SOCI Act annual report and board attestation: what is due by 28 September

The annual report is the one point each year when a responsible entity tells its regulator, in writing and with its governing body's approval, whether its critical infrastructure risk management program (CIRMP) was current. This guide covers what section 30AG of the SOCI Act requires, the dates, and what directors should ask before approving.

1.What section 30AG requires

The duty applies if, for all or part of a financial year, an entity was the responsible entity for one or more critical infrastructure assets and had a CIRMP. Within 90 days after the end of the financial year it must give a report that:

• states whether the program was up to date at the end of the financial year;
• if a hazard had a significant relevant impact on an asset during the period, identifies the hazard, evaluates how effective the program was in mitigating that impact, and outlines any variation made because of it;
• for critical telecommunications assets, summarises changes notified to government and describes the risks advised to the entity and the measures taken;
• if the entity was directed to vary its program under section 30AI, sets out the direction and how the program was varied;
• is in the approved form; and
• if the entity has a board, council or other governing body, is approved by that body.

The maximum civil penalty for failing to comply is 150 penalty units (see the penalties guide). Under section 30AG(3), the report is not admissible in evidence against the entity in civil proceedings for a contravention of a civil penalty provision of the Act.

2.Dates

The SOCI Act does not provide for extensions. CISC's CIRMP guidance says the Department may contact an entity that reports late, ask for the report as soon as practicable and consider whether enforcement action is appropriate.

3.Who receives the report

The report goes to the relevant Commonwealth regulator with functions relating to the security of the assets or, if there is none, to the Secretary of the Department of Home Affairs. CISC's guidance says that for critical financial market infrastructure assets the regulator is the Reserve Bank of Australia, and for all other assets it is the Department of Home Affairs. One report per responsible entity can cover several assets. The CIRMP itself is not attached, although the regulator may ask to see it for compliance, assurance or audit purposes.

4.The approved form

CISC's guidance says the approved form is updated each year, within the first three months of the calendar year, and that the Department releases guidance to go with it. Beyond the mandatory statements, it recommends that reports summarise any variations made to the program during the year and assess whether the program was effective, taking account of incidents and lessons learned. Where the report says the program is up to date, the guidance recommends evidence that it has been reviewed and reflects the entity's current operating environment and risk profile.

5.What the board is attesting to

Where an entity has more than one governing body, it chooses the most appropriate one; approval from all of them is not needed. CISC's guidance recommends that the approval confirm three things:

1. the CIRMP was in place and maintained during the reporting period;
2. the information in the report is accurate and complete; and
3. the governing body has oversight of the entity's risk management practices.

The guidance calls it best practice to report to the governing body regularly, escalate material risks, incidents or gaps in a timely way, and give it enough information to support an informed approval. It describes the annual process as a chance for boards to review the program's effectiveness, find areas for improvement and make sure resources are allocated to manage risk. An entity responsible for several assets can give one report per asset or a collective report for all the assets its governing body oversees.

Dr Jill Slay AM's 2026 review of the Act, published by Home Affairs, recorded stakeholder concern that self-attestation by company boards remains common, and some acceptance of bringing a suitably qualified expert into the process to provide external assurance.

6.A pre-approval checklist for directors

• Which assets, and which rule set (baseline, enhanced or telecommunications), does the report cover?
• When was each part of the program last reviewed, and what triggered the review?
• Which hazards had a significant relevant impact this year, and what changed in the program as a result?
• For each hazard category, what evidence shows that controls operated, not only that documents exist? For supply chain controls this can include the major supplier list, vendor assessments and device inspection records, such as those BoardSafe keeps for each device it checks.
• Did any direction, audit or exercise produce findings, and are they closed?
• Is the report in this year's approved form, and is there time to lodge it before 28 September?

The CIRMP checklist can serve as the index of evidence the board reviews.

7.Assets exempt from Part 2A

Assets exempt from the CIRMP duty under section 30AB(4), (5) or (6), such as those covered by a hosting certification at strategic level, still carry an annual reporting duty under Part 2AA (section 30AQ), on the same 90-day timetable and also requiring governing body approval.

8.Proposed changes

The Home Affairs consultation paper on a second tranche of SOCI reforms proposed simplifying annual reporting (Measure 3). Under Measure 15 it proposed requiring the governing body to approve the CIRMP itself, a review at least every 24 months, periodic independent assurance of the program at least once every three years, and removal of the restriction on using annual reports as evidence. Consultation closed on 31 July 2026; none of this is law yet.

General information, not legal advice. Based on the SOCI Act, Compilation No. 9 (4 June 2026).

Questions and answers

When is the SOCI annual report due?

Within 90 days after the end of the financial year, which is 28 September each year.

Do we attach the CIRMP to the annual report?

No. CISC's guidance says the report does not require submission of the CIRMP itself, although the regulator may ask to see the program.

Can we get an extension?

No. CISC's guidance says the SOCI Act does not provide for extensions or exemptions from the annual reporting timeframe.

What if our entity has no board?

The governing body approval requirement applies only if the entity has a board, council or other governing body. The report must still be given in the approved form by 28 September.

Other guidance notes

• CIRMP checklist: what a SOCI Act risk management program must contain
• SOCI Act supply chain hazards: what sections 10 and 10A require, and where hardware fits
• Which assets does the SOCI Act cover? The 11 sectors and 22 asset classes
• SOCI Act penalties and enforcement: what non-compliance can cost
• Enhanced CIRMP Rules 2026: what changed on 10 June and the 2027 and 2028 deadlines
• Selling to critical infrastructure: what the SOCI Act and CIRMP mean for suppliers