What you need to know
- The Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (Enhanced CIRMP Rules) commenced on 10 June 2026, formally amending the Security of Critical Infrastructure (Critical Infrastructure Risk Management Program) Rules 2023 (CIRMP Rules).
- A key feature of the enhancements is stricter compliance obligations associated with foreign ownership, control and influence (FOCI) risk for responsible entities of designated high-risk critical infrastructure assets.
- Section 6A requires CIRMPs to minimise or eliminate FOCI as a material risk as far as is reasonably practicable, and section 10A embeds FOCI considerations into supply chain mapping and major supplier assessments.
- Some challenges remain, including uncertainty around the "reasonably practicable" standard, limited alternatives to high-risk vendors, and the evolving nature of FOCI risk.
What you need to do
- Confirm whether your critical infrastructure assets fall within the designated high-risk asset classes captured by the Enhanced CIRMP Rules.
- Map major suppliers and critical components that may be exposed to FOCI risk.
- Brief procurement teams, develop risk assessment questionnaires and conduct open source due diligence processes for major suppliers and high-risk vendors.
- Update CIRMPs ahead of relevant deadlines to ensure mitigation measures for FOCI risks are compliant with the Enhanced CIRMP Rules.
Overview
On 10 June 2026, the Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (Enhanced CIRMP Rules) commenced, formally amending the Security of Critical Infrastructure (Critical Infrastructure Risk Management Program) Rules 2023 (CIRMP Rules) under the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act). Among the most significant features of these reforms is the treatment of "foreign ownership, control and influence" (FOCI) as a discrete and heightened category of risk for responsible entities operating high-risk critical infrastructure assets. This article examines what FOCI risk is, how the Enhanced Rules seek to address it, the specific new provisions targeting identification and mitigation of FOCI risk, and the challenges that may still lie ahead.
What is FOCI risk?
FOCI risk refers to the potential for entities to be directed or unduly influenced by a foreign government. This can occur in a range of ways such as through direct ownership channels, domestic laws of a foreign jurisdiction, or outside influence. In the context of security of critical infrastructure, FOCI risks are an important consideration for responsible entities, vendors and suppliers that may be exposed to a foreign state through ownership, control or influence.
The Department of Home Affairs identifies unauthorised access to or control of security technologies, unauthorised bulk data exfiltration and aggregation, theft of intellectual property, and sabotage as key FOCI threats. All of these have the potential to significantly impact an organisation's security and the availability and integrity of critical infrastructure assets, which in turn could affect Australia's national interests. FOCI risk may also arise through less overt (although no less serious) means, such as a foreign-linked entity gaining contractual access to critical components or data that are essential to the functioning of a critical infrastructure asset.
How do the Enhanced CIRMP Rules address FOCI risk?
The Enhanced CIRMP Rules impose uplifted risk-management requirements on responsible entities for designated high-risk asset classes, in addition to their existing obligations under the baseline CIRMP Rules.
Previously, FOCI was not explicitly addressed by the CIRMP Rules. However, under the Enhanced Rules, FOCI is now directly addressed through two principal mechanisms: as an additional material risk that responsible entities must manage under section 6A, and as an embedded vendor assessment consideration within the enhanced supply chain hazard provisions under section 10A.
Together, these provisions represent a significant shift in approach: FOCI risk prevention is no longer a general consideration but a specific and mandatory obligation.
Section 6A(2)(b) – FOCI as an additional material risk
Section 6A of the Enhanced Rules requires responsible entities to establish and maintain processes in their CIRMPs to, as far as reasonably practicable, minimise or eliminate specified additional material risks. These include the compromise or impairment of the functions of the critical infrastructure asset as a result of, or in connection with, FOCI.
The Explanatory Statement for the Enhanced CIRMP Rules clarifies that this provision is intended to ensure the material risk of compromise or impaired function as a result of, or in connection with FOCI is considered in a responsible entity's CIRMP across all hazard domains. In particular, the risk assessment should consider the impact of FOCI-associated vendors, suppliers, managed service providers or contractors critical to its operations or the availability, reliability, integrity and confidentiality of the asset.
The Explanatory Statement uses the example of a foreign-owned entity providing critical technology systems, which through its governance structure or ownership arrangements has the potential to be subject to foreign direction or coercion. In such circumstances, the responsible entity would need to explicitly identify in the CIRMP the risk (and the mitigations in place to minimise that risk) that "vulnerabilities could be introduced, access could be misused, or support services could be withheld in a manner that compromises the availability, integrity or reliability of the CI asset".
Section 6A is subject to a 12-month grace period. For assets that were critical infrastructure assets prior to the commencement of the Enhanced Rules on 10 June 2026, this means section 6A will become enforceable on 10 June 2027. For any assets that become critical infrastructure assets after that date, section 6A will apply 12 months from when the asset becomes a critical infrastructure asset captured by the SOCI Act.
Section 10A – FOCI risk in the enhanced supply chain hazards framework
Section 10A requires responsible entities to map their supply chains for major suppliers and critical components. As part of this mapping exercise, they must identify risks to the availability, integrity, reliability or confidentiality of those critical components, determine the maximum acceptable outage for the asset arising from supply chain disruption, and implement mitigation measures as far as is reasonably practicable. While the supply chain mapping provisions do not provide an exhaustive list of risks that must be considered, FOCI risk would naturally be a key consideration for entities with foreign-linked supply chains.
A separate vendor assessment process must also be maintained for existing and proposed major suppliers. Entities must evaluate each major supplier against a range of factors, including any FOCI risk-related legislative or other legal requirements to which the supplier is subject. Similar to the supply chain mapping provisions, responsible entities must consider the associated material risk, maximum acceptable outage and mitigation steps relevant to these FOCI risks.
Section 10A is subject to a 24-month grace period. For assets that were critical infrastructure assets prior to the commencement of the Enhanced Rules on 10 June 2026, this means section 10A will become enforceable on 10 June 2028. For any assets that become critical infrastructure assets after that date, section 10A will apply 24 months from when the asset becomes a critical infrastructure asset captured by the SOCI Act.
Remaining gaps and challenges
While the Enhanced Rules represent a meaningful step forward in addressing FOCI risk, several challenges and potential gaps warrant consideration:
- The "reasonably practicable" threshold: The new FOCI-specific provisions require entities to minimise or eliminate FOCI risk "as far as it is reasonably practicable." While this theoretically provides flexibility for entities to tailor their approach to their specific circumstances, it also introduces a degree of ambiguity in practical application. The Explanatory Statement recognises this, noting the need for the Department to provide further guidance on how entities should approach FOCI assessments and the expected depth of supply chain mapping.
- Limited alternatives for high-risk vendors: In many critical infrastructure sectors, diversification away from high-risk vendors may not be practicable. The Enhanced Rules' Consultation Paper acknowledged that the renewable energy sector in particular is heavily dependent on vendors and suppliers that may be considered high-risk, with limited scope for diversification. Where entities must continue to engage high-risk vendors, the adequacy of mitigation controls is something that entities will need to consider if they have no alternative but to engage with high-risk vendors.
- Scope limited to high-risk asset classes: The Enhanced CIRMP Rules apply only to designated high-risk asset classes, meaning responsible entities for other categories of critical infrastructure remain subject only to the baseline CIRMP Rules. Given that FOCI risk is not confined to particular sectors, and that supply chains frequently span multiple asset classes, there is a risk that this delineation may leave vulnerabilities unaddressed.
- Evolving nature of FOCI risk: The Department's FOCI Risk Assessment Guidance warns that certain jurisdictions are actively reducing the transparency of corporate and accounting information in order to conceal government ownership, control, or influence. This is an issue when the capacity of responsible entities to effectively identify and assess FOCI risk depends on the availability of reliable information about vendor ownership structures, political exposure, and jurisdictional risk. The residual challenge lies in navigating an evolving threat environment in which threat actors continue to adapt their methods and exploit emerging technologies, supply chain dependencies and systemic vulnerabilities.
What practical steps should responsible entities be taking?
We recommend that entities which know or anticipate that they will be captured by the Enhanced CIRMP Rules should take the following steps in preparation for managing these new obligations:
- mapping key suppliers that may be subject to FOCI risk;
- briefing and working with internal procurement teams to ensure they have a clear understanding of how to comply with relevant new obligations;
- developing probing risk assessment questionnaires to ensure they can meaningfully assess major suppliers and any FOCI risk; and
- consider conducting open source due diligence on major suppliers and high-risk vendors to ensure a clear picture of any FOCI risk those entities pose to their supply chain.
Next steps
The Enhanced CIRMP Rules represent a significant development in Australia's approach to securing critical infrastructure against foreign interference. By treating FOCI as a distinct material risk under section 6A and embedding FOCI-specific considerations into vendor assessment obligations under section 10A, the Rules require entities to confront a category of risk that has historically proven difficult to identify, assess and manage.
Responsible entities with exposure to FOCI risk should act promptly in familiarising themselves with these new provisions and implementing preparatory measures, not only to comply with applicable grace periods, but to develop the sustained FOCI risk management capability that genuine risk mitigation and resilience require.
Want to know more?
- High Risk, Higher Standards: What the Enhanced CIRMP Rules Mean for You (8 July 2026)
- The Insider Threat: Critical Infrastructure's Overlooked Vulnerability (6 August 2026)
- Physical Security Under the SOCI Act: The Overlooked Frontier of Critical Infrastructure Protection (25 August 2026)
Authors: Clare Doneley, Partner; Rachael Falk, Partner; Sanjam Bajwa, Lawyer; and Georgina Whittle, Graduate.
