A SOCI Act risk management audit checks whether a responsible entity's Critical Infrastructure Risk Management Program (CIRMP) is documented, aligned to a recognised framework and actually operating across four hazard domains: cyber, personnel, supply chain and physical. AI helps by monitoring controls continuously and assembling evidence, while accountable executives keep every decision and sign-off.
This guide is for CISOs, risk managers and CIOs at regulated operators and their key suppliers in energy, water, transport, ports, data processing, health care and food and grocery, including the many Victorian and Melbourne-based operators preparing for SOCI Act compliance audits. It explains what the CIRMP requires, where AI does real work and where it adds risk. It is general information, not legal advice.
Key takeaways
- Under the Security of Critical Infrastructure Act 2018 (SOCI Act), responsible entities have had to maintain a CIRMP since 2023, with the cyber hazard framework requirement in force from 17 August 2024.
- The regulator, the Cyber and Infrastructure Security Centre (CISC), and the Department of Home Affairs are moving expectations toward ongoing, demonstrable control rather than an annual attestation.
- AI fits the high-volume monitoring and evidence work: continuous control checks, supplier risk monitoring, insider-risk signals for human review, and drafting the annual report.
- Sensitive control and telemetry data should stay onshore in infrastructure you control, and AI must never close a risk or approve a control state on its own.
What does the SOCI Act CIRMP require?
A CIRMP is a documented program in which a responsible entity identifies and manages material risks from hazards that could affect the availability, integrity, reliability or confidentiality of a critical infrastructure asset. The CIRMP Rules group hazards into four domains:
- Cyber and information security hazards
- Personnel hazards (the trusted insider)
- Supply chain hazards
- Physical security and natural hazards
For the cyber domain, entities must comply with a recognised framework such as the Australian Energy Sector Cyber Security Framework (AESCSF), ISO/IEC 27001, the NIST Cybersecurity Framework, the Australian Signals Directorate's Essential Eight, or an equivalent. The point is alignment to a recognised baseline.
Two further obligations sit alongside the CIRMP:
- Mandatory cyber incident reporting to the Australian Signals Directorate: critical incidents with a significant impact within 12 hours of becoming aware, and other relevant incidents within 72 hours.
- A board-approved annual report on the CIRMP, submitted to the regulator after the end of each financial year.
Home Affairs has continued consulting on enhancements to the CIRMP Rules, with proposals that make expectations around material risks more explicit across cyber, supply chain and personnel security. Watch the CISC website for the current Rules before your next review.
If your security posture is built around general cyber security requirements for Australian businesses, the SOCI Act adds a higher, asset-specific bar with a regulator that expects evidence.
Are you a responsible entity under the SOCI Act?
Start by establishing whether you hold a regulated critical infrastructure asset. Asset classes are defined by sector. Treat the filter below as a starting point and confirm against current CISC guidance and legal advice.
Does your organisation operate assets in a regulated sector?
- Electricity, gas, liquid fuels, energy market operationLikely a responsible entity: CIRMP obligations apply
- Water, sewerage, transport, ports, aviationLikely a responsible entity: assess each asset
- Data storage or processing for government or critical sectorsPotentially in scope: check the asset definition
- Health care, food and grocery, communicationsPotentially in scope: confirm thresholds
- No regulated assets, but you supply oneOut of direct scope, but expect supply chain due diligence
The last row matters to a large group of mid-sized suppliers: engineering firms, maintenance contractors, software providers and logistics operators. Responsible entities increasingly push SOCI-driven supply chain requirements onto their suppliers, so demonstrable controls become a commercial qualifier.
What does a SOCI Act risk management audit look for?
Whether the review is internal audit, an external assurance provider or a CISC inquiry, a CIRMP audit tends to test the same things:
- Coverage: every regulated asset is mapped and every hazard domain is addressed.
- Framework alignment: the cyber domain meets the chosen framework at the required maturity.
- Operation: controls described in the document are actually working, with evidence over time.
- Governance: material risks are escalated, residual risks are accepted at the right level, and the board has approved the annual report on an informed basis.
- Incident readiness: the organisation can detect, classify and report incidents within the legislated timeframes.
Most operators can produce a credible document. Far fewer can show, on any given day, that the controls in it are operating. That gap is where audits find problems.
| Annual Attestation | Continuous Assurance | Impact | |
|---|---|---|---|
| Control evidence | Gathered once a year | Captured continuously | Always current |
| Risk visibility | Snapshot | Live | Current |
| Audit preparation | Weeks of scramble | Query the system | Major |
| Time to detect drift | Often months | Close to when it happens | Material |
| Board reporting confidence | Best estimate | Evidence-backed | Defensible |
This table describes the typical difference in posture, not a measured result.
Where does AI help across the four CIRMP hazard domains?
AI is not a control framework, and it does not replace the accountable executive. It handles the high-volume, exception-driven monitoring and evidence work people cannot sustain manually across four domains and dozens of controls.
1. Continuous cyber control monitoring
The cyber domain generates enormous signal volumes: configuration states, patch levels, access events and alerts. AI can continuously check the actual state of controls against your adopted baseline (Essential Eight, ISO/IEC 27001 or AESCSF) and flag drift when a control slips.
- IngestPull control state from across systems
- AssessCompare against the framework baseline
- DetectFlag drift and emerging anomalies
- EscalateRoute material risks to the right owner
- EvidenceLog a timestamped, auditable trail
The evidence step makes the rest defensible. When an auditor asks how you know a control was operating in March, the answer is a query. This is the same approach we describe for automated compliance reporting.
2. Supply chain risk monitoring
Supply chain risk lives outside your perimeter, which makes it hard to manage manually. AI helps maintain a live view of material suppliers: monitoring for adverse signals, tracking vendor-attested security posture, and flagging concentration risk where too many critical functions depend on one provider. It extends structured vendor onboarding into year-round oversight.
3. Personnel and insider risk signals
AI can correlate access patterns and behavioural signals to surface anomalies for a human investigator. The governance bar is high: this is sensitive employee data, and any system touching it must respect the Privacy Act and clear human-override controls set out in our AI governance framework.
4. Evidence assembly and the annual report
AI can draft the annual report narrative and assemble supporting evidence from the monitoring trail, leaving security leaders to verify and exercise judgement. The accountable executive still signs. The assembly burden shrinks.
How do operators get to continuous CIRMP assurance?
A staged roadmap keeps the program credible while capability grows.
- Stage 1BaselineMap assets, adopt a recognised cyber framework, document the CIRMP across all four hazard domains
- Stage 2InstrumentConnect control data sources so evidence can be collected automatically
- Stage 3MonitorLayer AI-assisted continuous monitoring and drift detection on the instrumented controls
- Stage 4AssureGenerate evidence-backed board and regulator reporting on demand
Most operators sit between Stage 1 and Stage 2. The Stage 2 work, connecting existing systems so control data flows into one place, is largely a system integration exercise that pays off well beyond compliance.
- Audit and annual report preparationFar less manual effort
- Detection of control driftEarlier
- Probability of a preventable incidentReduced
- Regulatory and penalty exposureMaterially reduced
The defensible business case for SOCI investment is reducing the probability and cost of the incident that takes a critical asset offline. Efficiency gains are a welcome second benefit.
How does continuous monitoring help meet the incident reporting clock?
For most operators, the hard part of incident reporting is detecting the incident, triaging severity and assembling the facts within 12 or 72 hours. An operator that already collects control state and telemetry continuously can detect earlier, classify against the threshold and pull together the chronology faster.
AI correlates signals across systems, flags events that may cross the reporting threshold and drafts the factual timeline for a person to verify before lodging. The accountable security leader decides whether and what to report.
Rehearse it. A tabletop exercise that runs a simulated incident through detection, classification and reporting against the legislated timeframes exposes gaps before a real incident does.
What are the traps when using AI for SOCI compliance?
Sending sensitive control data offshore. Telemetry, vulnerability data and personnel signals are among the most sensitive data you hold. Routing them through overseas AI services creates a sovereignty problem and new attack surface. Keep this data onshore in private AI infrastructure you control, as set out in our data sovereignty guide.
Treating AI output as a determination. Any workflow that lets AI silently close a risk or auto-approve a control state removes the human accountability the SOCI Act assumes. Keep AI in an advisory, evidence-producing role.
Automating an immature program. Continuous monitoring on poorly defined controls just produces faster noise. Get the framework baseline and documented CIRMP right first.
Our 50-point AI security checklist maps well onto the diligence a SOCI-regulated operator needs before deploying AI in a security-critical role.
What does the board need to see?
The annual CIRMP report is approved at board or governing-body level, so the program has to translate into something a non-specialist director can sign with confidence. What works is a concise, evidence-backed view: material risks across the four domains, the controls in place, where they operate as designed, and where there is drift or accepted residual risk with a remediation plan. Its value is that every line traces back to timestamped records.
How Solve8 can help
Our consultants and engineers connect control, telemetry and supplier data into one evidence trail and build monitoring that runs on your infrastructure in Australia, with your security leaders approving every escalation. Our team includes people with operational technology and industrial data experience across mining and energy environments. See our system integration and private AI infrastructure services, or talk to us.
