SOCI Act Cyber Security Requirements: Incident Reporting, CIRMP and Pentesting in Australia

The SOCI Act's cyber security requirements come down to three things for most critical infrastructure entities: report serious cyber incidents to ASD within 12 or 72 hours, keep a board-approved Critical Infrastructure Risk Management Program (CIRMP), and, since 17 August 2024, comply with a recognised cyber security framework such as Essential Eight Maturity Level One or ISO 27001. The SOCI Act doesn't name penetration testing as a standalone requirement. But CISC guidance lists pen tests as a way to manage cyber hazards, and independent testing is the most direct evidence that your program actually works.

This guide explains who the Security of Critical Infrastructure Act 2018 applies to, what each cyber obligation requires, how the framework requirement works, what changes when the regulator gets firmer in 2026–27, and where suppliers and MSPs fit in. If you're APRA-regulated, read it alongside our guide to CPS 234 penetration testing.

What is the SOCI Act, and who does it apply to?

The SOCI Act sets legal obligations for entities that own, operate or hold a direct interest in critical infrastructure assets across 11 sectors. The Cyber and Infrastructure Security Centre (CISC), part of the Department of Home Affairs, regulates it.

The 11 sectors are:

• ▸Communications
• ▸Financial services and markets
• ▸Data storage or processing
• ▸Defence industry
• ▸Higher education and research
• ▸Energy
• ▸Food and grocery
• ▸Healthcare and medical
• ▸Space technology
• ▸Transport
• ▸Water and sewerage

Within those sectors the Act defines 22 classes of critical infrastructure asset. Being in a listed sector isn't enough on its own: the obligations apply when your organisation is the responsible entity or a direct interest holder for an asset that meets one of those definitions. The CISC says that if your industry isn't on the list, the SOCI Act likely doesn't apply to you.

Your data storage systems can be part of the asset

Since 20 December 2024, amendments made by the Enhanced Response and Prevention Act 2024 mean certain data storage systems that hold "business critical data" are treated as part of the critical infrastructure asset. That covers systems the responsible entity owns or operates, used in connection with the asset, where a hazard to the data system could also have a relevant impact on the asset. Business critical data includes personal information about at least 20,000 individuals and information needed to operate the asset.

In practice, this pulls corporate IT into scope. The file shares, cloud storage and databases holding network diagrams, operational procedures or customer records can now sit inside your SOCI obligations, not beside them.

What are the SOCI Act's cyber security obligations?

Most critical infrastructure assets face three positive security obligations: register the asset, report cyber incidents, and adopt and comply with a written risk management program. The obligations that apply depend on your asset class and your role.

There's also an obligation that applies to all critical infrastructure assets: if an external provider stores or processes business critical data for your asset, you must tell them. That puts them on notice that they may have SOCI responsibilities too.

How fast do you have to report a cyber incident under SOCI?

You must report a critical cyber security incident to ASD's ACSC within 12 hours of becoming aware of it, and any other reportable cyber incident within 72 hours. The clock starts when you become aware, not when the investigation finishes.

ASD's reporting guidance sets two thresholds:

• ▸Critical incidents, 12 hours. The incident has had, or is having, a significant impact on the availability of your asset, meaning it has materially disrupted the essential goods or services the asset provides. If you report verbally, you must lodge a written record within 84 hours.
• ▸Other incidents, 72 hours. The incident has had, is having or is likely to have a relevant impact on the integrity, reliability or confidentiality of the asset. A verbal report must be followed by a written record within 48 hours.

Failing to report can attract a civil penalty. Section 30BC of the SOCI Act sets 50 penalty units for missing the critical-incident obligation.

Ransomware payments are a separate report

If you're the responsible entity for an asset covered by Part 2B, the Cyber Security Act 2024 also requires you to report any ransomware or cyber extortion payment within 72 hours of making it, whatever your turnover. This obligation has been active since 30 May 2025, and it sits on top of your SOCI incident report.

Can you actually hit 12 hours?

In our experience this is where plans fall over. Twelve hours only works if someone can quickly tell whether an alert is real, what it touched and whether essential services are affected. If your logging doesn't reach the systems that matter, or no one has rehearsed the decision, the deadline arrives before the facts do. A penetration test is also a useful rehearsal: if your team didn't notice our testing, ask whether they'd notice a real attacker.

What does the CIRMP require for cyber security?

The CIRMP must identify material risks across four hazard types, minimise or eliminate them as far as reasonably practicable, and mitigate their impact. The hazards are cyber and information security, personnel, supply chain, and physical security and natural hazards.

CIRMP obligations apply to responsible entities for specified asset classes, including broadcasting, domain name systems, data storage or processing, electricity, gas, liquid fuels, energy market operators, payment systems, food and grocery, designated hospitals, freight infrastructure, freight services and water. Some classes, such as banking, insurance and superannuation, are not covered by the CIRMP obligation. Check the CISC's CIRMP guidance for your asset class.

Key CIRMP dates and duties

• ▸17 August 2023: responsible entities had to have adopted a CIRMP
• ▸17 August 2024: the cyber security framework requirement under section 8 of the CIRMP Rules took effect
• ▸At least every 12 months: review the CIRMP so it stays current
• ▸Within 90 days of the end of each financial year: give the regulator an annual report, approved by your board, council or other governing body

What the CISC suggests for cyber hazards

The CISC's guidance on cyber and information security hazards names phishing, malware, credential harvesting and denial of service as examples. To mitigate them, it suggests anti-phishing measures, an incident response plan, regular testing of control effectiveness including vulnerability testing of critical applications, and "using penetration 'pen' tests, or simulated cyber attacks" against firewalls and all components of IT and OT infrastructure. It also calls out segmentation and regular checks on access privileges for systems such as Active Directory.

That's guidance, not a legal mandate. But when your annual report tells the board the cyber program is effective, a recent independent test is the strongest evidence behind that statement.

Which cyber security framework does SOCI require?

The CIRMP Rules require you to comply with one of five listed frameworks, or an equivalent, and some come with a minimum level. The obligation has applied since 17 August 2024.

Source: SOCI CIRMP Rules, section 8.

Choosing between them

• ▸Essential Eight ML1 is the most technically specific option. It's a good fit for Windows-based corporate IT, and the condition is measurable. It's also a floor: ASD's transition guidance notes that Maturity Level Two was the required baseline for many critical infrastructure operators. See Essential Eight Maturity Level 1 vs Level 2.
• ▸ISO 27001 suits organisations that want a management system across the business and may already hold certification. See ISO 27001 penetration testing.
• ▸AESCSF and C2M2 are common in energy, where operational technology dominates the risk.
• ▸An equivalent framework is allowed, but your CIRMP must explain why you chose it, how it's equivalent and how you use it.

What ASD Essentials means for SOCI entities

The Rules incorporate these documents "as in force from time to time", so changes to a framework flow through. On 15 October 2026, ASD launched ASD Essentials as the evolution of the Essential Eight, including a chapter for critical infrastructure operators protecting OT. ASD says organisations should keep meeting current regulatory obligations until regulators announce changes. Keep your ML1 evidence current and start mapping now. Our guide to Essential Eight changes and ASD Essentials explains the transition.

Does the SOCI Act require penetration testing?

Not for most critical infrastructure. The SOCI Act and CIRMP Rules don't contain a general penetration testing mandate. Three things still push most responsible entities towards regular testing.

1. Systems of National Significance can be required to undertake vulnerability assessments under the Enhanced Cyber Security Obligations, along with incident response plans and cyber security exercises.
2. The CIRMP must minimise material cyber risk, and the CISC's own guidance lists pen tests and simulated attacks as a mitigation.
3. Your chosen framework expects testing. Essential Eight ML1 requires regular vulnerability scanning and fast patching of internet-facing services, while ISO 27001 includes controls for managing technical vulnerabilities. Testing is how you prove those controls hold.

APRA-regulated entities have a firmer requirement. CPS 234 expects systematic testing of information security controls, which is why many financial services organisations test annually.

What a SOCI-focused pentest should cover

Follow the attack paths that could reach your critical asset:

• ▸External attack surface: internet-facing services, remote access, VPNs and admin portals, where Essential Eight ML1 expects critical vulnerabilities to be patched within 48 hours. See external vs internal penetration testing.
• ▸Identity and Active Directory: privilege escalation from a standard user to domain admin, which the CISC flags directly. See Active Directory penetration testing.
• ▸The IT/OT boundary: whether a compromise of corporate IT can reach systems that control or monitor operations. Active testing inside live OT needs specialist, safety-first planning, so many entities start at the boundary and test segmentation from the IT side.
• ▸Business critical data stores: file shares, cloud storage and databases now caught by the data storage amendments. See cloud penetration testing.
• ▸People: phishing and credential harvesting, both named in CISC guidance. See social engineering testing.

How much does SOCI-ready testing cost in Australia?

At Aussie Pentest, human-led penetration tests are fixed-fee and start from $5,000 + GST, and an independent Essential Eight assessment is $4,950 + GST for up to 50 seats. Most critical infrastructure scopes need internal as well as external testing, which puts them in the Standard or Advanced tiers.

Pentests are delivered in 5 to 10 business days, with a written scope agreed before testing starts, CVSS-scored findings, proof-of-concept evidence on every critical finding and retest confirmation. Full details are on our pricing page. What's included in each service is on the automated security assessment, Essential Eight assessment and vCISO pages.

Not sure what your SOCI scope should be? Book a 1-on-1 scoping call and we'll give you a fixed-fee quote before any work starts.

What changes in 2026–27?

The CISC is moving from a mainly educational approach to firmer, risk-based enforcement. It says it is evolving its compliance posture in 2026–27 in response to the threat environment and the 2026 Independent Review of the SOCI Act.

Its regulatory approach now spells out the escalation path: Regulatory Guidance Notices, formal Non-Compliance Notices, and enforcement such as infringement notices for serious or persistent non-compliance. The review recommended the CISC move from a "light touch" approach focused on administration and documentation to a penalty-based one. The independent review, led by Dr Jill Slay, concluded that the Act needs major legislative change to reduce complexity, and that it should move from compliance-driven to outcome-driven, with genuine security uplift as the goal.

The threat data supports that shift. ASD's Annual Cyber Threat Report 2024–25 found:

• ▸Critical infrastructure made up 13% of all cyber security incidents ASD recorded, up 2% on the previous year
• ▸The most common activities behind those incidents were scanning or reconnaissance (41%), denial of service (31%) and phishing (20%)
• ▸ASD notified critical infrastructure entities of potential malicious cyber activity over 190 times, up 111%

Scanning and reconnaissance top the list. Attackers are probing your external attack surface constantly, so you should be testing it too.

What if you supply a critical infrastructure entity?

Suppliers aren't usually responsible entities, but the obligations still reach you through contracts. Supply chain is one of the four CIRMP hazards, and the Rules require responsible entities to consider whether their program lists major suppliers: vendors whose product or service has a significant influence over the security of the asset.

If you're an MSP, SaaS provider, integrator or data host to a utility, hospital, freight operator or payments business, expect:

• ▸Security clauses and questionnaires in contracts and renewals
• ▸Requests for your latest penetration test summary and remediation status
• ▸Questions about privileged access, MFA and how you'd notify the customer of an incident
• ▸A notice under the SOCI Act if you store or process their business critical data

A current, independent pentest report is often the fastest way to answer those questions. MSPs that want to offer testing to critical infrastructure clients under their own brand can use our white-label program.

Frequently asked questions

Does the SOCI Act apply to small businesses?

Usually not directly. It applies to entities responsible for, or holding direct interests in, defined critical infrastructure assets, and those are typically large operators. Small businesses are more often affected as suppliers, through contract clauses, questionnaires and the data provider notification.

Is Essential Eight mandatory under the SOCI Act?

No. Essential Eight Maturity Level One is one of five frameworks listed in the CIRMP Rules. You can choose ISO 27001, the NIST framework, C2M2, the AESCSF or an equivalent instead. Whichever you pick, the CIRMP obligation to comply with a framework has applied since 17 August 2024.

Who has to approve the CIRMP annual report?

If the responsible entity has a board, council or other governing body, that body must approve the annual report. It's due within 90 days after the end of the Australian financial year.

Does a SOCI incident report replace a Notifiable Data Breaches report?

No. SOCI reporting goes to ASD's ACSC. If personal information is involved and serious harm is likely, you may also have to notify the OAIC and affected individuals under the Privacy Act. See our guide to Privacy Act cyber security requirements.

Bottom line

The SOCI Act's cyber security requirements are mostly about governance and speed: know your assets, report incidents within 12 or 72 hours, run a board-approved risk program and meet a recognised framework. Penetration testing isn't named as a blanket legal requirement, but the CISC suggests it, your framework assumes it and the regulator is getting firmer about evidence. Test the attack paths that reach your critical asset, fix what's found and keep the retest evidence for your annual report.

Aussie Pentest provides fixed-fee penetration testing from $5,000 + GST and independent Essential Eight assessments for $4,950 + GST. Book a 1-on-1 call to scope your test, or review our penetration testing services.

Sources

• ▸CISC: Security of Critical Infrastructure Act 2018 (SOCI)
• ▸CISC: SOCI Act regulatory obligations
• ▸CISC: Our regulatory principles and approach
• ▸CISC: Enhanced Cyber Security Obligations
• ▸CISC: Guidance for the Critical Infrastructure Risk Management Program
• ▸Federal Register of Legislation: SOCI (Critical Infrastructure Risk Management Program) Rules
• ▸Federal Register of Legislation: SOCI and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024
• ▸AustLII: SOCI Act section 30BC
• ▸ASD: Report a cyber security incident
• ▸Home Affairs: Ransomware payment reporting factsheet
• ▸Home Affairs: Independent Review of the SOCI Act, Final Report
• ▸ASD: Annual Cyber Threat Report 2024–25
• ▸ASD: ASD Essentials, evolving our approach to cyber security resilience
• ▸Aussie Pentest: Pricing

This article is general information only, not legal or compliance advice. Whether the SOCI Act applies to you depends on your asset class and your role, so confirm your obligations with the CISC or a qualified adviser. Prices are current as of October 2026, and legislation, guidance and statistics were checked in October 2026. Only test systems you have written authority to assess.