your customer's critical infrastructure risk management program (CIRMP) rather than directly. This guide explains why, what buyers are likely to ask, the contract terms to expect, and how to prepare evidence. Everything here comes from the Act, the CIRMP Rules and CISC guidance.

1.Why the SOCI Act reaches suppliers

The Home Affairs consultation paper on a second tranche of SOCI reforms describes the starting point: the Act generally places obligations on the entity that owns, operates or has legal responsibility for a critical infrastructure asset. The CIRMP Rules then make that entity responsible for its supply chain. Section 10 requires every responsible entity with a CIRMP to minimise, so far as reasonably practicable, risks including unauthorised access, interference or exploitation of its supply chain, misuse of privileged access to the asset by any provider in the supply chain, and risks arising from major suppliers. The program must list the entity's major suppliers.

For nine asset classes under the enhanced rules (broadcasting, domain name systems, electricity, energy market operators, freight infrastructure, freight services, gas, liquid fuel and water), section 10A goes further. By 10 June 2028 for assets already covered, the entity must assess each existing or proposed major supplier, identifying the foreign ownership, control or influence (FOCI) laws the supplier is subject to, sanctions affecting the jurisdiction, and the access, influence and control the supplier has over the asset. The enhanced rules also treat offshore or remote access to critical components and to business critical data as material risks (section 6A).

2.Are you a major supplier?

A major supplier is a vendor whose product or service gives it significant influence over the security of the asset. CISC's CIRMP guidance says size or contract value does not decide it, and a vendor does not need to control the asset. It gives examples of significant influence: being able to enable or prevent detection of threats, introduce vulnerabilities, control critical functions or systems, or access business critical data. Questions the guidance suggests buyers consider include:

Does the vendor supply an essential good or service that supports core operations?
Does it have privileged access to key systems, data or physical facilities?
If it failed or stopped trading, how easily and how quickly could it be replaced?
Would a compromise of the vendor create a significant operational or security risk?

Maintenance contractors, managed service providers, and software and hardware vendors providing technical or operational support are the guidance's examples of suppliers that may need higher levels of access to systems, data, components or facilities.

3.When the Act applies to a supplier directly

Some suppliers carry obligations of their own. Under section 12F of the SOCI Act, an asset used wholly or primarily to provide a data storage or processing service relating to business critical data to a responsible entity can itself be a critical data storage or processing asset, if the provider knows it is used that way. Section 12F(3) requires a responsible entity that becomes aware it receives such a service on a commercial basis to take reasonable steps to tell the provider, with a civil penalty of 50 penalty units. CISC's regulatory obligations page says the notice makes data providers aware that they may also have obligations under the Act. A supplier that is itself the responsible entity for a critical infrastructure asset has its own duties in any case.

4.What buyers are likely to ask

Question	Why the buyer asks
Who owns and controls your business, and has that changed?	FOCI risk in the section 10A vendor assessment; CISC suggests contract terms requiring notice of ownership changes
Which countries' laws and sanctions apply to you?	Section 10A(5)(a)-(b)
What access do you need to our systems, data, components or sites, and from where?	Privileged access risk (section 10(1)(a)(ii)); offshore and remote access risks (section 6A)
What cyber security framework do you maintain, and can we audit it?	CISC's guidance suggests a contractual obligation to maintain a framework, with the ability to audit or review it
Who will touch critical components, and what checks have they had?	Personnel hazards (sections 9 and 9A) and access limited to critical workers or accompanied visitors (section 11(1)(d))
Can you show that the hardware you deliver or repair has not been tampered with?	CISC's guidance names counterfeit components and hardware tampering in transit as supply chain threats, and suggests checking components before they return to service
How fast can you restore supply or support after a disruption?	Maximum acceptable outage (section 10A(3)(b)) and supplier surge and incident communication arrangements
Will you tell us about changes in subcontractors, locations or logistics?	CISC suggests requiring suppliers to notify material changes to their own supply chains

5.Contract terms to expect

CISC's guidance encourages responsible entities to build controls into contracts at onboarding. For major suppliers it suggests provisions requiring the supplier to:

notify the entity of changes in circumstance, such as a change in ownership structure, a change in the legal or regulatory framework in the supplier's jurisdiction, relevant geopolitical developments, significant operational, financial or reputational issues, or changes to the scope of services or access;
comply with specified security, resilience and assurance requirements; and
take part in audits, risk assessments or information-sharing arrangements.

It also notes that contracts can define what access a vendor has, where data may be stored or processed, what security controls must be kept, and what audit, reporting, assurance and termination rights the buyer holds. Home Affairs publishes an optional FOCI Model Clause Bank for this purpose. In practice these terms are drafted by lawyers: a Clayton Utz case study describes SOCI Act provisions written into a master services agreement for a mining services company that supplies the energy sector.

6.Evidence that answers the hardware questions

Most supplier questionnaires can be answered with policies. The hardware question is harder, because CISC's own worked example says sophisticated counterfeits are difficult to identify through visual inspection alone. Evidence that goes further is something a buyer can attach to its section 10 records. BoardSafe produces that kind of evidence:

each circuit board compared by AI with its original design files, and firmware checked against a known good version, in under 60 seconds per board;
a serial-numbered tamper-evident seal across the case join of each device that passes;
an inspection record for every device, with yearly audits and re-checks after repairs;
work done on site, so devices, design files and data stay on the premises and are not sent to outside AI, systems or third-party staff; and
staff who hold security clearances and undergo mandatory police checks and substance testing.

No rule requires a supplier to have its equipment checked this way, and the service is not a certification. The reasoning is commercial: a buyer that must show its CIRMP covers supply chain hazards has less work to do with a supplier that hands over records than with one that offers assurances, so the evidence can strengthen a bid.

7.Timing

Baseline CIRMP entities already have to list major suppliers and manage the section 10 risks. Enhanced entities must complete section 10A vendor assessments by 10 June 2028. CISC's guidance lets them prioritise suppliers by criticality, level of access and likely risk, but says all major suppliers must be assessed within the timeframe, and encourages reassessment when ownership, jurisdiction, services or access change. Suppliers can expect questions at onboarding, at contract renewal and after any of those changes.

8.What may change for suppliers

The consultation paper proposed two measures aimed at the supply side. Measure 17 would create a "relevant operator" concept for third parties, such as managed service providers, original equipment manufacturers and platform administrators, that exercise material practical control over an asset or a critical function. Measure 19 would clarify how CIRMPs handle cyber security assurance for major suppliers, including contractual or equivalent measures at contract entry or renewal and recognition of current, relevant supplier certifications as evidence. Consultation closed on 31 July 2026, and neither measure is law.

9.A supplier's preparation checklist

Work out which customers' assets are covered by the CIRMP Rules, and whether they are baseline or enhanced (see asset classes).
Prepare a standard ownership, control and jurisdiction statement, and a process for notifying changes.
Document every access path you use into customer systems and sites, including remote and offshore access.
Keep a current description of your cyber security framework and be ready for audit requests.
Record the clearances and checks held by staff who work on customer sites or components.
Keep device-level records for hardware you supply, install or repair.
Write down realistic restoration times so customers can set maximum acceptable outages.

General information, not legal advice. Based on the CIRMP Rules, Compilation No. 2 (10 June 2026), and CISC's CIRMP guidance.

Questions and answers

Does the SOCI Act apply directly to suppliers?: Generally not. The Act places its obligations on the entity that owns or operates the asset. A supplier can carry duties of its own if it is the responsible entity for a critical infrastructure asset, including a data storage or processing asset under section 12F.
What is a major supplier under the CIRMP Rules?: A vendor whose product or service gives it significant influence over the security of the asset. CISC's guidance says size or contract value does not decide it.
Do we need a certification to sell to critical infrastructure entities?: The CIRMP Rules do not require suppliers to hold a certification. The July 2026 consultation paper proposed recognising relevant supplier certifications as evidence, but that is not law.
Why are customers asking about our ownership?: Entities under the enhanced rules must assess each major supplier for foreign ownership, control or influence and sanctions exposure under section 10A, and CISC suggests contract terms requiring suppliers to report ownership changes.