Australian Focus
ACSC advisories and regulatory context relevant to Australian critical infrastructure operators.
SOCI Act 2018
The Security of Critical Infrastructure Act 2018 mandates risk management programs for CI entities across 11 sectors including energy, water, transport, and communications.
Key obligations:
- Register critical infrastructure assets with the Cyber and Infrastructure Security Centre (CISC)
- Report cyber security incidents within 12–72 hours depending on severity
- Adopt and maintain a Critical Infrastructure Risk Management Program (CIRMP)
- Comply with government-directed action in the event of serious incidents
CIRMP Rules
Critical Infrastructure Risk Management Programs require responsible entities to identify, manage, and mitigate material risks including cyber and supply chain threats.
Risk categories:
- Cyber and information security
- Personnel (insider threats)
- Supply chain
- Physical security and natural hazards
Annual obligation: Board-approved risk management program with annual report to CISC.
AESCSF
The Australian Energy Sector Cyber Security Framework provides a tailored maturity model for electricity, gas, and liquid fuel operators to assess and improve OT cybersecurity posture.
Framework structure:
- Based on US DOE C2M2 and NIST CSF, adapted for Australian context
- Maturity levels from MIL0 (not performed) to MIL3 (optimised)
- 10 domains covering governance, risk, access control, and situational awareness
- Self-assessment tool provided by AEMO for energy sector participants
ACSC Advisories (0)
ACSC feed currently unavailable
Australian Cyber Security Centre advisories could not be loaded. Visit the ACSC directly for the latest alerts and advisories relevant to Australian critical infrastructure.
Need help securing your OT environment?
Implicit OT provides expert OT/ICS cybersecurity consulting for critical infrastructure.