What is the SOCI Act and who must comply?

The Security of Critical Infrastructure Act 2018 (SOCI Act) imposes security obligations on operators across 11 critical infrastructure sectors: energy, water and sewerage, transport, communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology. All operators of critical assets must establish and maintain a Critical Infrastructure Risk Management Program (CIRMP).

What are the Enhanced CIRMP Rules enforceable from 9 June 2026?

The Enhanced CIRMP Rules add four specific obligations: (1) Supply chain mapping - comprehensive documentation of your vendor ecosystem and third-party dependencies; (2) FOCI documentation - assessment of Foreign Ownership, Control or Influence risks; (3) Cyber maturity Level 2 - verification against ACSC guidelines; (4) Network segregation - isolation of critical assets from non-essential systems.

What is FOCI and why does it matter for critical infrastructure?

FOCI stands for Foreign Ownership, Control or Influence. Under the Enhanced CIRMP Rules, critical infrastructure operators must document and assess FOCI risks across their entire vendor ecosystem. This ensures that foreign entities cannot compromise Australia's national security through supply chain relationships.

What are the penalties for SOCI Act non-compliance?

Penalties for SOCI Act non-compliance include substantial fines for organizations and personal liability for directors. Board members must provide annual attestation of compliance. Failure to comply can result in enforcement action, civil penalties, and reputational damage.

How does VRG help with CIRMP compliance?

Vetted Review Group provides independent, board-level assurance for CIRMP compliance. We conduct CIRMP health checks, FOCI assessments, supply chain mapping reviews, cyber maturity assessments, and network segregation verification. Our conflict-free approach ensures unbiased verification with no vendor relationships or conflicts of interest.

What sectors does VRG serve?

VRG serves all 11 critical infrastructure sectors under the SOCI Act: energy (electricity, gas, liquid fuel), water and sewerage, transport (aviation, maritime, rail, road), communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology.

Independent Assurance Services

SOCI Act Assurance

No Conflicts. No Agenda. Just the Truth.

Independence and objectivity

Focused regulatory expertise

Fixed-fee engagement with defined scope

Service Offerings

Assurance Programmes

VRG provides compliance assurance, not legal advice. Directors should seek independent legal counsel before attesting.

Entry Point

CIRMP Health Check

A rapid, fixed-fee independent review of your existing CIRMP against current SOCI Act obligations and the Enhanced CIRMP Rules (registered 9 June, commenced 10 June 2026).

What's Included

Gap identification across all seven hazard domains
Material risk and regulatory deficiency assessment
8-12 page Board-Ready Assessment Report
Director liability exposure review
Actionable findings and recommendations

$990

5 business days

Full Engagement

Full CIRMP Gap Assessment

End-to-end CIRMP review with comprehensive board-ready reporting, director liability analysis, and a full evidence package across all seven legislated hazard domains.

What's Included

Complete seven-domain CIRMP assessment
FOCI and supply chain risk analysis
Credential compromise and lateral movement review
Physical security and natural hazard documentation
Director due diligence evidence package
Board attestation support materials

From $4,850

2–3 weeks

Ongoing

CIRMP Assurance Programme

Ongoing regulatory surveillance and board-ready reporting, available exclusively to clients following gap assessment completion. Keeps your compliance posture current as legislation evolves.

What's Included

Continuous compliance monitoring
Legislative and regulatory intelligence alerts
Quarterly board-ready updates
Regulatory intelligence briefings
Annual reassessment included

POA

Continuous