What is the SOCI Act and who must comply?

The Security of Critical Infrastructure Act 2018 (SOCI Act) imposes security obligations on operators across 11 critical infrastructure sectors: energy, water and sewerage, transport, communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology. All operators of critical assets must establish and maintain a Critical Infrastructure Risk Management Program (CIRMP).

What are the Enhanced CIRMP Rules enforceable from 9 June 2026?

The Enhanced CIRMP Rules add four specific obligations: (1) Supply chain mapping - comprehensive documentation of your vendor ecosystem and third-party dependencies; (2) FOCI documentation - assessment of Foreign Ownership, Control or Influence risks; (3) Cyber maturity Level 2 - verification against ACSC guidelines; (4) Network segregation - isolation of critical assets from non-essential systems.

What is FOCI and why does it matter for critical infrastructure?

FOCI stands for Foreign Ownership, Control or Influence. Under the Enhanced CIRMP Rules, critical infrastructure operators must document and assess FOCI risks across their entire vendor ecosystem. This ensures that foreign entities cannot compromise Australia's national security through supply chain relationships.

What are the penalties for SOCI Act non-compliance?

Penalties for SOCI Act non-compliance include substantial fines for organizations and personal liability for directors. Board members must provide annual attestation of compliance. Failure to comply can result in enforcement action, civil penalties, and reputational damage.

How does VRG help with CIRMP compliance?

Vetted Review Group provides independent, board-level assurance for CIRMP compliance. We conduct CIRMP health checks, FOCI assessments, supply chain mapping reviews, cyber maturity assessments, and network segregation verification. Our conflict-free approach ensures unbiased verification with no vendor relationships or conflicts of interest.

What sectors does VRG serve?

VRG serves all 11 critical infrastructure sectors under the SOCI Act: energy (electricity, gas, liquid fuel), water and sewerage, transport (aviation, maritime, rail, road), communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology.

Get in Touch

Contact Us

To discuss your organisation's CIRMP obligations, complete the form below.

Strictly confidential

Response within 1 business day

Without obligation

Our Services

CIRMP Health Check$990

Independent compliance posture review. Fixed fee, 5 business days.

Full Gap Assessment$4,850+

End-to-end CIRMP review with board-ready reporting.

Assurance ProgrammePOA

Ongoing regulatory surveillance. Pricing on engagement.

mark@vettedreviewgroup.com.au

Location

470 St Kilda Road, Melbourne VIC 3004