What is the maximum penalty for not having a CIRMP?

200 penalty units. At $364 a unit that is $72,800 for an individual, and a court can order a body corporate to pay up to five times that, or $364,000.

Can the regulator issue a penalty without going to court?

Yes. Every civil penalty provision of the SOCI Act can be the subject of an infringement notice under the Regulatory Powers Act. Larger penalties require a court order.

Is the CIRMP penalty going up to 500 penalty units?

It has been proposed. The Home Affairs consultation paper on a second tranche of SOCI reforms proposed the increase, but it is not law.

How long does the regulator have to bring proceedings?

An application for a civil penalty order must be made within six years of the alleged contravention, under section 82(2) of the Regulatory Powers Act.

SOCI Act Compliance › Guidance notes

Guidance note

SOCI Act penalties and enforcement: what non-compliance can cost

Last reviewed 2026-11-14

Summary

Most SOCI Act duties carry civil penalties: 200 penalty units for CIRMP failures, 150 for the annual report and 50 for cyber incident reporting, and a court can order a company to pay up to five times that. Records showing controls in operation, such as dated hardware inspection records, help an entity respond if the regulator asks.

The SOCI Act enforces its obligations mainly through civil penalties rather than criminal offences. This guide lists the maximums, converts them to dollars on current figures, and explains how the regulator can act.

1.Maximum penalties by obligation

Obligation	Section	Penalty units	Individual	Body corporate
Adopt and maintain a CIRMP	30AC	200	$72,800	$364,000
Comply with the CIRMP	30AD	200	$72,800	$364,000
Review the CIRMP regularly	30AE	200	$72,800	$364,000
Keep the CIRMP up to date	30AF	200	$72,800	$364,000
Have regard to the Rules when adopting, reviewing or varying the CIRMP	30AKA	200	$72,800	$364,000
Give the annual report	30AG	150	$54,600	$273,000
Comply with a direction to vary the CIRMP	30AI	250	$91,000	$455,000
Report a critical cyber security incident within 12 hours	30BC	50	$18,200	$91,000
Report another cyber security incident within 72 hours	30BD	50	$18,200	$91,000
Give initial register information	23	50	$18,200	$91,000
Notify register events within 30 days	24	50	$18,200	$91,000
Tell a data storage or processing provider that it handles business critical data	12F(3)	50	$18,200	$91,000

Dollar figures use $364 per penalty unit and, for companies, the five-times multiplier explained below. They are the maximums a court may order, not fixed fines.

2.What a penalty unit is worth

The Crimes (Amount of a Penalty Unit) Instrument 2026 sets a Commonwealth penalty unit at $364 from 1 July 2026, as indexed under section 4AA of the Crimes Act 1914. The instrument notes that the amount applies to offences committed on or after 1 July 2026, so the figure for a given contravention depends on when the conduct occurred. Section 82(5) of the Regulatory Powers (Standard Provisions) Act 2014 caps the penalty a court can order at five times the specified amount for a body corporate, and at the specified amount for anyone else.

3.How the Act is enforced

Part 5 of the SOCI Act applies the standard Commonwealth regulatory toolkit to every civil penalty provision:

Civil penalty orders from the Federal Court, the Federal Circuit and Family Court (Division 2) or a state or territory court, on application by the Secretary or a person the Secretary appoints (section 49). The application must be made within six years of the contravention (Regulatory Powers Act section 82(2)).
Enforceable undertakings to comply with a civil penalty provision, which can be accepted and then enforced.
Injunctions to restrain a contravention or compel compliance.
Infringement notices, which any civil penalty provision of the Act can attract (section 49C).
Monitoring and investigation powers, including entry and inspection, which also cover the accuracy of information given under the Act (sections 49A and 49B).

In setting a penalty, a court must take into account the nature and extent of the contravention, any loss or damage it caused, the circumstances in which it occurred, and whether the person has previously been found to have engaged in similar conduct (Regulatory Powers Act section 82(6)).

4.Rules that shape the outcome

Several provisions of the Regulatory Powers Act and the SOCI Act affect how far exposure can run:

If one course of conduct contravenes two or more civil penalty provisions, proceedings can be brought for any of them, but the person is not liable to more than one pecuniary penalty for the same conduct (section 84).
A court can make a single civil penalty order for multiple contraventions founded on the same facts or forming a series of contraventions of the same or a similar character (section 85).
A pecuniary penalty is a debt payable to the Commonwealth and is enforced as a judgment debt (section 83).
An annual report given under section 30AG is not admissible in evidence against the entity in civil penalty proceedings under the SOCI Act (section 30AG(3)).

Separately, CISC's SOCI Act page warns that it is an offence to disclose protected information about critical infrastructure assets, even for a responsible entity, unless the disclosure complies with the Act. That matters when sharing CIRMP material with consultants, auditors and suppliers.

5.Directions to fix a program

If a relevant official is satisfied that a CIRMP has a serious deficiency, meaning one that poses a material risk to national security, the defence of Australia, or the social or economic stability of Australia or its people, the official may direct the entity to vary it (section 30AI). The entity must first be given notice and 14 days to make a written submission, the direction must allow at least 14 days to vary the program, and failing to comply carries up to 250 penalty units. The direction and the resulting changes must then be set out in the next annual report.

6.How the regulator says it will act

CISC's SOCI Act page says that from 2026-27 it is changing its compliance posture in response to the threat environment and the 2026 review of the Act. It will continue education and awareness work with regulated entities, while focusing on measures to address potential or identified non-compliance. That review, by Dr Jill Slay AM, recommended moving from a "light touch" approach focused on administration and documentation to a penalty-based risk management process with real enforcement of penalties (Recommendation 2 of the final report).

7.Proposed increase to 500 penalty units

Measure 16 in the Home Affairs consultation paper proposed raising the maximum for selected core preventive and assurance duties, including having, complying with, reviewing and updating a CIRMP, from 200 to 500 penalty units. Routine reporting, entity-change notifications and cyber incident notification would stay at their current levels. Consultation closed on 31 July 2026, and the change is not law.

8.Reducing exposure in practice

Keep a dated record of every CIRMP review and what changed (sections 30AE and 30AF).
Map each CIRMP requirement to a document and an owner, as CISC's guidance suggests.
Keep evidence that controls run. For hardware in the supply chain, per-device inspection records and seal numbers from a provider such as BoardSafe show when each device was last checked.
Rehearse the 12-hour and 72-hour cyber reporting steps, including the written record due within 84 hours (critical incidents) or 48 hours (other incidents) after an oral report.
Put the 28 September annual report deadline and the board meeting that approves it into the governance calendar; see the annual report guide.

General information, not legal advice. Based on the SOCI Act, Compilation No. 9 (4 June 2026), and the Regulatory Powers (Standard Provisions) Act 2014, Compilation No. 4.

Questions and answers

What is the maximum penalty for not having a CIRMP?: 200 penalty units. At $364 a unit that is $72,800 for an individual, and a court can order a body corporate to pay up to five times that, or $364,000.
Can the regulator issue a penalty without going to court?: Yes. Every civil penalty provision of the SOCI Act can be the subject of an infringement notice under the Regulatory Powers Act. Larger penalties require a court order.
Is the CIRMP penalty going up to 500 penalty units?: It has been proposed. The Home Affairs consultation paper on a second tranche of SOCI reforms proposed the increase, but it is not law.
How long does the regulator have to bring proceedings?: An application for a civil penalty order must be made within six years of the alleged contravention, under section 82(2) of the Regulatory Powers Act.