What you need to know
- The enhanced CIRMP rules under the SOCI Act now require responsible entities of certain high-risk critical infrastructure assets to screen critical workers through the AusCheck framework or ensure they hold a relevant security clearance (NV1 minimum), moving beyond conventional criminal background checks.
- "Critical workers" extends beyond employees to include contingent workers and contractors, and the same screening rigor must apply across the entire workforce.
- Insider risks are not limited to operational personnel. Senior executives, governance functions, cyber security leaders and third-party vendors with privileged access all present personnel risk.
- For many organizations, enhanced SOCI and CIRMP requirements are still treated as compliance milestones. In reality, they are better understood as indicators of where regulatory expectations are heading.
What you need to do
- Integrate AusCheck screening into onboarding processes now and build screening lead times into recruitment timelines.
- Update employment contracts and position descriptions to include screening, re-screening and notification obligations for critical workers.
- Reassess which roles carry critical access beyond operational personnel and apply "need to know" and privileged-access principles across the organization.
- Extend governance frameworks into procurement and supply chain management. Contractual protections alone won't satisfy regulators if a major compromise occurs through a third-party vendor.
- Ensure you can demonstrate reasonable steps were taken to assess and manage insider risk.
The underappreciated risk in critical infrastructure: People
Containing cyber threats in critical infrastructure assets has tended to focus on having the right tools, but Australia’s authorities increasingly want more attention paid to the people who have access to vital functions and data.
The emergence of advanced AI cyber tools has raised concerns among governments, regulators and security specialists about the resilience of critical sectors. In particular, there is growing unease that the pace of threats is evolving faster than organizations can adapt. In some cases, models have not been publicly released because of concerns that those capabilities could be abused by bad actors (see our recent article on Anthropic Mythos).
Regulators in Australia, the US, the UK and Canada are already engaging with financial institutions and other critical sectors about how they intend to maintain operational resilience as AI-driven threats accelerate.
But while the debate around AI-enabled cyber risk often focuses on technical controls and network defense, there is another vulnerability that many organizations continue to underestimate: their people.
The challenge for the C-suite is not necessarily to eliminate all risk, but to build governance, preparedness and operational resilience frameworks capable of responding when incidents occur. For critical infrastructure organizations, that starts with recognizing that personnel risk is no longer a narrow HR issue - it is a question of organizational resilience.
Inadequate checks
One of the most significant shifts under Australia’s Security of Critical Infrastructure Act 2018 (SOCI Act) and associated Critical Infrastructure Risk Management Program (CIRMP) obligations is the focus on “critical workers” - individuals whose actions or access could significantly affect the resilience of essential infrastructure. Importantly, this term extends beyond traditional employees to include contingent workers and contractors in critical roles. Organizations are therefore required to apply the same screening rigor across their entire workforce, whether permanent or temporary.
Despite this, many organizations still approach recruitment screening through the lens of conventional criminal background checks. Under the enhanced CIRMP rules, however, this will no longer satisfy regulatory expectations. Entities responsible for certain categories of critical infrastructure assets will be required to use the Australian Government's AusCheck framework for screening critical workers – or, alternatively, to permit access where a critical worker holds a relevant security clearance (at Negative Vetting 1 level or higher) issued by an authorized Australian Government entity. It is worth noting that these enhanced obligations do not yet apply universally across all critical infrastructure asset types. At present, these enhanced obligations are directed at a defined subset of higher-risk assets, which are water, energy, broadcasting, domain name systems and freight infrastructure and services assets.
The AusCheck framework uses a more comprehensive model for screening individuals seeking sensitive roles. This includes identity verification, criminal history and national security assessments and right-to-work verifications. However, many organizations continue to avoid AusCheck due to the cost implications. That reluctance now faces a double challenge as AusCheck fees are continuing to rise and the enhanced CIRMP rules are set to make either an AusCheck background check or the holding of a relevant security clearance (NV1 minimum) mandatory for critical workers requiring access to critical components.
Offshore critical workers also present a unique challenge, as they may not be eligible for screening through AusCheck or for holding a relevant security clearance. Organizations with offshore personnel in critical roles will need to address this gap within their CIRMP, including by identifying and implementing alternative screening and risk mitigation measures appropriate to those individuals.
For organizations already in growth phases or actively onboarding new personnel, this combination of rising costs and a regulatory mandate requires particular consideration of screening budgets, recruitment timelines and workforce processes. Importantly, for critical workers requiring ongoing access to critical components, the AusCheck background check will need to be conducted at least every five years and for NV1, at least every ten years. This means organizations will need to build ongoing review cycles into their employment and contracting arrangements. Organizations should also consider imposing positive obligations on critical workers to notify relevant personnel if their circumstances change in a way that may affect their suitability for the role, providing an additional layer of assurance between formal re-screening intervals.
Under the baseline CIRMP framework, organizations are not legally required to use AusCheck directly, with many opting for private background check agencies instead. The problem is that standard commercial screening often misses the very risks that regulators and security agencies increasingly warn about. These include whether an individual has failed a security clearance review, been subject to national security attention, been investigated for organized crime links, or faced disciplinary action within defense or intelligence establishments – matters that may not appear under civilian criminal law.
This issue is particularly important as critical infrastructure operators often seek to hire former defense and intelligence agency personnel for their extensive experience of cyber threats and to carry out operational and security functions.
One of the issues is that military disciplinary systems operate differently from civilian equivalents. Serious misconduct, imprisonment or discharge under defense legislation may not automatically appear in ordinary corporate background checks.
Unless organizations ask the right questions, and use providers capable of obtaining the relevant information, important information could be missed.
It is important not to overlook these additional checks. When a major incident occurs, regulators will inevitably ask whether the organization took reasonable steps to assess insider risk, particularly where employees or contractors had access to sensitive systems and data. Governance failures in this area could result in regulatory action, reputational damage and, in serious cases, personal liability for directors.
Critical infrastructure organizations therefore need to integrate legal, risk and operational considerations into their screening processes. Conducting only one of these elements in isolation leaves critical governance gaps.
To manage these changes effectively, organizations should integrate AusCheck screening into existing onboarding processes. In practice, this means building screening lead times into recruitment timelines, evaluating roles by criticality to determine where AusCheck is mandatory versus where enhanced commercial screening may suffice in the interim, and engaging legal advisors early to draft contract terms that clearly allocate screening obligations. Taking these steps early will help minimize both cost and disruption as the new requirements take effect.
Not just critical workers
Another growing challenge is that many organizations still define insider risk too narrowly. Critical worker regimes often focus on employees with direct physical access to operational infrastructure. But in practice, the risk landscape extends well beyond those roles.
Senior executives, legal teams, governance functions, payroll personnel, cyber security leaders and risk officers may all hold privileged access to highly sensitive information, systems or operational decision-making processes. In some cases, their authority and visibility across the organization may create risks equivalent to those posed by operational personnel. This is even more pertinent as organizations digitize more operational functions and centralize access to sensitive systems.
The lesson from mature defense and intelligence environments is that resilience depends on applying disciplined access management principles across the organization. “Need to know”, “need to hold” and privileged-access controls are also governance issues rather than purely technical controls.
The challenge for Boards is that governance failures are often far less visible than technical vulnerabilities - until an incident occurs late on a Friday night.
As AI-driven threats accelerate, organizations must recognize that they cannot realistically recover every vulnerability immediately. Decisions around addressing vulnerabilities need to become increasingly risk-based and supported by vigorous governance frameworks.
That governance also needs to extend into procurement and supply chain management. Third and fourth-party vendors often hold access to systems, operational environments and sensitive data that may be critical to resilience. Contractual protections alone will not satisfy regulators if a major compromise occurs.
Employment considerations
A question that arises is how an organization can require an employee identified as a critical worker to undergo these checks.
The simplest solution is to ensure a critical worker's employment contract requires satisfaction of screening requirements as part of the pre-employment checks as well as an obligation to undergo periodic re-screening as required by the organization. This will resolve the issue for new employees and any current employees who are re-issued employment contracts.
If existing employees do not have screening obligations in their employment contracts, then organizations may need to issue a lawful and reasonable direction for them to undergo screening. If an employee refuses to comply, that becomes a separate issue, to be managed on its own facts.
Organizations should also ensure position descriptions are updated to identify whether a role is critical for the purposes of the SOCI Act. This will be useful in establishing whether compliance with the screening requirements under the SOCI Act forms part of the inherent requirements of their role.
If an adverse screening result is received, organizations should be mindful of their obligations under employment and anti-discrimination legislation when managing an employee's employment.
Lessons from government
For many organizations, enhanced SOCI and CIRMP requirements are still treated as compliance milestones. In reality, they are better understood as indicators of where regulatory expectations are heading.
The Protected Security Policy Framework (PSPF), used across Australian government agencies, offers one example of the level of rigor increasingly expected around personnel security, physical security and governance.
The framework extends into areas such as facility security planning, access governance and operational resilience. Many private-sector organizations remain unfamiliar with that depth of discipline because historically they have not operated in heavily regulated national security environments. That is changing.
The broader lesson from defense and intelligence sectors is not that private companies are resilient, it is that resilience requires continual reassessment, long-term planning and a recognition that security is not a “set and forget” exercise.
Technology will continue to evolve rapidly. AI-enabled offensive capabilities will continue to lower the cost, speed and sophistication of cyber-attacks. The organizations best positioned to manage that environment will be those capable of building disciplined governance, stronger personnel screening, integrated legal-risk oversight and mature preparedness frameworks before a major incident occurs.
Authors: Clare Doneley, Partner; Rachael Falk, Partner; Tamara Lutvey, Partner; Amanda Wu, Senior Associate; Sanjam Bajwa, Lawyer and Molly Fitzgerald, Lawyer.
