SOCI Act

Who it applies to

Responsible entities and direct interest holders for critical infrastructure assets in sectors including energy, water, communications, data storage and processing, financial services, health, food and grocery, transport, higher education, defence industry and space.

Key requirements

• Register ownership and operational information for critical infrastructure assets.
• Mandatory cyber incident reporting to the Australian Signals Directorate.
• A Critical Infrastructure Risk Management Program covering cyber, personnel, supply chain and physical hazards, with annual board-approved reporting.
• Enhanced cyber security obligations for Systems of National Significance.
• Government assistance and intervention powers as a last resort during serious incidents.

Breach and incident notification

Critical cyber incidents having a significant impact are reported within 12 hours of becoming aware; other cyber incidents with a relevant impact within 72 hours, to the Australian Signals Directorate's ACSC.

Penalties

Civil penalties for non-compliance with the Act's obligations, enforced by the Cyber and Infrastructure Security Centre.

Go deeper