Raising the stakes: CIRMP governance, independent assurance and graduated civil penalties under the proposed tranche 2 SOCI reforms

What you need to know

• On 30 June 2026, the Department of Home Affairs released a consultation paper Streamlining and Modernising the Security of Critical Infrastructure Act 2018 (Consultation Paper),¹ setting out proposed amendments to the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act). The Consultation Paper forms part of the broader Tranche 2 reform process, addressing structural and operational concerns identified in the Independent Review of the SOCI Act conducted by Dr Jill Slay between November 2025 and January 2026 (Independent Review).²
• Amongst the 21 measures proposed, Measures 15 and 16 are of particular significance for responsible entities.
• Measure 15 would tighten the governance and assurance of a Critical Infrastructure Risk Management Program (CIRMP) through:
  • Annual compliance reports being used as evidence in civil penalty proceedings. This would remove the current restrictions in sections 30AG and 30AQ.
  • The governing body (or, in specified circumstances, a nominated senior manager) having to approve the establishment, review, update and variation of the CIRMP, and overseeing risk management on an ongoing basis.
  • CIRMPs having to be reviewed at least every 24 months with certain events triggering an earlier review.
  • Requiring independent assurance of the CIRMP's design, implementation and effectiveness at least every three years.
• Measure 16 would raise the maximum civil penalty for core preventive and assurance duties from 200 to 500 penalty units (currently $165,000).

What you need to do

If you are a responsible entity caught by the SOCI Act:

• consider the current review process of your CIRMP and whether your board or senior management currently approves and oversees it;
• ensure your CIRMP is reviewed at least every 24 months and set internal triggers for earlier reviews linked to incidents, material changes, Departmental risk information and assurance findings;
• determine whether your internal assurance function is capable and independent, or whether you will need external assurance given your asset's risk profile;
• review annual compliance reports through the lens that they may become admissible in civil penalty proceedings;
• close existing gaps by fixing known CIRMP deficiencies, and keeping incident response plans, cyber security exercises and vulnerability assessments up to date, to avoid higher penalties applying in circumstances where CISC has indicated it is moving to start enforcing breaches of the SOCI Act.

The governance and accountability gap

The Independent Review found that stakeholders considered the SOCI framework too focused on administration and documentation, and insufficiently focused on effective risk management, testing, remediation and accountability. The current CIRMP regime relies heavily on self-attestation and governing-body approval of annual compliance reports as its primary assurance mechanisms. Those mechanisms provide limited independent evidence that a CIRMP is adequate, effectively implemented and operated in practice. A board may approve an annual compliance report without having a consistent independent basis for understanding whether the CIRMP reflects the entity’s actual operating environment, whether key controls are working or whether the right issues are being remediated.

At the same time, the current penalty settings for core preventive and assurance duties, generally a maximum of 200 penalty units (currently equates to $66,000)³, may not adequately reflect the importance of obligations central to the SOCI Act's risks management framework. The Tranche 2 reforms represent a shift towards moving from light-touch compliance to stronger enforcement.

Measure 15: CIRMP governance and assurance

Measure 15 addresses how responsible entities govern, review and assure their CIRMPs. The proposed reforms have three linked parts:

1. removing current admissibility restrictions on annual compliance reports;

2. strengthening governance and review obligations; and

3. introducing mandatory independent assurance of CIRMP design, implementation and effectiveness.

Removing admissibility restrictions on annual compliance reports

Under the current framework, sections 30AG and 30AQ of the SOCI Act prevent the Critical Infrastructure Security Centre (CISC) from relying on mandatory annual compliance reports as evidence in civil penalty proceedings, even in circumstances of those reports disclosing potential non-compliance. As a result, the framework's main compliance reporting tool is not able to support enforcement action where necessary.

The proposed reforms would remove these admissibility restrictions, in order to allow annual compliance reports to be used in civil penalty proceedings where appropriate. The CISC however, would still take voluntary disclosure, cooperation and timely remediation into account when making decisions relating to compliance and enforcement.

Strengthened governance controls

The SOCI Act currently requires CIRMPs to be reviewed “regularly” and kept “up to date”. However, neither of these standards have been sufficiently defined to support consistent supervision or provide clear expectations to industries. Additionally, the SOCI Act also does not require the governing body or senior decision-makers to approve the establishment, review, update and variation of the CIRMP itself. This is significant as decisions concerning the risk appetite, security investment, prioritisation and remediation efforts for an entity are usually made at board or senior-management level. If CIRMP governance is not clearly linked to those decision-makers, the program risks becoming a compliance document rather than a practical tool for responsible entities in managing its risk.

Under the proposed Tranche 2 reforms, the governing body (or in specified circumstances, a nominated senior manager) would need to approve the establishment, review, update and variation of the CIRMP and oversee risk identification and management on an ongoing basis. The SOCI Act would also require a review at least once every 24 months, with certain events triggering an earlier review. These events may include:

• a significant cyber security incident affecting the asset;
• a material change to the asset’s operating environment, ownership structure or supply chain;
• relevant risk information communicated by the Department; or
• a relevant finding from an audit, assurance activity, cyber security exercise or vulnerability assessment.

The reforms also aim to set clear criteria for when a CIRMP is “not up to date”. These may include whether the CIRMP reflects the entity’s current operating environment and asset configuration, potential threats and hazards, regulatory requirements and governance arrangements, as well as lessons learned from relevant incidents, exercises or reviews that have been conducted by the entity.

Independent CIRMP assurance

A significant element of Measure 15 is the proposal to require periodic independent assurance of the CIRMP's design, implementation, appropriateness and operational effectiveness. Reviews would have to occur at least once every three years with their scope, method, frequency and independence requirements being dependent on the nature, size, complexity and criticality of the responsible entity and the relevant asset.

For lower-risk entities, an internal assurance function may be enough if it has appropriate capability and is operationally independent from the design and operation of the CIRMP. More frequent reviews or stronger independence requirements may apply to higher risk entities. Examples include assets of heightened national, economic or societal importance, elevated threat environments or significant changes to the asset, its operating environment or its risk posture.

Assurance reports would be provided to both the entity’s governing body and the CISC. If a review identifies material deficiencies, the entity would have to prepare and provide a remediation plan. If it identifies a serious deficiency under section 30AI of the SOCI Act, the report could give the CISC grounds to use its existing CIRMP remediation powers.

Measure 16: Graduated civil penalty settings

Under its existing framework, the SOCI Act already sets civil penalties in graduated tiers. Administrative and visibility obligations, such as routine reporting, entity-change notifications and cyber incident notifications, generally attract lower maximum penalties. Preventive and assurance duties, including obligations relating to CIRMPs, incident response planning, cyber security exercises and vulnerability assessments, carry 200 penalty units. At the top tier, failure to protect critical telecommunications assets attracts 1,500 penalty units, and failure to comply with a Ministerial direction under Part 2D attracts 2,000 penalty units.

The Consultation Paper suggests that the 200 penalty units for the middle tier may no longer reflect the importance of selected preventive and assurance duties. These duties are key considerations to the SOCI framework, through which entities identify material risks, implement controls, test preparedness and remediate any deficiencies. Failure to comply with these may result in material risks being left unidentified, untreated or untested. This weakens an entity’s ability to maintain or restore essential services during or after a serious incident.

The proposed Tranche 2 reforms would raise the maximum civil penalty for selected core preventive and assurance duties from 200 penalty units to 500 penalty units (currently equating to $165,000).4 This increase would apply to obligations to have, comply with, review and update a CIRMP and to related obligations on incident response planning, cyber security exercises and vulnerability assessments.

Importantly, the increase would not introduce any new compliance obligations. The existing enforcement framework would remain unchanged. Courts would still continue to determine the appropriate penalty considering the circumstances of each case, by having regard to the nature and extent of the contravention, loss or damage, the circumstances in which the contravention took place, and any previous similar contraventions.

Lower-tier administrative and visibility obligations and top-tier telecommunications and Ministerial direction obligations would remain at their existing levels.

Remaining gaps and challenges

While these measures represent meaningful steps forward in strengthening CIRMP governance and enforcement credibility, several challenges and potential gaps warrant consideration:

Harmonisation with the foreign investment framework: The Department has recognised that certain foreign-owned entities may already be subject to reporting, audit or assurance conditions under the Foreign Acquisitions and Takeovers Act 1975 (Cth). While the Consultation Paper flags engagement with Treasury to reduce duplication, the mechanisms for recognising equivalent assurance outcomes across frameworks are not yet defined. Until those mechanisms are settled, affected entities may face overlapping and potentially inconsistent obligations.

Transition and implementation: The interaction between the new governance and assurance obligations (Measure 15) and the increased penalties (Measure 16) will require careful consideration for entities. If both these requirements commence at the same time, responsible entities may face greater enforcement exposure before they have had a reasonable opportunity to establish the new governance and assurance arrangements.

Conclusion

Responsible entities should act promptly to assess their current CIRMP governance and assurance arrangements against the proposed requirements and consider the practical implications of the proposed penalty uplift for their compliance posture.

Authors: Clare Doneley, Partner and Sanjam Bajwa, Lawyer.

Want to know more?

• Streamline and Modernise: An Overview of the SOCI Act 'Tranche 2' Reforms (21 September 2026)
• High Risk, Higher Standards: What the Enhanced CIRMP Rules Mean for You (8 July 2026)
• Your Board, Their Rules: Inside SOCI's Proposed Ministerial Powers (15 April 2026)
• The Insider Threat: Critical Infrastructure's Overlooked Vulnerability (6 August 2026)