# What Is the SOCI Act? Australia's Critical Infrastructure Security Rules

> A plain-English explainer on Australia's Security of Critical Infrastructure (SOCI) Act: the sectors it covers, the positive security obligations, mandatory cyber incident reporting, the risk-management program requirement, and the enhanced obligations for systems of national significance. General information, not legal advice.

Source: https://playciso.com/blog/soci-act-explained · Published: 2026-10-23 · Publisher: PlayCISO (https://playciso.com)

---

The SOCI Act is Australia's Security of Critical Infrastructure Act — the law that places security and resilience obligations on the organisations that own and operate the infrastructure a country cannot function without. Its purpose is simple to state: make the essential services everyone depends on harder to disrupt, whether the threat is a cyberattack, a physical attack, a malicious insider or a compromised supplier. This is general information, not legal advice. ## What the Act is for Critical infrastructure is the set of systems whose failure would cause serious harm to the economy, security or daily life — the power grid, water, communications networks, payment systems, hospitals, ports. The SOCI Act exists because these are increasingly digital, interconnected and targeted, and because the consequences of a successful attack extend far beyond the operator to the whole community. Rather than leaving protection to each operator's commercial judgement, the Act makes a baseline of security a legal duty for covered assets, and gives government visibility and, in serious incidents, the ability to assist or intervene. ## The sectors it covers The Act defines critical infrastructure across a broad range of sectors, and it has grown over successive amendments from a narrow starting point to a wide footprint. The covered areas include, among others: - Energy — electricity, gas and liquid fuels. - Water and sewerage. - Communications. - Financial services and markets. - Data storage or processing. - Health care and medical. - Higher education and research. - Food and grocery. - Transport — including ports, aviation and freight. - Space technology and the defence industry. Within each sector, the legislation designates specific asset classes that are treated as critical, and which obligations apply depends on the class. Because the list and the definitions have changed as the Act has been amended, operators should confirm against the current rules whether a particular asset is covered. ## The positive security obligations At the core of the Act are the positive security obligations — the baseline duties that require covered entities to actively do things, not merely avoid prohibited conduct. In broad terms they are: - Register of assets. Provide and keep current certain information about the asset, including ownership and operational details, in a government register. - Mandatory incident reporting. Notify government of qualifying cyber security incidents within set timeframes (covered below). - Risk-management program. Adopt, maintain and comply with a critical infrastructure risk-management program. Which of these are switched on for a given asset depends on its class and on rules made under the Act, so the obligation set is not uniform across every covered organisation. ## Mandatory incident reporting One of the most consequential obligations is reporting. Responsible entities must notify the Australian Government of significant cyber security incidents within mandatory timeframes — a shorter deadline for incidents with a significant impact, and a longer one for those with a lesser relevant impact. The purpose is to give government timely visibility of threats to critical infrastructure so it can assist the affected operator, warn others and build a national threat picture. Because missing a reporting deadline is one of the clearest ways to fall foul of the Act, operators should know the current definitions and timeframes precisely rather than approximately. Having an incident-response and [business continuity plan](/blog/business-continuity-plan-explained) that builds these notification steps in is the practical way to meet the duty under pressure. ## The risk-management program The Act requires covered entities to run a risk-management program that identifies and mitigates hazards across four domains: cyber, physical, personnel (insider threat) and supply chain. This reflects a mature view of security — that a critical asset can be taken down by a disgruntled employee or a compromised vendor just as surely as by a remote hacker. A structured control framework such as the [NIST Cybersecurity Framework](/tools/nist-csf) is a natural fit for the cyber portion, and the supply-chain domain is exactly where a [vendor-risk assessment](/tools/vendor-risk-scorecard) earns its keep, given how often an incident reaches a critical operator through a third party. If you are new to why any of this matters at the national level, our broader explainer on [why cybersecurity is important](/blog/why-is-cybersecurity-important) sets the scene. ## Enhanced obligations and systems of national significance Above the baseline sits a smaller, privately designated set of the most crucial assets: systems of national significance. The designation takes account of how sectors depend on one another, and it is not public. For these assets, government can impose enhanced cyber security obligations on top of the positive security obligations — which can include developing incident-response plans, taking part in cyber exercises, undertaking vulnerability assessments and sharing system information to build situational awareness. The Act also provides government assistance measures and, for serious incidents, intervention powers. ## Why it matters to operators The practical message is that for covered assets, security is no longer purely a commercial decision — it is a legal duty with registers to maintain, incidents to report on a clock, and a risk program to run and evidence. The Act reflects a wider global trend of governments treating critical infrastructure resilience as a matter of national security. Operators who treat the obligations as a genuine program, rather than a paperwork exercise, end up more resilient as well as compliant. Again, this is general information; the exact obligations depend on the asset class and the current rules, and specific compliance questions deserve professional legal advice. ## Frequently asked questions **What is the SOCI Act?** Australia's Security of Critical Infrastructure Act, which imposes security and resilience obligations on owners and operators of critical infrastructure against cyber, physical, personnel and supply-chain threats. **Which sectors does it cover?** A broad range including energy, water, communications, financial services, data storage and processing, health, education, food and grocery, transport, space and defence industry, with specific asset classes designated within each. **What are the positive security obligations?** Keeping asset information in a register, reporting qualifying cyber incidents within mandatory timeframes, and running a critical infrastructure risk-management program. **What are the incident-reporting rules?** Significant incidents must be reported to government within set timeframes, with a shorter deadline for the most serious impacts and a longer one for lesser impacts. **What are systems of national significance?** A privately designated subset of the most crucial assets, for which government can impose enhanced obligations such as response plans, exercises and vulnerability assessments on top of the baseline.