Critical Infrastructure Security Changes in Australia: What Businesses Need to Know 

Australia has significantly expanded its critical infrastructure laws. The Security of Critical Infrastructure Act 2018 (SOCI Act), together with the 2022 SLACIP amendments and further 2024 enhancements, now impose much stricter standards. The government has adopted an “all-hazards” approach – combining physical and cyber security – across 11 key sectors (including energy, data centres, and AI facilities). This means businesses in those sectors must rethink risk management to cover cyber attacks, insider threats, supply-chain hazards, natural disasters and even physical sabotage under one program.

Complying with New Obligations for Regulated Entities

Regulated entities are subject to many new obligations. Some of these major changes are:

• Mandatory Risk Management Programs (CIRMPs): Companies must implement a written risk management program identifying material hazards (cyber, physical, personnel, supply chain, etc.) and detailing controls to eliminate or mitigate them. Annual reporting on this program to the Cyber and Infrastructure Security Centre (CISC) is now compulsory. Boards must sign off on these programs, making cyber risk a board-level issue.
• Systems of National Significance (SoNS): The government has expanded the list of “SoNS” assets – a subset of the most vital infrastructure (e.g. major power, water, transport and health facilities) – and imposed even higher standards. These facilities must now undergo regular cyber‑physical security drills and vulnerability assessments. There is an explicit aim of near real-time threat detection for SoNS assets.
• Data and Telecom Coverage: “Business-critical” data storage systems are now explicitly brought under SOCI obligations. Major data centres, cloud and AI infrastructure fall into scope, and telecom security rules have been folded into the SOCI Act. In practice, any IT system holding essential data is treated like a critical asset.
• Government Oversight (“Last Resort” Powers): Regulators (CISC) can compel organisations to strengthen deficient risk programs. New “last resort” powers allow the Home Affairs Minister to intervene directly in extreme incidents (including non-cyber attacks) to protect national security.

These reforms effectively remove any division between IT security and physical security. For example, access controls at a data centre gate and its network firewall must be designed in concert, since the law now treats them as part of a single risk program.

Implications for Business Risk and Governance

For businesses, the stakes are high: compliance lapses now translate into very real risks. Consider the following:

• Governance & Accountability: Executives and boards must treat cyber-physical security as a top priority. New rules explicitly require board or executive sign-off on the risk management program. Company directors can be held personally liable for failures in cyber risk oversight. This raises the bar for board reporting and audit of security practices.
• Incident Response Readiness: Organisations must be ready to detect and report incidents quickly. Under SOCI reforms, critical cyber breaches must be reported to CISC within a matter of hours (often within 12–72 hours). Regulators also expect continuous monitoring: industry guidelines now push for near real-time attack detection on critical networks.
• Vulnerability Testing: Finally, be prepared for ongoing testing. Critical operators are now expected to conduct regular red-team exercises and vulnerability assessments on both IT and physical security systems. Penetration tests, physical intrusion tests, and joint cyber-physical drills are becoming best practices and may soon be mandatory for those SoNS assets.

Getting Ready: Strengthening Resilience

Are you prepared to take the next step? Our team of experts at Protectera work with businesses and boards on developing plans to achieve compliance and resilience. To learn more about how to align your security controls and oversight systems with the new Australian security requirements, contact our specialists at 02 7227 5428 or schedule a no-cost 30-minute consultation. Be sure to follow us on LinkedIn to receive updates about best practices in the area of security.