'A clearer pathway: How the SOCI Act Tranche 2 reforms proposed to redefine critical data infrastructure
What you need to know
- Measure 8 of the Tranche 2 reforms to the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act) is intended to clarify and streamline the process for identifying critical data storage or processing assets, and reduce inconsistencies within the current regime.
- The proposed changes will replace the current customer-driven test for identifying critical data storage or processing assets with a new multi-pathway, operator-facing assessment process.
- An asset could be captured as a result of the size of its facilities, the type/scale of services provided, the nature of certifications held, or (in exceptional cases) a Ministerial designation.
- Some responsible entities may be captured by the revised regime for the first time, whereas others currently captured as a result of customer-driven characteristics may no longer be.
What you need to do
- Consider whether the new test could bring your data storage or processing asset/s under the regime for the first time, or whether your asset may be excluded as a result of the shift away from customer-facing criteria.
- Familiarise yourself with the broader compliance obligations proposed under Tranche 2 and closely monitor the progress of the reforms.
At a glance
The Department of Home Affairs is currently reviewing submissions made during the consultation period for its Tranche 2 reforms to the SOCI Act.
This second wave of proposed reforms is intended to streamline, modernise and refine the SOCI Act in the face of increasingly fast-paced and sophisticated critical infrastructure security threats. The Department has proposed 21 discrete measures to achieve these aims.
One of these measures, known as 'Measure 8: Data Storage or Processing Capture Pathways', sits within Part A of the reforms and is focused on reducing complexity, duplication and uncertainty in relation to the identification and regulation of critical data storage and processing assets. Instead, the proposal is to replace the existing customer-driven capture model with four clearer, operator-facing pathways.
Issues with the current definition
The existing definition of "critical data storage or processing asset" under section 12F of the SOCI Act fails to provide a clear standard for identifying nationally significant data infrastructure. The definition is poorly aligned with contemporary operating models like multi-tenant data centres, cloud services and other modern data storage and processing infrastructure.
The current test identifies regulated assets indirectly, relying on criteria such as the identity of the customer, whether the data being handled is "business-critical", and whether the provider has been notified by the customer about the nature of the service they are providing to the customer. In practice, this means the information needed to determine SOCI status, such as the customer's regulatory standing, the downstream use of its service, or whether a notification has been issued, often sits with the customer rather than the provider. Additionally, there is the added complexity that customers who are government bodies are exempt from certain notification requirements to their data storage and processing provider, leaving a gap which requires providers to self-assess their SOCI obligations with respect to government customers. As the Tranche 2 consultation paper explains, this can produce "inconsistent outcomes": significant data-related facilities may escape the framework entirely if the customer-driven criteria are not satisfied, while a smaller service could be captured simply due to an individual customer relationship.
The broader consequence for the sector is that data storage and processing providers often cannot reliably assess their regulatory position by reference to their own facilities, services or certifications. This renders the framework unpredictable and can create misalignment between what is regulated versus the genuine significance of a facility or service.
The Department's view is that these issues demonstrate a need for a clearer system for identifying significant data storage or processing facilities, without simply classifying all data centres, data services and cloud services as critical infrastructure.
The proposed model: four new "pathways"
Measure 8 proposes to replace the current section 12F model with a multi-pathway regulatory framework built around provider-facing criteria, so that entities can assess their status by reference to their own facilities, services or certifications.
The four proposed pathways are:
- Facility-based capture: A data-centre facility could fall under the regulation based on its physical and operational characteristics, principally measured by rated IT load. The consultation paper proposes a starting threshold of one megawatt of capacity, informed by international comparators including the United Kingdom's proposed approach.
- Service-based capture: An asset could also be captured by the framework based on the type and scale of service provided rather than its underlying physical infrastructure. This pathway is directed at larger service-layer providers (such as cloud, managed hosting, backup and disaster recovery providers) that meet a prescribed Australian-facing scale threshold, potentially measured by revenue, customer numbers, data volume, headcount or a combination of these factors.
- Certification-based capture: Additionally, an asset could be captured by the regulation based on certification/s held by the provider. This pathway would apply to providers holding relevant certifications, primarily under the Commonwealth Hosting Certification Framework, or an equivalent prescribed scheme relating to the handling of sensitive Government information.
- Reserve Ministerial designation: A fourth deliberately narrow mechanism would allow the Minister for Home Affairs to designate a provider in exceptional cases of government dependency that fall outside the ordinary thresholds.
Importantly, these pathways are intended to provide alternative entry points into a single regulatory regime. If a provider were to be captured under more than one pathway, the obligations would apply only once, not cumulatively.
Key design elements and preliminary impact analysis
Several other key design features of the proposed model include:
- The Act would introduce a formal concept of a "data centre" as a physical facility housing IT equipment together with supporting infrastructure such as power, cooling, security and resilience systems, broad enough to accommodate campus-style and distributed designs.
- Aggregation provisions would allow multiple structures to be treated as one facility where they operate as a single integrated unit, though common ownership or physical proximity alone would not be sufficient.
- For foreign-headquartered providers, the service-based threshold would be measured by Australian-derived revenue or another domestic metric, rather than global group scale. This is intended to align regulation under the SOCI Act with the provider's genuine significance in the Australian market.
- The customer notification obligation under subsection 12F(3) would be repealed, as the new operator-facing pathways would remove the need for critical infrastructure customers to notify their commercial data storage or processing providers.
In terms of a preliminary impact analysis, the consultation paper acknowledges that the size of the affected population will depend heavily on where thresholds are set. The paper notes that a 1 MW threshold "is low relative to industry norms, because commercial colocation and hyperscale facilities typically operate from approximately 15 MW to well over 100 MW". Additionally, Australia's commercial data-centre base is concentrated in Sydney and Melbourne and operated by a relatively small number of providers. Meanwhile, some entities currently captured only through customer identity or data characterisation may fall outside scope, which the paper characterises as a "deregulatory benefit".
What changes vs what stays the same
The table below provides a summary of what would change versus what would stay the same were Measure 8 to be implemented:
| What changes | What stays the same |
|---|---|
| The customer-driven capture model under section 12F would be replaced by four operator-facing pathways. | The reform modernises the existing critical data storage or processing asset class; it does not create a new sector or a second parallel regime. |
| Providers would assess their own status by reference to their facilities, services or certifications, rather than relying on customer identity or notification. |
Lower-consequence services, incidental data handling and ordinary software or professional services remain outside the scope of the regime. |
| The subsection 12F(3) customer notification obligation would be repealed. | Internal data systems that form part of another primary critical infrastructure asset continue to be dealt with under subsection 9(7). |
| New entities may be captured for the first time based on facility size, service scale or certification status. | Entities captured under more than one pathway face only a single set of obligations, not cumulative layers. |
| A reserve Ministerial designation pathway would be introduced for exceptional government-dependent cases. | Entities currently captured under section 12F would transition without a gap in coverage if they continue to meet the revised criteria. |
Outstanding consultation questions
As part of the consultation period, the Department posed a number of targeted questions to stakeholders regarding Measure 8. These included:
- Whether facility-based capture using rated IT load is the right primary threshold and whether 1 MW is appropriate in the Australian market?
- Which Australian-facing metrics would best identify significant service-layer providers without drawing in smaller or incidental operators?
- What aggregation rules are needed for campus-style or distributed data-centre operations?
- What service types should be expressly excluded from service-based capture, and how should such exclusions be drawn?
- How potential reforms to the Hosting Certification Framework should interact with the proposed certification-based pathway?
Advice for affected entities
For those critical data infrastructure entities that have not yet been captured by the SOCI regime, this will mean a shift in terms of implementing obligations under the SOCI legislation and adopting an 'all hazards' approach to risk management, preparedness and planning.
This will involve the creation and maintenance of a Critical Infrastructure Risk Management Plan along with board approval and the filing of an Annual Report to the Critical Infrastructure Security Centre. While ideally most of these risks will already form part of these entities' enterprise risk management frameworks, this approach to risk management will take some time to implement from a governance and operational perspective.
Key takeaways
Overall, Measure 8 represents a meaningful shift in how the SOCI Act would regulate data storage and processing infrastructure. By moving from a customer-dependent model to a set of operator-facing pathways, the Government aims to make the framework more predictable, self-assessable and better aligned with the contemporary data infrastructure landscape.
With the consultation period now closed, stakeholders in the data centre, cloud and managed hosting sectors should closely monitor the progress of these reforms as the Government moves towards finalising the legislative implementation of Tranche 2.
Want to know more?
- Streamline and Modernise: An Overview of the SOCI Act 'Tranche 2' Reforms (21 September 2026)
- High Risk, Higher Standards: What the Enhanced CIRMP Rules Mean for You (8 July 2026)
- Your Board, Their Rules: Inside SOCI's Proposed Ministerial Powers (15 April 2026)
- The Insider Threat: Critical Infrastructure's Overlooked Vulnerability (6 August 2026)
- Physical Security Under the SOCI Act: The Overlooked Frontier of Critical Infrastructure Protection (25 August 2026)
Authors: Clare Doneley, Partner; Rachael Falk, Partner; Jasneet Birdi, Lawyer; Georgina Whittle, Graduate.
