SOCI Act obligations

The Security of Critical Infrastructure Act 2018 (SOCI Act) sets legal obligations if you own, operate, or hold a direct interest in a critical infrastructure asset. The Cyber and Infrastructure Security Centre (CISC) is the regulator. What applies depends on your role and the asset class. This page is a high-level map, not a determination of whether you are in.

CISC describes three positive security obligations that can apply, depending on asset class: provide operational and ownership information to the Register of Critical Infrastructure Assets (Part 2); report cyber incidents that have a relevant or significant impact on the asset (Part 2B); and adopt, maintain and comply with a written risk management program (Part 2A). There is also an obligation to notify data service providers (s 12F(3)).

Mandatory cyber incident reporting is Part 2B. Clocks run from when the responsible entity becomes aware: 12 hours if the incident has had or is having a significant impact on availability of the asset; 72 hours for other cyber incidents with a relevant impact. If you report orally, the written approved-form follow-up is 84 hours after the oral report for the 12-hour duty (s 30BC) and 48 hours after the oral report for the 72-hour duty (s 30BD). Detail, definitions, and who files sit on the SOCI cyber incident clock page.

Assets declared Systems of National Significance carry Enhanced Cyber Security Obligations: incident response plans, cyber security exercises, vulnerability assessments, and providing system information so government can keep a near-real-time threat picture. Government assistance measures exist for incidents that would cause serious harm to Australia's prosperity, national security, or defence. They are last-resort tools, not a retainer.

If you think you might be a responsible entity, read the CISC obligation pages and the asset-class guidance. Do not guess yourself out of the Act. Do not treat a vendor questionnaire as a substitute for the register or the 12/72-hour clock.