What is a major supplier under the CIRMP Rules?

Any vendor that, because of the product or service it offers, has a significant influence over the security of the responsible entity's critical infrastructure asset.

Do we have to map our whole supply chain?

Under the baseline rules, the program must list major suppliers and describe supply chain hazards. Enhanced assets must also map the supply chain for major suppliers and critical components under section 10A, by 10 June 2028 for assets covered before 10 June 2026.

Does a hardware inspection make us compliant with section 10?

No. Inspection records are evidence for part of the supply chain hazard category. The entity still has to address all six section 10 risks, list major suppliers and, for enhanced assets, map suppliers and assess vendors.

Where does CISC mention counterfeit parts?

CISC's 2026 CIRMP guidance lists counterfeit components as a threat to products and services, and includes a worked CIRMP entry for a counterfeit component introduced through the supply chain.

SOCI Act Compliance › Guidance notes

Guidance note

SOCI Act supply chain hazards: what sections 10 and 10A require, and where hardware fits

Last reviewed 2026-11-14

Summary

Section 10 of the CIRMP Rules requires every responsible entity to minimise six kinds of supply chain risk, list its major suppliers and describe its supply chain hazards. Hardware is part of this: CISC guidance names counterfeit components and tampered hardware, and BoardSafe checks devices' circuit boards and firmware and keeps a per-device record a CIRMP can cite. Enhanced assets must also map suppliers and assess vendors under section 10A by 10 June 2028.

Supply chain is one of the four hazard categories every CIRMP must address under the CIRMP Rules. This guide sets out what section 10 requires of all responsible entities, what section 10A adds for the nine enhanced asset classes, and how checks on hardware can be used as evidence.

1.What counts as a supply chain hazard

The Rules define a supply chain hazard as including malicious people, inside or outside the organisation, exploiting, misusing, accessing or disrupting the supply chain, and over-reliance on particular suppliers. A major supplier is any vendor whose product or service gives it significant influence over the security of the asset. Both definitions are broad: a firmware supplier, a maintenance contractor and a logistics provider can all fall within them.

2.Section 10: the baseline rule

Every responsible entity with a CIRMP must have a process or system to minimise or eliminate, so far as reasonably practicable, these material risks:

unauthorised access, interference or exploitation of the asset's supply chain;
misuse of privileged access to the asset by any provider in the supply chain;
disruption of the asset due to an issue in the supply chain;
threats to people, assets, equipment, products, services, distribution and intellectual property within supply chains;
risks arising from major suppliers;
failure or lowered capacity of other assets and entities in the supply chain.

The program must also mitigate the impact of a supply chain hazard, and the entity must have regard to whether the program lists its major suppliers and describes the supply chain hazards that could affect the asset (section 10(2)).

3.Section 10A: mapping and vendor assessment

For critical broadcasting, domain name system, electricity, energy market operator, freight infrastructure, freight services, gas, liquid fuel and water assets, section 10A adds two systems. Assets that were already critical infrastructure assets before 10 June 2026 must comply by 10 June 2028, according to CISC's enhanced CIRMP snapshot.

Requirement	What the program must do
Supply chain mapping (10A(2)-(3))	Map the supply chain for major suppliers and critical components; identify risks to the availability, integrity, reliability or confidentiality of critical components or business critical data; identify the maximum acceptable outage for the asset and its critical components; and include measures to minimise those risks or mitigate an outage that exceeds the maximum.
Vendor assessment (10A(4)-(5))	For each existing or proposed major supplier, identify the FOCI-related legal requirements the supplier is subject to, restrictions or sanctions affecting the jurisdiction, the access, influence and control the supplier has over the asset, whether these together present a material risk or could exceed a maximum acceptable outage, and the steps to minimise that risk.

The Rules give supplier diversification, redundancy planning, and recovery, resilience and restoration processes as examples of mitigation measures.

4.Where hardware comes in

CISC's CIRMP guidance (2026) gives several hardware examples in its supply chain chapter:

Under threats to products and services: counterfeit components, and hardware used by an asset that has been compromised with malicious code.
Under interference: tampering with hardware or software during manufacturing, transit or delivery that introduces unreliable components.
Under unauthorised access: an intruder in a manufacturer's production systems tampering with components before delivery.

Its suggested controls include recording the provenance of critical components through their life, controlling their movement between environments of different trust (such as from IT into operational technology), and, when a component leaves the entity's control for maintenance, repair or disposal, checking it before it is reintegrated. The guidance's worked CIRMP entry on counterfeit parts lists inspecting and testing critical components before installation, in proportion to their criticality, as a preventive control, and says sophisticated counterfeits are difficult to identify through visual inspection alone.

5.Turning hardware checks into CIRMP evidence

BoardSafe checks the hardware organisations run on, including phone systems, servers, Wi-Fi routers, switches, firewalls, printers and building and plant controllers, for hidden spy chips, fake or swapped parts and altered firmware. The table maps what it does to the rules and guidance above.

CIRMP need	Source	What a BoardSafe check provides
Inspection and testing of critical components beyond a visual check	CISC guidance, worked example	Each circuit board compared by AI with its original design files, and firmware checked against a known good version, in under 60 seconds per board
Checking components before reintegration after repair	CISC guidance, provenance controls	Re-checks after repairs, recorded against the device
Showing a device has not been opened since it was checked	Section 10(1)(a), interference risk	A serial-numbered tamper-evident seal across the case join, and yearly audits
Keeping schematics and configuration data in Australia	Section 6(d) material risk	Work done on site; devices, design files and data stay on the customer's premises, and no data goes to outside AI, systems or third-party staff
Knowing who handles critical components	Sections 9 and 11(1)(d)	Staff hold security clearances and undergo mandatory police checks and substance testing

BoardSafe reports finding 97% of planted faults in internal testing. Its checks are a source of evidence, not a certification or a government approval, and the entity remains responsible for its program.

6.Questions to ask a hardware or supply chain provider

Which device types can you check, and how do you verify a board or its firmware against a known reference rather than by eye?
Where do our design files, configuration data and results go during the work? Is anything processed offshore or by third-party AI tools?
What record do we get for each device, and can it be matched to our asset register?
How will we know later whether a checked device has been opened?
What clearances and background checks do your staff hold?
Does the check affect the manufacturer's warranty? (BoardSafe says warranty is usually unaffected, depending on the device type.)
Will you become a major supplier or gain privileged access, and so need your own vendor assessment?

7.What a hardware check does not cover

Device checks speak to the integrity of the components in hand. They do not map major suppliers, assess FOCI exposure, set maximum acceptable outages or diversify supply. Those remain program-level tasks for the entity, often with a consultancy from the provider register and, for contract terms, a law firm. The CIRMP checklist shows where supply chain sits among the other hazard categories.

8.What may change

The Home Affairs consultation paper on a second tranche of SOCI reforms, open until 31 July 2026, proposed clarifying how CIRMPs should handle cyber security assurance for major suppliers (Measure 19). It suggested contractual or equivalent measures at contract entry, renewal or material variation, and recognising current, relevant supplier certifications as evidence, and it named original equipment manufacturers and firmware providers among the relationships in scope. These are proposals, not law.

General information, not legal advice. Based on the CIRMP Rules, Compilation No. 2 (10 June 2026), and CISC's CIRMP guidance.

Questions and answers

What is a major supplier under the CIRMP Rules?: Any vendor that, because of the product or service it offers, has a significant influence over the security of the responsible entity's critical infrastructure asset.
Do we have to map our whole supply chain?: Under the baseline rules, the program must list major suppliers and describe supply chain hazards. Enhanced assets must also map the supply chain for major suppliers and critical components under section 10A, by 10 June 2028 for assets covered before 10 June 2026.
Does a hardware inspection make us compliant with section 10?: No. Inspection records are evidence for part of the supply chain hazard category. The entity still has to address all six section 10 risks, list major suppliers and, for enhanced assets, map suppliers and assess vendors.
Where does CISC mention counterfeit parts?: CISC's 2026 CIRMP guidance lists counterfeit components as a threat to products and services, and includes a worked CIRMP entry for a counterfeit component introduced through the supply chain.