Australia Can Intervene in a Critical-Infrastructure Cyber Incident
Australia’s critical-infrastructure framework combines mandatory risk management and incident reporting with last-resort government powers to act during a serious cyber incident.
Australia has expanded the Security of Critical Infrastructure Act in several waves. Major reforms in 2021 and 2022 broadened the sectors in scope, created mandatory cyber-incident reporting and introduced government-assistance powers. The Enhanced Response and Prevention reforms received assent in November 2024, and enhanced Critical Infrastructure Risk Management Program requirements commenced on 10 June 2026 for relevant asset classes.
The result is not a single cyber rule. It is a national resilience framework that connects asset registration, risk programmes, incident reports and emergency intervention.
Reporting begins before the crisis is over
Responsible entities for covered critical infrastructure assets may need to report cyber incidents through the statutory framework. The reporting period depends on the applicable threshold, including whether an incident has a significant impact on asset availability.
The organisation therefore needs to recognise regulated impact early. A security team may still be determining the attacker’s identity while operations can already confirm that the asset cannot deliver its critical function.
Supplier contracts must support this. If the relevant detection occurs inside a managed service or telecommunications provider, notification cannot wait for the supplier’s normal monthly governance meeting.
Risk management must cover more than cyber
The Critical Infrastructure Risk Management Program is an all-hazards requirement. Depending on the asset and applicable rules, it addresses risks involving cyber and information security, personnel, supply chains, physical security and natural hazards.
Enhanced requirements introduced in 2026 add further expectations for specified assets. The precise obligation depends on asset class, declaration and current rules, so organisations need an applicability map rather than a generic “SOCI compliant” label.
A mature programme should connect risks to the essential function, tolerable outage, dependencies, controls and accountable executive approval.
Government assistance is a last resort—but real
During a serious cyber incident that creates a material risk to Australia’s social or economic stability, defence or national security, the Act provides escalating government-assistance powers.
Subject to statutory conditions and authorisations, government may gather information, direct an entity to take specified action or authorise an Australian government agency to take action to protect a network or system. The most intrusive power requires high-level approval and is described as a last resort.
This changes incident planning. An operator should know how it would provide safe access, preserve accountability and coordinate competing recovery actions if government assistance were activated.
The question is not whether the organisation expects intervention. It is whether an unplanned intervention during its worst incident would create additional danger.
Prepare the interface in advance
A critical-infrastructure playbook should identify:
- Assets and entities subject to each SOCI obligation.
- Operational thresholds for mandatory reporting.
- Authorised contacts for government and sector regulators.
- Network diagrams and asset information that can be shared securely.
- Safety and change controls applying to emergency technical actions.
- Supplier responsibilities during a government-assisted response.
- Evidence and decision logs needed after the event.
- Conflict-resolution procedures where operational, safety and national-security priorities differ.
Concentration risk is moving into view
The 2024 reforms and later rules increasingly recognise that business-critical data, telecommunications and shared providers can create systemic dependencies. A service does not become less critical because it runs in a third party’s environment.
For operators, the lesson is similar to developments in Europe and Singapore: regulatory responsibility follows the essential function and its consequences, not merely ownership of the server.
Resilience is a public-private system
Australia’s model makes explicit what is often left implicit. Critical infrastructure is privately operated in many sectors, but severe failure becomes a national concern.
The best outcome is not government taking control during an incident. It is an operator with sufficiently mature plans, information and recovery capability that the most intrusive powers never become necessary.
Official sources
- Australian Critical Infrastructure Security Centre: Regulatory obligations
- Australian Critical Infrastructure Security Centre: Government assistance
- Enhanced Response and Prevention Act 2024
This article provides general information and is not legal advice.
Continue the series: APAC Cyber & Digital Law Series index
