Jump to content

Security of Critical Infrastructure Act 2018

Add links
From Wikipedia, the free encyclopedia

Security of Critical Infrastructure Act 2018
Parliament of Australia
  • An Act to create a framework for managing risks to national security relating to critical infrastructure, and for related purposes
CitationAct No. 29 of 2018
Royal assent11 April 2018
Commenced11 July 2018
Administered byDepartment of Home Affairs

The Security of Critical Infrastructure Act 2018 (SOCI 2018) establishes a national framework to identify, manage and reduce national security risks to Australia's critical infrastructure. It covers assets across 11 industries and provides for an asset register, risk-management programs, incident reporting and ministerial directions.[1]

History

[edit]

The Act received royal assent on 11 April 2018 and commenced on 11 July 2018.[2] Parliament later expanded the framework in two tranches: the Security Legislation Amendment (Critical Infrastructure) Act 2021 and the Security Legislation Amendment (Critical Infrastructure Protection) Act 2022.[3][4] The 2022 advisory report of the Parliamentary Joint Committee on Intelligence and Security examined the Bill and recommended refinements adopted by government.[5]

The Act has been amended several times. In 2024 this was by the Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (SOCI Amendment Act).[6] Together with the Cyber Security Act 2024, and the Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024 this provides a comprehensive package of measures intended to protect Australian infrastructure with a strategy up to 2030.[7] Amongst others, these amendments explicitly stated the inclusion of data storage, not merely operational infrastructure, as one of the protected resources.[8]

Scope

[edit]

The framework applies to assets designated under the Act and rules across multiple industries. Positive security obligations and enhanced cyber obligations can be applied to specified assets, including those declared systems of national significance.[9][10]

The SOCI Act applies to the following 11 sectors:[1]

  • Communications
  • Financial services and markets
  • Data storage or processing
  • Defence industry
  • Higher education and research
  • Energy
  • Food and grocery
  • Healthcare and medical
  • Space technology
  • Transport
  • Water and sewerage

Provisions

[edit]

The Act's main aspects are:[11]

Positive obligations
Organizations are required to take pro-active preventive measures beforehand.[11]
Asset register
Assets deemed to fall under critical infrastructure are to be notified to the central register of such.[12] Industry sectors affected are specified and their 'switch on' dates informed on a sector-by-sector basis.[13]
Mandatory incident reporting
Any cyber incident that significantly impacts operation must be reported within 72 hours, 12 hours for critical events. This includes outages, attacks and threatened attacks, including ransomware.[11][14][15]
Government assistance
The Act grants government the power to either assist in a crisis, to direct a particular course of action, or to intervene and take charge of it.[9][11]
Risk management
Risks must be formally assessed regularly, and a risk management program must be put in place to ameliorate these. These assessments must be reported to the government's Cyber and Infrastructure Security Centre (CISC).[11][16][17]

Failure to comply is backed up by the potential for significant penalties, including fines or enforcement actions.[11]

Administration and enforcement

[edit]

The Cyber and Infrastructure Security Centre within the Department of Home Affairs administers the regime, including compliance, incident reporting and engagement with industry. Sectoral coordination occurs with other regulators where relevant; for example, a memorandum of understanding sets out cooperation with the Reserve Bank of Australia for payments systems.[12][18] Independent scrutiny has included a performance audit by the Australian National Audit Office on administration and regulation of critical infrastructure protection policy.[19]

References

[edit]
  1. ^ a b "Security of Critical Infrastructure Act 2018 (overview)". Critical Infrastructure Security Centre. 27 August 2024. Retrieved 19 October 2025.
  2. ^ "Security of Critical Infrastructure Act 2018 (as made)". Federal Register of Legislation. 4 April 2025. Retrieved 19 October 2025.
  3. ^ "Security Legislation Amendment (Critical Infrastructure) Act 2021". Federal Register of Legislation. Retrieved 19 October 2025.
  4. ^ "Security Legislation Amendment (Critical Infrastructure Protection) Act 2022". Federal Register of Legislation. Retrieved 19 October 2025.
  5. ^ "Advisory report: Security Legislation Amendment (Critical Infrastructure Protection) Bill 2022". Parliamentary Joint Committee on Intelligence and Security. 2022. Retrieved 19 October 2025.
  6. ^ "Cybersecurity law package 2024 passed by the Australian parliament". Pinsent Masons LLP. 26 November 2024.
  7. ^ "Australia's latest Security of Critical Infrastructure Act amendments explained". Pinsent Masons LLP. 3 December 2024.
  8. ^ "Demystifying Australia's Security of Critical Infrastructure Regime". Herbert Smith Freehills Kramer LLP. 28 April 2025.
  9. ^ a b "Security Legislation Amendment (Critical Infrastructure) Act 2021 — simplified outline of the Act (s 4)". Australian Taxation Office (consolidated law extract). Retrieved 19 October 2025.
  10. ^ "Security Legislation Amendment (Critical Infrastructure Protection) Bill 2022 — summary". Parliament of Australia. Retrieved 19 October 2025.
  11. ^ a b c d e f Leah Sadoian (12 February 2025). "SOCI Act Explained: Compliance Rules & Requirements". UpGuard.
  12. ^ a b "Security of critical infrastructure: legislation, regulation and compliance". Critical Infrastructure Security Centre. Retrieved 19 October 2025.
  13. ^ "Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022 — compilation". Federal Register of Legislation. 4 April 2025. Retrieved 19 October 2025.
  14. ^ "Mandatory cyber incident reporting now in effect". Australian Cyber Security Centre. 2 December 2021. Retrieved 19 October 2025.
  15. ^ "Mandatory Cyber Incident Reporting — guidance" (PDF). Cyber and Infrastructure Security Centre. April 2025. Retrieved 19 October 2025.
  16. ^ "Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023 — as made". Federal Register of Legislation. 16 February 2023. Retrieved 19 October 2025.
  17. ^ "Critical Infrastructure Risk Management Program — factsheet" (PDF). Critical Infrastructure Security Centre. 2025. Retrieved 19 October 2025.
  18. ^ "Memorandum of Understanding: Department of Home Affairs and Reserve Bank of Australia". Reserve Bank of Australia. Retrieved 19 October 2025.
  19. ^ "Administration of Critical Infrastructure Protection Policy". Australian National Audit Office. 2022. Retrieved 19 October 2025.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Security_of_Critical_Infrastructure_Act_2018&oldid=1321487217"