SOCI Act supply chain hazards: what the CIRMP Rules require

The Security of Critical Infrastructure Act 2018 (Cth) requires the responsible entity for certain critical infrastructure assets to adopt, maintain and comply with a critical infrastructure risk management program (CIRMP). Supply chain hazards are one of the hazard types the CIRMP Rules spell out, and they reach down to the hardware an asset runs on. This guide covers who must comply, what the Rules require, key dates, and the hardware records that can support a program.

Key points

Part 2A of the SOCI Act requires a responsible entity to adopt and maintain a written CIRMP for its covered assets.
The CIRMP Rules list 13 asset classes, including electricity, water, food and grocery, and designated hospitals.
Section 10 lists six supply chain material risks every program must address as far as reasonably practicable.
Enhanced rules from 10 June 2026 add supply chain mapping and vendor assessment (section 10A) for nine asset classes, due by 10 June 2028 for existing assets.
Annual reports are due within 90 days after the financial year ends and need board, council or governing body approval where one exists.

This page is general information, not legal advice. For authoritative guidance, contact the Cyber and Infrastructure Security Centre (CISC).

Who must have a CIRMP

Under section 30AC of the SOCI Act, the responsible entity for one or more critical infrastructure assets must adopt and maintain a CIRMP, with a civil penalty of 200 penalty units. Part 2A also covers assets declared under section 51 where the declaration applies it (section 30AB).

Section 4(1) of the CIRMP Rules specifies 13 classes: critical broadcasting, domain name system, data storage or processing, electricity, energy market operator, gas, food and grocery, freight infrastructure, freight services, liquid fuel and water assets, certain critical financial market infrastructure assets, and designated hospitals.

Section 4A(1) makes nine of those classes subject to enhanced requirements on top of the baseline: broadcasting, domain name systems, electricity, energy market operator, freight infrastructure, freight services, gas, liquid fuel and water. The CISC CIRMP guidance places critical telecommunications assets under separate TSRMP Rules, and shows no CIRMP obligation for classes such as banking, ports, aviation and defence assets.

What the Rules say about supply chain hazards

Section 3 of the CIRMP Rules says a supply chain hazard "includes malicious people both internal and external exploiting, misusing, accessing or disrupting the supply chain and over-reliance on particular suppliers."

Section 10(1) requires a process or system in the CIRMP to minimise or eliminate these material risks, as far as it is reasonably practicable to do so:

unauthorised access, interference or exploitation of the asset's supply chain
misuse of privileged access to the asset by any provider in the supply chain
disruption of the asset due to an issue in the supply chain
risks arising from threats to people, assets, equipment, products, services, distribution and intellectual property within supply chains
risks arising from major suppliers
any failure or lowered capacity of other assets and entities in the entity's supply chain.

The process must also mitigate the relevant impact of a supply chain hazard. Under section 10(2), the entity must have regard to whether its CIRMP lists its major suppliers and describes the supply chain hazards that could have a relevant impact. A major supplier is "any vendor that by nature of the product or service they offer, has a significant influence over the security of a responsible entity's CI asset."

Section 6(b) lists as a material risk "a substantive loss of access to, or deliberate or accidental manipulation of, a critical component of the CI asset". The Act defines a critical component as a part whose absence, damage or compromise would prevent the asset's proper function or could cause significant damage, as assessed by the responsible entity.

Enhanced requirements in section 10A

For enhanced assets, section 10A requires the entity to map its supply chain for major suppliers and critical components. The CIRMP must identify risks to the availability, integrity, reliability or confidentiality of critical components, set a maximum acceptable outage, and include measures to minimise or eliminate those risks.

Section 10A(4) and (5) add a vendor assessment for each existing or proposed major supplier. It covers the FOCI (foreign ownership, control or influence) legal requirements the supplier is subject to, sanctions affecting the jurisdiction, and the supplier's access, influence and control over the asset. CISC says baseline-only entities need not map their supply chains, but strongly recommends that all responsible entities consider some mapping.

Key dates and annual reporting

17 February 2023: the CIRMP Rules commenced (legislation history), with a baseline grace period of six months under section 4(2).
10 June 2026: the enhanced CIRMP Rules commenced, per the CISC enhanced CIRMP snapshot.
10 June 2027: grace period ends for the new material risks (sections 6A, 8A(2) and 9A(2)) for assets that were CI assets before 10 June 2026.
10 June 2028: grace period ends for section 10A and the other enhanced measures for those assets. Later assets get 24 months from becoming a CI asset under section 4A(6).

Section 30AG of the SOCI Act requires an annual report in the approved form within 90 days after each financial year ends. It must state whether the program was up to date at year end and evaluate its effectiveness against any hazard that had a significant relevant impact. Where the entity has a board, council or other governing body, that body must approve the report.

CISC says the 2025-26 report (1 July to 28 September 2026) needed no information on enhanced risks or measures. The 2026-27 report covers the enhanced material risks from 11 June 2027. The CISC guidance recommends backing an "up to date" statement with evidence that the program has been reviewed.

Where hardware inspection fits

The Rules do not name an inspection method, but CISC's guidance gives hardware examples. Its glossary gives this example of supply chain interference: "Tampering with hardware or software during manufacturing, transit, or delivery phases which introduces unreliable components to the CI asset."

Section 7.3.2.1 of the CISC guidance suggests recording movements of critical components in and out of an entity's control. When components leave for maintenance, repair or disposal, compensating controls can include "checking components prior to reintegrating them into the CI asset environment".

CISC's worked example on counterfeit components lists this control: "Inspect and test critical components before installation, proportionate to their criticality and the sourcing circumstances". It also notes "the difficulty of identifying sophisticated counterfeits through visual inspection alone."

Section 11 of the Rules adds physical security duties: identify physical critical components, control access to them, respond to unauthorised access, and test that security arrangements can detect, delay, deter, respond to and recover from a breach.

A practical evidence checklist for hardware

List each asset's hardware critical components, such as circuit boards and controllers, and who supplies them.
Record which suppliers meet the major supplier definition and why.
Keep a provenance log: receipt, serial numbers, install location, and each time a unit leaves your control.
Inspect and test critical hardware before installation and after repair, in proportion to its criticality. Keep the results.
Check firmware against a known good version and record what is installed.
Fit tamper-evident seals after inspection, log each seal number against the asset, and check seals at every site visit.
Audit installed hardware and maintenance plans on a set schedule, and log findings and fixes.
Feed results into the regular review (section 30AE) and update duty (section 30AF), so the annual report rests on current records.

DISP and the PSPF for defence suppliers and agencies

Defence suppliers and Commonwealth agencies have their own frameworks.

Framework	Who it applies to	What it says about supply chain	Official source
SOCI Act and CIRMP Rules	Responsible entities for assets listed in section 4(1)	Six material risks in section 10; mapping and vendor assessment in section 10A for enhanced assets	Federal Register of Legislation
Defence Industry Security Program (DISP)	Open to Australian entities seeking to join the Defence industry supply chain; mandatory in set cases	Membership covers governance, personnel, physical, and ICT and cyber security, plus a FOCI declaration	Department of Defence
Protective Security Policy Framework (PSPF)	Non-corporate Commonwealth entities subject to the PGPA Act	Assess the source, reliability and integrity of suppliers and the supply chain; use secure and verifiable vendors (Requirement 0048)	protectivesecurity.gov.au

Per the DISP eligibility page, membership is mandatory for entities that work on classified information or assets (PROTECTED and above), handle weapons or explosive ordnance, provide security services for Defence bases, or need it as a contract condition.

The PSPF Release 2026, published 1 July 2026, asks entities to consider risks "as systems, software and hardware are being designed, built, stored, delivered, installed, operated, maintained and decommissioned."

Where BoardSafe fits

BoardSafe can support the hardware evidence an entity keeps for its program. Its scanner checks a circuit board against the board's original design files, flags parts that are fake, swapped or not in the design, and checks firmware against a known good version. Each board takes under 60 seconds, on site, so design files stay with the customer. After a device passes, a small serial-numbered tamper-evident seal goes across the join of its case.

Ongoing assurance adds yearly audits of critical hardware infrastructure and maintenance plans, plus on-site visits for compliance checks and hardware integrity verification. The program and its compliance stay with the responsible entity. See also our guides to tamper-evident seals for IT and OT equipment and counterfeit electronic components.

Questions people ask

What is a supply chain hazard under the CIRMP Rules?

Section 3 of the CIRMP Rules says a supply chain hazard includes malicious people both internal and external exploiting, misusing, accessing or disrupting the supply chain, and over-reliance on particular suppliers. Section 10 then lists six material risks a program must minimise or eliminate as far as reasonably practicable, from unauthorised access to the supply chain to failure of other entities in it.

Which assets need a critical infrastructure risk management program?

Section 4(1) of the CIRMP Rules lists 13 classes: critical broadcasting, domain name system, data storage or processing, electricity, energy market operator, gas, food and grocery, freight infrastructure, freight services, liquid fuel and water assets, certain critical financial market infrastructure assets, and designated hospitals. Under section 30AB of the SOCI Act, an asset declared under section 51 can also be brought under Part 2A.

When do the enhanced supply chain requirements in section 10A apply?

The enhanced CIRMP Rules commenced on 10 June 2026. For assets that were already critical infrastructure assets and are in an enhanced class, CISC says section 10A (supply chain mapping and vendor assessment) must be met by 10 June 2028. The new material risks in sections 6A, 8A(2) and 9A(2) must be met by 10 June 2027.

Does the board have to approve the CIRMP annual report?

Yes, where the entity has one. Section 30AG of the SOCI Act requires the annual report within 90 days after the end of the financial year, in the approved form, approved by the board, council or other governing body. CISC's guidance says the regulator may also request access to the CIRMP itself for compliance, assurance or audit purposes.

Do baseline-only entities have to map their supply chain?

No. CISC's guidance says entities subject only to the baseline CIRMP are not required to map their supply chain for major suppliers and critical components, which is a section 10A enhanced requirement. It still strongly recommends that all responsible entities consider some level of supply chain mapping, so they understand how risk enters their supply chain.