Security of Critical Infrastructure: proposed changes to Critical Infrastructure Risk Management Program and enhanced Ministerial Powers

Following an independent review into the Security of Critical Infrastructure Act 2018 (SOCI Act) conducted by Dr Jill Slay AM (the Review), the Department of Home Affairs (the Department) has released the first in a series of proposed changes aimed at implementing a comprehensive legislative restructure that will impact how relevant assets are managed.  

The Review determined that while the SOCI Act had achieved a strong foundation for protecting Australia’s critical infrastructure assets, the Act’s ‘current complexity, regulatory overlap, weak enforcement posture, and gaps in addressing emerging threats’ required a comprehensive legislative restructure. 

In response, the Department accepted all six of the Review’s recommendations in principle, proposing to respond in two tranches. The first tranche of initiatives is in part targeted at addressing recommendation 6 of the Review, and include: 

• proposed amendments to Ministerial Directions Powers in Part 3 of the SOCI Act; and 
   
• an Exposure Draft of proposed enhancements to the Critical Infrastructure Risk Management Program (CIRMP) rules. 

In addition to enhancing the Minister’s powers to deal with security concerns more effectively, the consultation papers propose an enhanced set of CIRMP rules targeting several sectors of critical importance to Australian infrastructure and the broader economy. These changes will be accompanied by a second tranche of amendments at a later stage, which will seek to adopt the remaining recommendations. Further amendments are likely to include an expansion of the assets and sectors currently covered by the SOCI Act, the adoption of stricter penalties for non-compliance, and enhanced guidelines to address areas of emerging risk. 

With the consultation period now concluded, organisations should begin considering how the proposed CIRMP rule changes will impact how relevant assets are managed. In this Insight, we detail the relevant sectors affected and outline the proposed enhanced obligations for those seeking regulatory certainty in the SOCI Act’s evolving framework.  

The proposed enhancements to the CIRMP rules contained in the first tranche of initiatives are intended only to apply to a sub-set of ‘high-risk’ asset classes which are among those already required to develop and maintain a CIRMP under Part 2A of the SOCI Act. These are: 

• critical broadcasting assets; 
   
• critical domain name systems; 
   
• critical electricity assets;
   
• critical energy market operator assets;
   
• critical freight infrastructure assets; 
   
• critical freight services assets;
   
• critical gas assets; 
   
• critical liquid fuel assets; and 
   
• critical water assets. 

The proposed assets were considered by the consultation paper to be high-risk, as they concern the ongoing availability of other critical infrastructure sectors and the broader economy. Further, the identified sectors were chosen in part due to intelligence assessments provided by the National Intelligence Community.  

The initial consultation paper on the enhanced CIRMP obligations was delivered whilst the Review was being conducted. The Review recommended the amendments be accepted, noting that they would increase board and executive accountability for security outcomes by deepening the SOCI Act’s obligations under Part 2A. The Review broadly identified some challenges in implementing the new requirements, including shortages in specialist skills and a need to support smaller operators with limited internal security capabilities.  

We have set out a summary of the proposed additional measures and relevant compliance timelines below. 

All hazard measures

Cyber and information security hazard measures

Supply chain hazard measures

Personnel security hazard measures

Physical and natural hazard measures

As mentioned above, the Department will soon propose further amendments in line with the remaining recommendations contained in the Review. These amendments will likely include a shift to a penalty-based risk management process with a greater focus on enforcement. The adjustment comes as the Review proposes broad changes to enhance the SOCI Act’s ability to respond to emerging technologies and associated threats. Recommendations in the Review include creating a power for the Department to ban dangerous technologies or suppliers. The recommendations recognise the need for the Department to work with other agencies to respond to concerns on emerging technologies (including AI, quantum, physical threat vectors and the role of Operational Technology Cybersecurity). Finally, the Review suggests introducing a requirement for qualified independent experts (such as chartered cyber engineers) to provide external assurances on the organisation’s risk management program.  

The Review also recommends broadening the definition of critical infrastructure in a variety of ways. Recommendation 6(a) suggests expanding the definition to capture new assets and sectors, as well as modifying existing classes to extend the SOCI Act’s current coverage. Suggested changes include covering ‘corporate groups’ (though it is not clear from the Review what is intended to be covered by this proposal), adding space assets to the SOCI Act’s coverage (given its importance to the supply of communications services), and expanding the healthcare and food supply chain protections by adding additional methods of approach.  

The Review specifically calls for consideration to be given to a new definition of the higher education and research sector. The proposed change aims to capture all forms of Higher Education research and institutions such as CSIRO, NHMRC and other medical research, co-operative research centres and projects and Defence-funded research carried out in universities. The proposed amendment comes after the Review concluded that current university foreign interference guidelines are ‘static’ and applied inconsistently, representing a deficiency in an area that faces foreign interference risks around research security. 

Further changes may also be made to the CIRMP rules, with the Review recommending that amendments work towards the simplification and rationalisation of the SOCI Act’s framework to develop a ‘new simpler principles-based SOCI Act.’ 

The consultation period on the proposed amendments closed on 1 May 2026, with the Department now reviewing submissions and determining next steps. While the Exposure Draft is still subject to change, relevant entities for affected ‘high risk’ asset classes should review their existing CIRMP and consider what systems or procedures may need to change to meet the new obligations. Specifically, entities should:

• identify and segregate critical systems; 
   
• consider any required uplifts to their cyber security measures, including compliance with relevant frameworks and the implementation of MFA;
   
• ensure appropriate physical security measures and access controls are in place for critical systems;
   
• review their supply chains and consider any risks from major suppliers, including lack of diversification and FOCI; 
   
• review current personnel security measures; and
   
• consider whether key supplier contracts require uplifting to ensure compliance with the proposed CIRMP requirements (for example, obligations on vendor personnel to undergo relevant background checks or achieve security clearances).