What is the SOCI Act and who must comply?

The Security of Critical Infrastructure Act 2018 (SOCI Act) imposes security obligations on operators across 11 critical infrastructure sectors: energy, water and sewerage, transport, communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology. All operators of critical assets must establish and maintain a Critical Infrastructure Risk Management Program (CIRMP).

What are the Enhanced CIRMP Rules enforceable from 9 June 2026?

The Enhanced CIRMP Rules add four specific obligations: (1) Supply chain mapping - comprehensive documentation of your vendor ecosystem and third-party dependencies; (2) FOCI documentation - assessment of Foreign Ownership, Control or Influence risks; (3) Cyber maturity Level 2 - verification against ACSC guidelines; (4) Network segregation - isolation of critical assets from non-essential systems.

What is FOCI and why does it matter for critical infrastructure?

FOCI stands for Foreign Ownership, Control or Influence. Under the Enhanced CIRMP Rules, critical infrastructure operators must document and assess FOCI risks across their entire vendor ecosystem. This ensures that foreign entities cannot compromise Australia's national security through supply chain relationships.

What are the penalties for SOCI Act non-compliance?

Penalties for SOCI Act non-compliance include substantial fines for organizations and personal liability for directors. Board members must provide annual attestation of compliance. Failure to comply can result in enforcement action, civil penalties, and reputational damage.

How does VRG help with CIRMP compliance?

Vetted Review Group provides independent, board-level assurance for CIRMP compliance. We conduct CIRMP health checks, FOCI assessments, supply chain mapping reviews, cyber maturity assessments, and network segregation verification. Our conflict-free approach ensures unbiased verification with no vendor relationships or conflicts of interest.

What sectors does VRG serve?

VRG serves all 11 critical infrastructure sectors under the SOCI Act: energy (electricity, gas, liquid fuel), water and sewerage, transport (aviation, maritime, rail, road), communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology.

Assurance | Vetted Review Group

Assurance on Vetted Review Group. Critical Infrastructure Assurance.

Pages

Contact — Contact on Vetted Review Group. Critical Infrastructure Assurance.
FAQ — FAQ on Vetted Review Group. Critical Infrastructure Assurance.
Cookie Policy — Cookie Policy on Vetted Review Group. Critical Infrastructure Assurance.
Resources — Resources on Vetted Review Group. Critical Infrastructure Assurance.
Home
Terms Of Service — Terms Of Service on Vetted Review Group. Critical Infrastructure Assurance.
Why VRG — Why VRG on Vetted Review Group. Critical Infrastructure Assurance.
Privacy Policy — Privacy Policy on Vetted Review Group. Critical Infrastructure Assurance.