What is the SOCI Act and who must comply?

The Security of Critical Infrastructure Act 2018 (SOCI Act) imposes security obligations on operators across 11 critical infrastructure sectors: energy, water and sewerage, transport, communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology. All operators of critical assets must establish and maintain a Critical Infrastructure Risk Management Program (CIRMP).

What are the Enhanced CIRMP Rules enforceable from 9 June 2026?

The Enhanced CIRMP Rules add four specific obligations: (1) Supply chain mapping - comprehensive documentation of your vendor ecosystem and third-party dependencies; (2) FOCI documentation - assessment of Foreign Ownership, Control or Influence risks; (3) Cyber maturity Level 2 - verification against ACSC guidelines; (4) Network segregation - isolation of critical assets from non-essential systems.

What is FOCI and why does it matter for critical infrastructure?

FOCI stands for Foreign Ownership, Control or Influence. Under the Enhanced CIRMP Rules, critical infrastructure operators must document and assess FOCI risks across their entire vendor ecosystem. This ensures that foreign entities cannot compromise Australia's national security through supply chain relationships.

What are the penalties for SOCI Act non-compliance?

Penalties for SOCI Act non-compliance include substantial fines for organizations and personal liability for directors. Board members must provide annual attestation of compliance. Failure to comply can result in enforcement action, civil penalties, and reputational damage.

How does VRG help with CIRMP compliance?

Vetted Review Group provides independent, board-level assurance for CIRMP compliance. We conduct CIRMP health checks, FOCI assessments, supply chain mapping reviews, cyber maturity assessments, and network segregation verification. Our conflict-free approach ensures unbiased verification with no vendor relationships or conflicts of interest.

What sectors does VRG serve?

VRG serves all 11 critical infrastructure sectors under the SOCI Act: energy (electricity, gas, liquid fuel), water and sewerage, transport (aviation, maritime, rail, road), communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology.

Why VRG

No Conflicts. No Agenda. Just the Truth.

Independent assurance means nothing without structural independence.

Direct delivery, no handoffs

Sole focus on critical infrastructure

Evidence fit for board scrutiny

Our Approach

Independent

VRG does not sell, implement, or manage security solutions.

Specialist

Critical infrastructure is VRG’s exclusive focus.

Evidence-Based

Every finding traces to SOCI Act obligations.

Board-Ready

Executive intelligence for governance review.

Comparison

Capability	VRG	Traditional
Independence	Zero conflicts	Audit their own work
Expertise	SOCI Act specialist practice	Generalists
Timeline	5 days – 3 weeks	6+ weeks
Cost	Fixed-fee	Partner billing
Seven Hazard Domains	All seven assessed	Partial or outsourced
Output	Board-ready	Generic reports