SOCI Act Enhanced CIRMP Rules 2026: What Australian Businesses and SME Suppliers Must Know

On 10 June 2026, Australia's Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 commenced, fundamentally changing how responsible entities — and the SME suppliers who serve them — must manage cyber security risk. For Australian businesses navigating these changes, a qualified cyber consultant is no longer optional: the new rules demand evidence-based compliance, board-level accountability, and a level of technical rigour that most organisations cannot achieve without specialist guidance.

Understanding the 2026 Enhanced CIRMP Rules

The Security of Critical Infrastructure Act 2018 (SOCI Act) regulates 11 sectors and 22 asset classes across Australia, including energy, health, transport, water, and data storage. The Critical Infrastructure Risk Management Program (CIRMP) is the core compliance mechanism under the Act, requiring responsible entities to identify, assess, and manage risks to their critical infrastructure assets.

The 2026 enhanced rules represent a significant shift from documentation-based compliance to demonstrating effective risk management. Where previous requirements focused on having a CIRMP in place, the new rules require responsible entities to show that their controls are actually working — through objective evidence, independent assurance, and board-level oversight.

The reforms also increase civil penalties for breaches of core risk management duties, with proposed increases from 200 to 500 penalty units, reflecting the government's view that the previous penalty regime was insufficient to drive genuine compliance behaviour.

Key Changes Under the Enhanced CIRMP Rules

The 2026 enhanced rules introduce several specific requirements that responsible entities and their cyber consultants must understand and implement.

Prescriptive Security Controls for High-Risk Assets

High-risk assets must now implement specific technical controls, including phishing-resistant multi-factor authentication (MFA), network segmentation between operational technology (OT) and information technology (IT) environments, and improved management of legacy systems. These are not aspirational guidelines — they are mandatory requirements with defined implementation standards.

Evidence-Based Compliance

The shift from documentation to evidence is the most significant practical change for responsible entities. Organisations must now maintain objective evidence of control effectiveness, such as penetration test results, red-team exercise findings, and vulnerability scan outputs. A cyber consultant plays a critical role in designing and executing the testing programs that generate this evidence.

Board-Level Oversight and Independent Assurance

The enhanced rules require mandatory board-level oversight of the CIRMP, with clear ownership and regular reporting to the board on cyber security risk. Periodic independent assurance of CIRMP design and effectiveness is also required — meaning responsible entities must engage qualified third parties to assess whether their risk management programs are fit for purpose.

Incident Reporting Obligations

The SOCI Act's strict incident reporting windows — 12 hours for critical cyber incidents and 72 hours for other significant incidents — remain in place under the enhanced rules. Responsible entities must ensure their internal detection and escalation processes can meet these timeframes, which requires investment in monitoring capabilities and pre-tested incident response procedures.

How the Enhanced Rules Affect SME Suppliers

While the SOCI Act primarily regulates responsible entities — the owners and operators of critical infrastructure assets — the 2026 enhanced rules have significant flow-down implications for SMEs that supply goods or services to those entities.

Responsible entities are now required to identify "relevant operators" and manage risks associated with major suppliers. This means that SMEs providing software, data processing, maintenance, or professional services to critical infrastructure clients are increasingly subject to stringent security questionnaires, contractual requirements, and audit rights.

The government is exploring frameworks for supplier certification and accreditation to reduce the administrative burden of duplicate security assessments. The intent is to allow SMEs to demonstrate cyber due diligence through recognised standards once — rather than responding to bespoke requests from every client. For many SMEs, the ASD Essential Eight at Maturity Level 2 has become the de facto benchmark for "reasonable steps" in security, often required as a prerequisite for remaining on vendor panels for critical infrastructure clients.

Common Mistakes Businesses Make When Responding to SOCI Act Obligations

Whether you are a responsible entity or an SME supplier, the following mistakes are commonly identified by cyber consultants working in the critical infrastructure space.

• Assuming the SOCI Act does not apply — Many businesses are unaware that they are responsible entities, or that their supplier relationships bring them within the scope of the Act's flow-down obligations. A cyber consultant can conduct a scope assessment to determine your actual obligations.
• Treating the CIRMP as a document, not a program — The enhanced rules require evidence of effective risk management, not just a well-written policy document. Businesses that have not tested their controls against real-world threats will struggle to demonstrate compliance.
• Failing to meet incident reporting timeframes — The 12-hour and 72-hour reporting windows are strict. Businesses that have not pre-tested their incident response procedures — including escalation paths, communication templates, and regulatory notification processes — are at high risk of missing these deadlines.
• Neglecting OT/IT network segmentation — Many critical infrastructure operators have historically allowed IT and OT networks to converge for operational convenience. The enhanced rules require segmentation, and retrofitting this control is technically complex and time-consuming.
• Ignoring legacy system risk — Legacy systems that cannot be patched or updated are a significant risk under the enhanced rules. Businesses must have a documented strategy for managing legacy system risk, including compensating controls where replacement is not immediately feasible.

Australian Regulatory Context: SOCI Act, ASD, and the Essential Eight

The SOCI Act is administered by the Department of Home Affairs, with the Australian Signals Directorate (ASD) providing technical guidance on cyber security controls and incident response. The ASD's Essential Eight Maturity Model is the primary framework referenced in SOCI Act compliance guidance, and the enhanced CIRMP rules align closely with Essential Eight requirements at Maturity Level 2 and above.

The 2026 independent review of the SOCI Act, conducted by the Department of Home Affairs, identified several areas where the regulatory framework needed strengthening. The enhanced CIRMP rules are the legislative response to that review, and further reforms — including potential changes to the definition of critical infrastructure assets and the scope of regulated sectors — are expected in 2027.

For SME suppliers, the intersection of SOCI Act obligations with other regulatory frameworks — including APRA CPS 234 for financial services suppliers, the Privacy Act 1988 for entities handling personal information, and the Cyber Security Act 2024 for entities subject to mandatory ransomware reporting — creates a complex compliance landscape. A cyber consultant with experience across these frameworks can help businesses develop a "build once, attest many times" approach that satisfies multiple regulatory requirements without duplicating effort.

The Australian Cyber Security Centre (ACSC), operating within the ASD, publishes regular threat intelligence and guidance that responsible entities and their suppliers should incorporate into their risk management programs. Cyber consultants working in the critical infrastructure space should be actively monitoring ACSC advisories and translating them into actionable control updates for their clients.

Questions to Ask When Choosing a Cyber Consultant for SOCI Act Compliance

If your business is a responsible entity or a supplier to critical infrastructure, the following questions will help you assess whether a cyber consultant has the expertise to support your SOCI Act compliance program.

• Have you conducted CIRMP design and effectiveness reviews under the enhanced 2026 rules? — Experience with the specific requirements of the enhanced rules is essential. Ask for examples of engagements completed since June 2026.
• What is your approach to generating objective evidence of control effectiveness? — Consultants should be able to describe their methodology for penetration testing, red-team exercises, and vulnerability assessments in the context of CIRMP compliance.
• How do you approach OT/IT network segmentation assessments? — This is a technically specialised area. Consultants should have demonstrated experience with operational technology environments, not just IT security.
• Can you help us develop a supplier certification approach? — For responsible entities managing supply chain risk, consultants should be able to design a proportionate supplier assessment framework that aligns with the government's emerging certification approach.
• How do you stay current with ASD and ACSC guidance? — The threat landscape and regulatory guidance evolve rapidly. Consultants should have a clear process for monitoring and incorporating new guidance into their client programs.
• What is your experience with incident response under SOCI Act reporting timeframes? — Consultants should have experience designing and testing incident response procedures that can meet the 12-hour and 72-hour reporting windows.

How MyMoney® Can Help

The 2026 enhanced CIRMP rules have raised the bar for cyber security compliance across Australia's critical infrastructure sectors and their supply chains. Whether you are a responsible entity building an evidence-based CIRMP or an SME supplier seeking to meet your clients' security requirements, a qualified cyber consultant is essential to navigating this landscape effectively.

MyMoney® connects Australian businesses with experienced cyber consultants who understand the full scope of SOCI Act obligations, the ASD Essential Eight, and the intersection of critical infrastructure security with other regulatory frameworks. Post a Brief on MyMoney® to receive tailored proposals from cyber consultants with demonstrated SOCI Act expertise. You can also Browse Cyber Consultants on MyMoney® to compare credentials, experience, and approach before making your decision.

In a regulatory environment where evidence of effective risk management is now mandatory, the right cyber consultant is not just a service provider — they are a critical part of your compliance program.