SOCI Act

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-06-04 Compilation No. 9 of the SOCI Act takes effect
2. 2025-04-04 Security regulation for critical telecommunications assets (Schedule 5 of the Enhanced Response and Prevention Act 2024) takes effect in the SOCI Act
3. 2024-12-20 Enhanced Response and Prevention Act 2024 amendments (data storage systems, consequence management, protected information, risk management program directions) take effect
4. 2024-11-29 Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 is made

1. 2026-06-04
   Security of Critical Infrastructure Act 2018 (Compilation No. 9) AmendmentCurrent text

   Minor amendments by the Strengthening Oversight of the National Intelligence Community Act 2025 (Schedule 1, items 269 and 270). source

2. 2025-04-04
   Compilation No. 8 (Enhanced Response and Prevention Act, Schedule 5) Amendment

   Schedule 5 of the 2024 Enhanced Response and Prevention Act took effect: security regulation for critical telecommunications assets. source

3. 2024-12-20
   Compilation No. 7 (Enhanced Response and Prevention Act) Amendment

   Schedules 1 to 4, 6 and 8 of the 2024 Enhanced Response and Prevention Act took effect. source

   More

   • Schedule 1 - data storage systems that hold business critical data.
   • Schedule 2 - managing the consequences of incidents affecting critical infrastructure assets.
   • Schedule 3 - use and disclosure of protected information.
   • Schedule 4 - directions to vary a critical infrastructure risk management program.
   • Schedule 6 - notification of a declaration of a system of national significance.
   • Schedule 8 - other amendments.
4. 2023-10-20
   Compilation No. 6 Amendment

   Minor amendments by the Treasury Laws Amendment (2023 Law Improvement Package No. 1) Act 2023. source

5. 2023-10-18
   Compilation No. 5 Amendment

   Minor amendment by the Statute Law Amendment (Prescribed Forms and Other Updates) Act 2023. source

The Act reaches critical infrastructure assets in eleven sectors; which obligations apply depends on the asset class.

Sectors

Communications; data storage or processing; financial services and markets; water and sewerage; energy; health care and medical; higher education and research; food and grocery; transport; space technology; defence industry (section 8D). source

Who

The obligations likely apply where an organisation's sector is listed and it owns, operates or has a direct interest in a critical infrastructure asset. source

Positive security obligations

Give ownership and operational information to the Register of Critical Infrastructure Assets, report cyber incidents, and adopt, maintain and comply with a written risk management program, depending on the asset class. source

Systems of national significance

Assets declared systems of national significance can also face enhanced cyber security obligations: incident response plans, exercises, vulnerability assessments and system information. source

Responsible entities keep a written risk management program and give an annual report on it, approved by their board, within 90 days after the end of the financial year.

Risk management program

A responsible entity must have, comply with, regularly review and keep up to date a critical infrastructure risk management program (section 30AC). source

Annual report

Within 90 days after the end of the financial year, give a report on the program, approved by the board, council or other governing body where there is one (section 30AG). source

Critical incidents

Report a cyber security incident that has a significant impact on the availability of the asset as soon as practicable and in any event within 12 hours (section 30BC). source

Other incidents

Report other cyber security incidents that have, or are likely to have, a relevant impact on the asset as soon as practicable and in any event within 72 hours (section 30BD). source

Key obligations are civil penalty provisions; the CISC regulates compliance and is evolving its compliance posture from 2026-27.

Regulatory posture

From 2026-27 the CISC is evolving its compliance posture in response to the threat environment and the 2026 Independent Review of the SOCI Act, focusing on potential or identified non-compliance. source

Government assistance

Government assistance measures apply only to incidents that will cause serious harm to Australia's prosperity, national security or defence. source

Protected information

Disclosing protected information about critical infrastructure assets is an offence unless the disclosure complies with the Act. source

1. Law text Security of Critical Infrastructure Act 2018 (latest compilation)
2. Law text Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024
3. Guidance CISC - SOCI Act 2018 overview and obligations
4. Guidance 2026 Independent Review of the SOCI Act - final report

1. NIS2

   The EU directive on cybersecurity risk management and incident reporting for essential and important entities, transposed by each Member State.

2. CER Directive

   The EU directive on the physical and all-hazards resilience of critical entities.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 29 September 2026. Subscribe to SOCI Act (RSS)