What is the SOCI Act and who must comply?

The Security of Critical Infrastructure Act 2018 (SOCI Act) imposes security obligations on operators across 11 critical infrastructure sectors: energy, water and sewerage, transport, communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology. All operators of critical assets must establish and maintain a Critical Infrastructure Risk Management Program (CIRMP).

What are the Enhanced CIRMP Rules enforceable from 9 June 2026?

The Enhanced CIRMP Rules add four specific obligations: (1) Supply chain mapping - comprehensive documentation of your vendor ecosystem and third-party dependencies; (2) FOCI documentation - assessment of Foreign Ownership, Control or Influence risks; (3) Cyber maturity Level 2 - verification against ACSC guidelines; (4) Network segregation - isolation of critical assets from non-essential systems.

What is FOCI and why does it matter for critical infrastructure?

FOCI stands for Foreign Ownership, Control or Influence. Under the Enhanced CIRMP Rules, critical infrastructure operators must document and assess FOCI risks across their entire vendor ecosystem. This ensures that foreign entities cannot compromise Australia's national security through supply chain relationships.

What are the penalties for SOCI Act non-compliance?

Penalties for SOCI Act non-compliance include substantial fines for organizations and personal liability for directors. Board members must provide annual attestation of compliance. Failure to comply can result in enforcement action, civil penalties, and reputational damage.

How does VRG help with CIRMP compliance?

Vetted Review Group provides independent, board-level assurance for CIRMP compliance. We conduct CIRMP health checks, FOCI assessments, supply chain mapping reviews, cyber maturity assessments, and network segregation verification. Our conflict-free approach ensures unbiased verification with no vendor relationships or conflicts of interest.

What sectors does VRG serve?

VRG serves all 11 critical infrastructure sectors under the SOCI Act: energy (electricity, gas, liquid fuel), water and sewerage, transport (aviation, maritime, rail, road), communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology.

Legal & Compliance

Cookie Policy

This Cookie Policy explains how VRG uses cookies and similar tracking technologies on our website. By using our website, you consent to the use of cookies as described here. Read in conjunction with our Privacy Policy.

What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help websites function properly, improve security and user experience, and provide usage information to website owners.

1.1 How Cookies Work

Cookies can be session cookies (deleted when you close your browser) or persistent cookies (remaining for a set period). They may store a unique device identifier, preference data, pages visited, and visit timestamps.

Types of Cookies We Use

2.1 Essential Cookies

These are strictly necessary for our website to function and cannot be disabled. They enable navigation, secure form submissions, and session management. They do not require your consent.

2.2 Analytics Cookies

These help us understand how visitors interact with our website. They collect anonymised information about visitor counts, popular pages, and navigation patterns to improve performance. Data collected includes pseudonymised IP addresses, browser type, device type, and pages visited.

Why We Use Cookies

Website Functionality — to enable essential features including secure form submissions
Security — to protect against fraudulent activity and unauthorised access
User Experience — to make our website more intuitive and responsive
Performance Monitoring — to identify and fix technical issues
Site Traffic Analysis — to inform content and business decisions

What We Do NOT Use Cookies For

No Targeted Advertising — we do not track you across websites for ads
No Selling of Data — we do not sell or trade cookie data to third parties
No Behavioural Profiling — we do not build profiles for marketing purposes
No Third-Party Commercial Tracking — we do not allow third parties to track you for their own interests

How to Manage or Disable Cookies

5.1 Browser Settings

Most browsers allow you to block, delete, or manage cookies through their settings:

Google Chrome: Settings → Privacy and Security → Cookies and other site data
Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
Safari: Preferences → Privacy → Cookies and website data
Microsoft Edge: Settings → Cookies and site permissions

5.2 Impact of Disabling Cookies

Blocking essential cookies may prevent access to certain features. Disabling analytics cookies does not affect functionality but limits our ability to improve the site.

Third-Party Cookies and Services

Where we use trusted third-party services for analytics, they are contractually obligated to use your information only as specified by us, maintain confidentiality, and not use it for their own commercial purposes.

Updates to This Policy

We may update this Cookie Policy to reflect changes in technology, practices, or legal requirements. Changes will be posted with an updated effective date.

More Information

For more detail on how we collect, use, and protect your personal information, see our Privacy Policy.

Contact Us

For any questions or feedback regarding this Cookie Policy:

Vetted Review Group Pty Ltd

ABN: 92 693 553 418 · 470 St Kilda Road, Melbourne VIC 3004

Email: support@vettedreviewgroup.com.au