AICD submission on SOCI Act proposed reforms

On 31 July 2026 the AICD made a submission to the Department of Home Affairs consultation on proposed reforms to strengthen and modernise the Security of Critical Infrastructure Act 2018 (SOCI Act).

The AICD was supportive in-principle of a number of the proposed reforms. However, we cautioned against introducing extensive new prescriptive requirements that will ultimately only further entrench a compliance focused mindset rather than an outcomes-based model that seeks to build resilience and address asset hazards.

Our key points were:

• Measure 1 Exemptions Framework: We supported the development of a clearer and more flexible exemptions framework for entities, or classes of entities, already subject to equivalent regulatory requirements.

• Measure 15 CIRMP Governance and External Assurance: We supported in-principle a proportionate obligation for a CIRMP to be subject to periodic independent assurance. We recommended that any assurance requirement remain principles-based, with boards retaining discretion to determine the appropriate scope and method of review having regard to the nature of critical assets, entity size, complexity and risk profile.

• Measure 16 – Graduated Civil Penalty Settings: We supported in-principle the introduction of graduated civil penalty settings, provided they are implemented in a measured and proportionate way. However, we did not consider that an aggressive enforcement posture would be appropriate given the complexity of the SOCI Act, the multiple iterations and changes made to the regime in recent years, and the further changes contemplated in these reforms.

• Measure 19 – Supply Chain Cyber Security Assurance: We supported greater focus by both regulated entities and government on strengthening resilience across key digital supply chains. However, we cautioned against placing responsibility for supply chain resilience solely on SOCI entities, particularly where risks arise from highly concentrated global digital markets or from suppliers over which entities have limited visibility, leverage or contractual bargaining power.

• Regulatory costs – We recommended Home Affairs assess the cumulative regulatory costs of the reform package as a whole, rather than considering each proposed measure in isolation.