How many asset classes does the SOCI Act cover?

Section 9(1) names 22 classes of critical infrastructure asset across 11 sectors. Assets can also be declared by the Minister under section 51 or prescribed by the rules.

Do banks need a CIRMP under the SOCI Act?

Critical banking assets are not currently specified in the CIRMP Rules. Of the financial services classes, only financial market infrastructure used for payment systems is specified.

Are data centres covered by the CIRMP Rules?

Critical data storage or processing assets are specified for the baseline CIRMP rules. They are not among the nine classes under the enhanced rules.

Does the SOCI Act apply to assets outside Australia?

Generally not. Section 9(2B) excludes assets to the extent they are located outside Australia, with exceptions for certain satellite facilities.

SOCI Act Compliance › Guidance notes

Guidance note

Which assets does the SOCI Act cover? The 11 sectors and 22 asset classes

Last reviewed 2026-11-14

Summary

The SOCI Act covers 22 named classes of critical infrastructure asset across 11 sectors, from electricity, water and telecommunications to food and grocery, freight and defence industry, plus assets the Minister declares. Covered assets with CIRMP duties must manage supply chain hazards, including the hardware they run on, which BoardSafe checks on site. Which duties apply depends on the asset class.

Whether the SOCI Act reaches an organisation depends first on its sector, then on whether something it owns or operates meets one of the asset definitions in the Act, and then on which obligations the rules switch on for that asset. CISC's SOCI Act page puts the first test simply: if your industry is not one of the 11 sectors, the Act likely does not apply to you.

1.The 11 sectors

Section 8D lists the critical infrastructure sectors:

communications;
data storage or processing;
financial services and markets;
water and sewerage;
energy;
health care and medical;
higher education and research;
food and grocery;
transport;
space technology;
defence industry.

2.The 22 asset classes and their CIRMP rules

Section 9(1) names 22 classes of critical infrastructure asset. The table shows each class, its sector, and whether the baseline or enhanced CIRMP rules apply, from sections 4 and 4A of the CIRMP Rules and the asset class table in CISC's CIRMP guidance.

Sector	Asset class	Baseline CIRMP	Enhanced CIRMP
Communications	Critical telecommunications asset	Separate telecommunications rules	No
Communications	Critical broadcasting asset	Yes	Yes
Communications	Critical domain name system	Yes	Yes
Data storage or processing	Critical data storage or processing asset	Yes	No
Financial services and markets	Critical banking asset	No	No
Financial services and markets	Critical superannuation asset	No	No
Financial services and markets	Critical insurance asset	No	No
Financial services and markets	Critical financial market infrastructure asset	Payment systems only	No
Water and sewerage	Critical water asset	Yes	Yes
Energy	Critical electricity asset	Yes	Yes
Energy	Critical gas asset	Yes	Yes
Energy	Critical energy market operator asset	Yes	Yes
Energy	Critical liquid fuel asset	Yes	Yes
Health care and medical	Critical hospital	Designated hospitals only	No
Higher education and research	Critical education asset	No	No
Food and grocery	Critical food and grocery asset	Yes	No
Transport	Critical port	No	No
Transport	Critical freight infrastructure asset	Yes	Yes
Transport	Critical freight services asset	Yes	Yes
Transport	Critical public transport asset	No	No
Transport	Critical aviation asset	No	No
Defence industry	Critical defence industry asset	No	No

"No" in the baseline column means the CIRMP Rules do not currently specify that class; the asset may still carry other obligations, and an asset can be brought under Part 2A by a ministerial declaration under section 51. CISC's guidance notes that no asset class is currently defined for the space technology sector. Designated hospitals are the critical hospitals listed in Schedule 1 of the CIRMP Rules. Critical telecommunications assets follow the Telecommunications Security and Risk Management Program Rules.

3.Not every duty applies to every asset

The Act switches each obligation on through rules or a declaration: the register in Part 2 (section 18A), the CIRMP in Part 2A (section 30AB) and cyber incident reporting in Part 2B (section 30BB). CISC's regulatory obligations page summarises the duties:

notify external data service providers that store or process business critical data for the asset (subsection 12F(3)), which applies to all critical infrastructure assets;
give operational and ownership information to the Register of Critical Infrastructure Assets (Part 2);
report cyber incidents that have a relevant or significant impact on the asset (Part 2B);
adopt, maintain and comply with a written risk management program (Part 2A).

Critical telecommunications assets and systems of national significance carry further obligations.

4.Who holds the obligations

The responsible entity for each asset class is defined in section 12L of the Act, and the definition differs from class to class. CISC describes a direct interest holder as an entity, such as an individual, company or trust, that holds an interest of at least 10% in the asset together with associates, or an interest that puts it in a position to directly or indirectly influence or control the asset. Direct interest holders have the register obligation; the CIRMP, incident reporting and annual report duties sit with the responsible entity.

5.Edge cases worth checking

Data storage systems that store or process business critical data for an asset are treated as part of that asset (section 9, note 2, and subsection 9(7)).
Assets owned by the Commonwealth, or by a Commonwealth body corporate other than a government business enterprise, are not critical infrastructure assets unless declared or prescribed (section 9(2A)).
Assets located outside Australia are generally excluded (section 9(2B)), with exceptions for some satellite facilities.
The rules can exclude specified assets from any class (section 9(2)).
A newly captured asset has a six-month grace period before the CIRMP duty applies (section 4(2) of the CIRMP Rules).
A critical public transport asset is a network managed by a single entity that can handle at least 5 million passenger journeys a month.
A critical energy market operator asset must be owned or operated by AEMO, Power and Water Corporation, Regional Power Corporation or Electricity Networks Corporation, and be critical to the security and reliability of an energy market or system.

6.Systems of national significance

The Minister can declare an asset a system of national significance (section 52B). CISC lists four enhanced cyber security obligations that can then apply: incident response plans, cyber security exercises, vulnerability assessments, and providing system information.

7.Supply chain duties travel with the asset

Once an asset carries CIRMP duties, its supply chain is in scope: section 10 of the CIRMP Rules covers threats to equipment and products in the chain and risks from major suppliers. That includes the servers, switches, firewalls and controllers the asset runs on. Device-level checks, such as the circuit board and firmware inspections BoardSafe carries out on site, are one way to produce evidence for that part of the program. The supply chain guide explains how.

8.Proposed changes to coverage

The Home Affairs consultation paper on a second tranche of SOCI reforms proposed changes affecting space technology, the health care and medical sector, distributed energy resources, offshore electricity assets and critical freight, and replacing the critical education asset class with a critical research asset class. Consultation closed on 31 July 2026, and these proposals are not law.

General information, not legal advice. Based on the SOCI Act, Compilation No. 9 (4 June 2026).

Questions and answers

How many asset classes does the SOCI Act cover?: Section 9(1) names 22 classes of critical infrastructure asset across 11 sectors. Assets can also be declared by the Minister under section 51 or prescribed by the rules.
Do banks need a CIRMP under the SOCI Act?: Critical banking assets are not currently specified in the CIRMP Rules. Of the financial services classes, only financial market infrastructure used for payment systems is specified.
Are data centres covered by the CIRMP Rules?: Critical data storage or processing assets are specified for the baseline CIRMP rules. They are not among the nine classes under the enhanced rules.
Does the SOCI Act apply to assets outside Australia?: Generally not. Section 9(2B) excludes assets to the extent they are located outside Australia, with exceptions for certain satellite facilities.