SOCI Act CIRMP Deadlines: What Responsible Entities Need to Know in 2026

The Critical Infrastructure Risk Management Program (CIRMP) obligations under the Security of Critical Infrastructure Act 2018 (SOCI Act) are no longer new. The CIRMP Rules commenced on 17 February 2023, with a grace period that ended on 18 August 2024. If you are a responsible entity for a critical infrastructure asset, you should already have a CIRMP in place, have submitted your first annual report, and be well into your second cycle.

The reality, based on what we see working with entities across multiple sectors, is that many organisations are still catching up. Some have a CIRMP on paper but have not operationalised it. Others have strong technical controls but weak governance documentation. A surprising number are uncertain about what their annual report should contain and whether their board has fulfilled its approval obligations.

This article provides a practical guide to where things stand in 2026, what the Cyber and Infrastructure Security Centre (CISC) expects, and what you need to do if you are behind.

Who Is Affected: Responsible Entities and Critical Infrastructure Assets

The SOCI Act applies to responsible entities for critical infrastructure assets across 11 sectors: communications, data storage and processing, defence industry, energy, financial services and markets, food and grocery, health care and medical, higher education and research, space technology, transport, and water and sewerage.

If you are the owner or operator of an asset that is listed on the Register of Critical Infrastructure Assets (or should be), you are a responsible entity. The obligation to maintain a CIRMP applies to you. If you are not sure whether your asset qualifies, the CISC maintains the register and can provide guidance — but given that the obligation has been in force since 2023, uncertainty at this point is itself a compliance risk.

What a CIRMP Must Contain

The CIRMP Rules set out the minimum contents of a compliant CIRMP. This is not a suggestion — it is a legislative instrument with civil penalties for non-compliance.

Board Approval and Annual Reporting

The SOCI Act imposes specific board-level governance obligations. The CIRMP annual report must be:

• Approved by the board (or the governing body for entities without a traditional board structure) before submission to the sector regulator
• Submitted annually to the relevant Commonwealth regulator for the entity's sector. The exact deadline and regulator depend on the sector — for example, the Australian Energy Market Operator (AEMO) for energy sector entities, the Department of Health for health care entities
• Honest and accurate — the board must be satisfied that the information in the annual report is true and correct. Directors who approve a misleading report face personal accountability

The Relationship Between CIRMP and Essential Eight

Many responsible entities have adopted the Essential Eight Maturity Model as their cyber security framework for the CIRMP cyber hazard vector. This is a valid choice under Schedule 1 of the CIRMP Rules. However, it is critical to understand what the E8 covers and what it does not.

The Essential Eight addresses one of four hazard vectors. It provides a structured approach to managing cyber and information security risks through eight mitigation strategies. But your CIRMP must also address personnel hazards, supply chain hazards, and physical security and natural hazards — none of which the E8 covers.

Furthermore, even within the cyber hazard vector, the E8 does not cover:

• Incident detection and response (the E8 is preventative, not detective or responsive)
• Network security and segmentation
• Security governance and risk assessment
• Data protection and encryption
• Security monitoring and log management (beyond what ML3 requires for specific strategies)

For a detailed mapping of how the E8 aligns to CIRMP obligations, including the specific gaps, see our E8-to-CIRMP Mapping Guide.

What CISC Expects: Regulatory Posture in 2026

The Cyber and Infrastructure Security Centre (CISC), within the Department of Home Affairs, administers the SOCI Act for cross-cutting matters and coordinates with sector-specific regulators. Based on public statements and regulatory guidance, CISC's focus in 2026 is on:

• Compliance, not perfection — CISC has acknowledged that CIRMP compliance is a journey. The expectation is not that every risk is fully mitigated, but that entities have a compliant program in place, are actively managing material risks, and are demonstrating year-on-year improvement.
• Quality of annual reports — regulators are looking at the substance of annual reports, not just whether they were submitted. Reports that are generic, lack specificity about the critical infrastructure asset, or do not address all four hazard vectors will attract scrutiny.
• Board engagement — there is increasing focus on whether boards are genuinely engaged with CIRMP obligations or merely rubber-stamping reports. Regulators may request evidence of board discussions, risk committee papers, and governance records.
• Incident reporting alignment — the Cyber Security Act 2024 introduced mandatory incident reporting obligations that intersect with CIRMP. Entities are expected to have integrated their incident reporting processes across both legislative frameworks.