Who we protect

The rules

Electricity, energy market operator, gas and liquid fuel assets are covered by the enhanced CIRMP Rules under the SOCI Act, with obligations due by 10 June 2027 and 10 June 2028. Energy operators commonly measure themselves against the AESCSF.

The rules

Critical water assets are covered by the enhanced CIRMP Rules, including the material risk of offshore or remote access to OT control systems, due by 10 June 2027. Read our guide.

The rules

Critical freight infrastructure and freight services assets are covered by the enhanced CIRMP Rules. Other operators face security requirements from customers and head contractors.

The rules

Customer and supplier security requirements, IEC 62443 in plant and equipment specifications, and the ASD’s Essentials for OT chapter.

The rules

Safety obligations make the integrity of control systems a safety matter, and listed companies must consider continuous disclosure when an incident is material.

The rules

The Privacy Act applies to every health service provider, whatever its turnover, and so does the Notifiable Data Breaches scheme.

The rules

From 1 July 2026, the AML/CTF reforms bring lawyers, accountants, conveyancers and real estate agents into regulation, and those entities lose the Privacy Act small business exemption for their AML/CTF information.

The rules

APRA-regulated entities must meet CPS 234 Information Security; ASIC expects licensees to have adequate cyber resilience.

The rules

The ASD’s Information Security Manual, Essential Eight maturity requirements in contracts and panels (which still apply during the transition to ASD Essentials), the Protective Security Policy Framework, and defence industry security requirements.

The rules

Privacy Act duties, state department requirements, and the Children’s Online Privacy Code the OAIC must register by 10 December 2026.

The rules

Privacy Act obligations depend on turnover and activities; ACNC governance standards expect boards to manage risk.

The rules

The Security of Critical Infrastructure Act 2018, its risk management program rules (or sector rules for telecommunications) and mandatory cyber incident reporting. Ransomware payment reporting applies to critical infrastructure whatever your turnover.