The Security of Critical Infrastructure Act 2018 (SOCI Act) is designed to protect Australian critical infrastructure, ensure resilience against disruptions, and safeguard national security, the economy and community wellbeing.
As a regulator, the Critical Infrastructure Security Centre (CISC) strives to ensure the reliability, continuity and security of Australia’s critical infrastructure.
In 2026-27, the CISC is evolving its regulatory compliance posture in response to changes in the threat environment and recommendations of the 2026 Independent Review of the SOCI Act. Please see our SOCI Regulatory Philosophy for further detail on our revised approach to regulating critical infrastructure in Australia.
Working in partnership with regulated entities to promote education and awareness of SOCI obligations will continue. This will be complemented by a greater focus on a range of measures to address potential or identified non-compliance with SOCI obligations. Depending on the findings of compliance assessments, responses may include:
- Regulatory Guidance Notices – Regulatory Guidance Notices (RGNs) will be issued to an entity where a gap below the non-compliance threshold has been identified. RGNs are educative and corrective in intent, and seek to clarify and resolve potential non-compliance matters prior to formal identification of non-compliance.
- Non-Compliance Notices – Non-Compliance Notices (NCNs) are a formal notice to an entity, confirming that non-compliance with the SOCI Act has been identified. Depending on the nature of the contravention, the NCN may require ‘no-action’, and simply notify the entity of the non-compliance; or may include a return-to-compliance process which the CISC will monitor and track.
- Enforcement Actions (particularly the issuing of infringement notices) – As the case requires, the CISC may issue an infringement notice in response to any potential or identified non-compliance, for example in instances of serious or persistent non-compliance, or where a significant unmitigated national security threat is present. The issuing of infringement notices support the CISC’s regulatory approach by providing a clear and practical pathway for addressing non-compliance and helping industry return to compliance.
- Where the recipient meets the requirements of an infringement notice, the matter is considered resolved and no further regulatory action will be taken in relation to the alleged contravention. Importantly, responding to an infringement notice does not mean that the recipient is admitting wrongdoing. However, where the issue is not resolved, the CISC will consider further regulatory options, which can include court-based action in appropriate circumstances.
The CISC will continually review our activities based on the results and impact on industry. As the threat environment evolves over time, we will also develop our activities and amend our processes to ensure we are achieving the objectives of the SOCI Act in enhancing critical infrastructure resilience and protecting Australia’s economy, security and community wellbeing.
In deciding which compliance action to pursue, the CISC will consider the circumstances of each case. Depending on the facts and evidence, this may result in one or more forms of enforcement action, or an alternative regulatory outcome. Factors the CISC will consider, include:
- the nature and seriousness of the suspected misconduct
- the conduct of the person or entity after the suspected misconduct
- the expected public benefit in taking enforcement action
- the likelihood of behavioural improvement and deterrence for the regulated entity and other regulated entities
- whether the misconduct was isolated and the level of harm caused
- whether the misconduct was inadvertent and whether it has been self-reported.
Contact us
If you have any questions, email enquiries@cisc.gov.au
To stay updated with critical infrastructure news and advice from the department, follow CISC on LinkedIn.
You can join the Trusted Information Sharing Network (TISN) by completing an application form. You can find more information on the Trusted Information Sharing Network webpage.
