Australia SOCI Act

Security of Critical Infrastructure Act - 11 sectors, risk management program, mandatory IR reporting.


Short name	SOCI
Region	Asia-Pacific
Country or scope	Australia
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers SOCI

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 6 controls from Safeguard's control catalog for SOCI.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for SOCI and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`AU-SOCI-P2-REG` Register of Critical Infrastructure Assets	Responsible entities must provide and keep current operational and interest information about their critical infrastructure assets for the national register, which presumes knowing what systems and software constitute the asset (SOCI Act Part 2)	Scan
`AU-SOCI-P2A-RMP` Critical Infrastructure Risk Management Program	Responsible entities must adopt and maintain a written risk management program that identifies material risks to the asset, which requires an inventory of the software components the asset depends on (SOCI Act Part 2A)	Scan
`AU-SOCI-CIRMP-SC` Supply Chain Hazard Management	The risk management program must minimise material risks arising from supply chain hazards, including reliance on third-party vendors and suppliers, so component origins must be documented (SOCI Act Part 2A and CIRMP Rules 2023 supply chain hazard provisions)	Scan
`AU-SOCI-30BC` Critical Incident Reporting Readiness (12 hours)	Cyber security incidents with a significant impact must be reported within 12 hours, demanding the ability to rapidly identify which precise components are affected (SOCI Act s 30BC)	Scan
`AU-SOCI-30BD` Other Incident Reporting Readiness (72 hours)	Other relevant cyber security incidents must be reported within 72 hours, requiring version-level knowledge of deployed software to assess whether an incident is relevant to the asset (SOCI Act s 30BD)	Scan
`AU-SOCI-P2A-CYBER` Cyber and Information Hazard Controls	The risk management program must minimise cyber and information security hazards, which for software assets includes protecting the integrity of code and artifacts against tampering (SOCI Act Part 2A cyber hazard obligations, CIRMP Rules 2023)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`SOCI-2A`	Critical Infrastructure Risk Management Programme
`SOCI-2B`	Cyber Incident Reporting
`SOCI-2C`	Enhanced Cyber Security Obligations
`SOCI-3`	Critical Infrastructure Asset Register
`SOCI-POSOWN`	Positive Security Obligations
`SOCI-GOVCOORD`	Government Coordination & Assistance

Policy templates

Written for SOCI:

SOCI Act Critical Infrastructure Risk Management Programme

And 22 from the standard set, adapted to SOCI.