The SOCI Act bar just went up. Here is the timeline.

Who the enhanced rules cover

The enhanced requirements apply to responsible entities for nine asset classes:

• Critical electricity, gas and liquid fuel assets, and critical energy market operator assets
• Critical water assets
• Critical freight infrastructure and critical freight services assets
• Critical broadcasting assets and critical domain name systems

If an asset becomes a critical infrastructure asset on or after 10 June 2026, its grace periods run from the date it became one. Other asset classes that keep a CIRMP, such as hospitals, data storage or processing, and food and grocery, are not covered by the enhanced tier.

Due by 10 June 2027

• Additional material risks (section 6A), including foreign ownership, control or influence, and offshore or remote access to OT control systems, critical components and business-critical data.
• Cyber material risks (section 8A(2)): unpatched systems, legacy or unsupported components that have not been replaced or mitigated, and advanced, novel or emerging technology used by or against the asset.
• Personnel access management (section 9A(2)): preventing unauthorised access and credential misuse, and handling onboarding and offboarding properly.

Due by 10 June 2028

• A listed cyber security framework at maturity level 2 or equivalent (section 8A(3) and (4)). The listed frameworks are the Essential Eight, C2M2, the AESCSF (Security Profile 2), AS ISO/IEC 27001:2023 and NIST CSF 2.0.
• Credential compromise hazards (section 8B), including phishing-resistant MFA where your chosen framework does not already require it.
• An inventory of critical systems and their connections, recovery and restoration, and protection against lateral movement (section 8C). Segregating critical systems is deemed to meet the lateral movement obligation.
• Background checks for critical workers (section 9A), supply chain mapping and vendor risk assessment (section 10A), and physical security and natural hazards (section 11A).

Nothing about the enhanced material risks or measures has to be reported for the 2025-26 period, but both grace periods are already running.

What it means for operational technology

Much of this lands on OT. Offshore and remote access to OT control systems is now named as a material risk. Legacy and unsupported components are common in plant that runs for decades. And an inventory of critical systems and their connections is where every OT security program starts.

Some of the listed frameworks, such as the Essential Eight, were written for enterprise IT. For control systems, the ASD’s Essentials for OT chapter and the IEC 62443 series show how to apply the same ideas safely: zones and conduits, target security levels and controlled remote access. Used together, one body of evidence can serve the regulator, the board and your engineers.

Five things to do now

1. Confirm which of your assets fall into the nine enhanced asset classes, and when each grace period ends for them.
2. Run a gap analysis of your current CIRMP against the enhanced requirements, starting with the 2027 items.
3. Build or refresh the inventory of critical systems and their connections, including every remote and vendor access path into OT.
4. Choose your cyber framework and assess where you stand against maturity level 2, or Security Profile 2 for the AESCSF.
5. Turn the gaps into a funded plan the board approves, with phishing-resistant MFA and segregation of critical systems on the critical path.

Our OT risk assessment builds the inventory and the risk picture, and our IEC 62443 audit and assessment measures your controls against the standard written for industrial systems.