What is the SOCI Act and who must comply?

The Security of Critical Infrastructure Act 2018 (SOCI Act) imposes security obligations on operators across 11 critical infrastructure sectors: energy, water and sewerage, transport, communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology. All operators of critical assets must establish and maintain a Critical Infrastructure Risk Management Program (CIRMP).

What are the Enhanced CIRMP Rules enforceable from 9 June 2026?

The Enhanced CIRMP Rules add four specific obligations: (1) Supply chain mapping - comprehensive documentation of your vendor ecosystem and third-party dependencies; (2) FOCI documentation - assessment of Foreign Ownership, Control or Influence risks; (3) Cyber maturity Level 2 - verification against ACSC guidelines; (4) Network segregation - isolation of critical assets from non-essential systems.

What is FOCI and why does it matter for critical infrastructure?

FOCI stands for Foreign Ownership, Control or Influence. Under the Enhanced CIRMP Rules, critical infrastructure operators must document and assess FOCI risks across their entire vendor ecosystem. This ensures that foreign entities cannot compromise Australia's national security through supply chain relationships.

What are the penalties for SOCI Act non-compliance?

Penalties for SOCI Act non-compliance include substantial fines for organizations and personal liability for directors. Board members must provide annual attestation of compliance. Failure to comply can result in enforcement action, civil penalties, and reputational damage.

How does VRG help with CIRMP compliance?

Vetted Review Group provides independent, board-level assurance for CIRMP compliance. We conduct CIRMP health checks, FOCI assessments, supply chain mapping reviews, cyber maturity assessments, and network segregation verification. Our conflict-free approach ensures unbiased verification with no vendor relationships or conflicts of interest.

What sectors does VRG serve?

VRG serves all 11 critical infrastructure sectors under the SOCI Act: energy (electricity, gas, liquid fuel), water and sewerage, transport (aviation, maritime, rail, road), communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology.

VRG Publications

Resources & Publications

Free executive briefing and practical compliance tools for critical infrastructure operators.

Independent analysis

Board-ready reporting

Immediate PDF delivery

Part I · Knowledge Library

Free Resource

Executive Briefing

12pp · 1.2 MB

VRG 2026 Executive Briefing

VRG-2026-EB-001

The definitive briefing on Australia's Enhanced CIRMP Rules — obligations, timelines and board implications.

12pp · 1.2 MB

Part II · Compliance Toolkits

Compliance Programmes

FOCI Vendor Risk Snapshot

Foreign Ownership, Control or Influence · VRG-2026-TK-005

$97

AUD

Rapidly assess FOCI exposure across your vendor ecosystem with this structured risk toolkit.

Includes

FOCI risk indicator framework
Vendor screening criteria checklist
Red flag identification guide
Risk Priority Matrix

Instant PDF download

CIRMP Director Liability Checklist

Board-Level Compliance Assurance · VRG-2026-TK-006

$197

AUD

Verify your organisation's CIRMP obligations under the SOCI Act — including the 2026 Enhanced Rules where they apply to your asset class — built for directors.

Includes

Director attestation requirements
CIRMP obligation verification points
Board governance checklist
Personal liability exposure guide
Annual review framework

Instant PDF download