The Critical Infrastructure Test: What Expanded SOCI Obligations Mean for ICT in Government
For years, the Security of Critical Infrastructure Act (SOCI) sat in the background of most public sector conversations about IT. A Home Affairs framework, primarily concerned with private-sector operators of essential services. That has changed. Successive amendments have progressively expanded the Act's reach into government-owned and government-controlled critical infrastructure, and the obligations that follow now apply, in various forms, to a growing set of Commonwealth and state agencies.
For the technology leaders inside those agencies, SOCI is no longer a compliance conversation. It is a design conversation.
What SOCI now requires
The Cyber and Infrastructure Security Centre (CISC) within Home Affairs oversees a regime that spans eleven critical infrastructure sectors, from energy and water to healthcare, transport, communications, food and grocery, financial services, and data storage or processing services. For entities designated as responsible for critical infrastructure assets, the current obligations include:
• Registration of critical infrastructure assets with the Register of Critical Infrastructure Assets.
• Risk management programs (CIRMP) covering cyber, personnel, supply chain, and physical hazards.
• Mandatory cyber incident reporting to ASD's ACSC within tight windows (12 hours for critical incidents, 72 hours for other incidents).
• Enhanced cyber security obligations (ECSO) for Systems of National Significance, including incident response planning and government assistance obligations.
• Supply chain and third-party risk visibility as part of the CIRMP.
For agencies that hold critical infrastructure assets — a hospital network, a water utility, a transport authority, a data storage service, or an increasingly integrated cross-agency ICT platform — those obligations translate directly into how systems are designed, operated, and assured.
Where it lands in day-to-day ICT delivery
Three practical shifts are worth calling out.
First, cyber incident readiness is no longer a documentation exercise. The 12-hour and 72-hour reporting windows mean detection, escalation, and communication paths have to work in real time. Agencies that cannot confirm within hours whether an event qualifies as reportable are already behind.
Second, supply chain assurance is now a first-class discipline. Vendor due diligence, third-party access controls, and continuous monitoring of supplier security posture are no longer nice-to-haves. Under CIRMP, they are expected practice.
Third, the boundary of “the system” has widened. SOCI thinks in terms of the asset rather than any single technology stack. That means identity, network, cloud, and application layers all sit inside the same accountability envelope, a shift that pushes agencies toward a more integrated design conversation between security, delivery, and assurance functions.
What good looks like
The agencies operating well inside the expanded SOCI regime share a small set of habits. They treat the CIRMP as a living operational document rather than an annual submission. They test incident escalation paths as often as they test technical controls. They build cyber, supply chain, and physical risk into the same governance conversation, rather than running them in parallel and hoping they meet.
Public sector IT solutions in the SOCI era have to be built to satisfy a design standard, an operational standard, and a reporting standard at the same time. That combination is what the strongest Government IT Consulting and Managed Services engagements are increasingly being built to deliver.
Why it matters beyond compliance
The value of SOCI is not that it introduces new obligations. It is that it consolidates a set of disciplines that already mattered into a single accountability framework. Well-designed public sector IT solutions from trusted Government Enterprise IT Partners have always considered supply chain risk, incident readiness, and integrated assurance. What SOCI does is name those expectations, formalise them, and give them regulatory teeth.
For agencies with critical infrastructure obligations, the practical question is no longer whether to invest in the disciplines that respond. It is whether the technology partners they work with can help apply those disciplines at the pace the regime now demands.
How TSC Can Help
At The Services Company, we help government IT departments design and deliver citizen experiences that strike the right balance between technology and humanity. As a specialist public sector IT provider, we bring together intuitive portals, AI-assisted services and accessibility-first design to make complex systems simple, for the citizens who use them and the teams who manage them.
If your department is exploring how to bring AI and automation into your citizen experience strategy (without losing the human touch), let's talk.
Get in touch with our team at The Services Company, Australia’s Most Trusted NSW Government IT services partner.
The Services Company – Australia's Most Trusted Public Sector IT Provider
The Services Company (TSC) is a Sydney-based public sector IT provider delivering government IT consulting and managed services, cybersecurity consulting and ITSM to NSW state and federal departments.
We help departments run leaner, more transparent programs across Citizen Experience, Government Efficiency, Critical Services and Departmental Transformation, backed by 20+ years as the government enterprise IT partner Sydney teams rely on.
Whether you need an NSW Government IT managed services partner or public sector IT solutions for a single critical project, TSC delivers secure, compliant, citizen-first outcomes. Panel listings: SCM0020, SCM0005 and LGP ICT Products and Services.
Sources
Cyber and Infrastructure Security Centre (CISC), Department of Home Affairs — Security of Critical Infrastructure Act 2018 (as amended), Critical Infrastructure Risk Management Program (CIRMP) guidance, and Systems of National Significance framework (cisc.gov.au); Australian Signals Directorate — mandatory cyber incident reporting requirements and ASD's ACSC incident response guidance (cyber.gov.au); Security Legislation Amendment (Critical Infrastructure) Acts 2021 and 2022, and Security of Critical Infrastructure and Other Legislation Amendment Act 2024.