Australia’s Critical-Infrastructure Regulator Wants More Than a Signed Risk Report
Covered responsible entities under Australia’s critical-infrastructure regime must file their 2025-26 risk-management reports by 28 September 2026. At the same time, the Cyber and Infrastructure Security Centre (CISC) says it will escalate serious or persistent non-compliance during the 2026-27 cycle. The practical question for boards is whether the controls behind their annual statement will withstand scrutiny after the form has been filed.
The CISC’s regulatory philosophy says voluntary compliance comes first, followed by proportionate escalation where necessary. Its SOCI overview places the change in the 2026-27 cycle. This is an enforcement approach under the existing Security of Critical Infrastructure Act 2018, not a new penalty or a claim that every late report will attract a fine. The reviewed material is a statement of regulatory posture, not an announcement of a particular enforcement case.
Update, 31 October 2026: the returns are under review
In its 23 October update, CISC confirmed that the 2025-26 CIRMP reporting cycle closed on 28 September. It received 575 annual reports, 26% more than in 2024-25, and has started analysing the returns and reviewing compliance. That is a count of submissions, not a finding that every submitting entity is compliant. The centre says it will approach non-submitters in stages and share initial findings at a compliance town hall in November. That event and its findings are still ahead as of this update.
The same notice distinguishes telecommunications maturity deadlines: level 1 under the chosen cyber security framework was to be met by 4 October 2026; level 2 for critical carrier assets is due by 4 October 2027. Those are separate from the annual-report deadline and the enhanced CIRMP transition periods discussed below. Operators need to check their specific asset and applicable framework, rather than apply the carrier deadline indiscriminately to every provider.
CISC’s 28 October guidance announcement says it released updated CIRMP guidance and a snapshot on 27 October. The material provides plain-language best practice for developing, maintaining and reviewing programmes, including baseline and enhanced obligations, worked examples, material risks, impacts and controls. The announcement tells telecommunications entities to use CIRMP guidance as a best practice resource alongside their separate telecommunications guidance. This publication is guidance, rather than an announcement of a new statutory deadline or an imposed penalty. The practical follow-through is to compare the submitted assurance with operational evidence and keep each applicable implementation date on its own timetable.
Who actually has to file?
The Act ties the return to a responsible entity and a covered asset with an applicable risk programme during all or part of the financial year. The current CIRMP Rules specify 13 asset classes, including certain broadcasting, DNS, data-processing, electricity, energy-market, gas, hospital, food, freight, fuel, financial-market and water assets. A sector label alone does not settle whether an asset meets the statutory definition; applicable transitions and declarations also matter. There is a separate reporting route under Part 2AA: section 30AQ covers specified assets exempted under subsections 30AB(4), (5) or (6), rather than every exempt asset. It requires an approved annual account of the exemption grounds, hazards with a significant relevant impact and the response, including its effectiveness, within the same 90-day window.
Telecommunications has its own risk-management rules. Under the 2025 telecommunications rules, the relevant assets include those owned or operated by carriers and specified carriage-service-provider assets. The latter test includes at least 20,000 active carriage services, or services supplied to a qualifying Commonwealth entity. CISC’s telecommunications guidance says the first annual report under that regime covers 2025-26 and is due by 28 September 2026. The threshold is about the regulated asset and service, not a general employee-count exemption. Smaller providers may still have other SOCI obligations, as CISC explains in its telecommunications town hall.
The Act applies within and outside Australia. An overseas headquarters therefore does not, by itself, decide whether an entity responsible for a covered Australian asset is in scope. Applicability still depends on the asset, the responsible entity and the rules that switch on the relevant obligation.
What the board is approving
Section 30AG sets a 90-day window after the Australian financial year ends. CISC gives 28 September 2026 as the 2025-26 due date. The checked official guidance does not specify a public filing hour or timezone, so the date should not be read as a promise of extra time.
The approved reporting form asks whether the programme was up to date at year-end and, where relevant, what significant hazards occurred and how effectively the programme mitigated them. It also covers resulting programme changes and regulatory directions. Telecommunications returns add information about notified service changes, advised risks and responses. Where an entity has a board, council or other governing body, that body must approve the report.
The report goes to the relevant Commonwealth regulator for an asset, or otherwise to the Home Affairs Secretary. The CIRMP Rules name the Reserve Bank of Australia for the asset class in paragraph 12D(1)(i) of the Act; CISC’s telecommunications guidance identifies CISC for telecommunications. The full programme need not accompany the return, but the regulator may request it in an audit. A signature does not prove that the programme is current or followed in practice.
There is one timing trap. The enhanced CIRMP Rules took effect in June 2026 for specified assets, but their individual measures have transition periods. At its 25 June 2026 town hall, CISC said operators do not need to report on the enhanced measures in the 2025-26 attestation and identified enhanced material risks for the next reporting year. That is not a requirement to attest to every enhanced measure in that next return: the June guidance distinguishes a 12-month transition for the specified additional material-risk provisions, including cyber and personnel-access risks, from 24 months for other enhanced measures, including the updated cyber framework and critical-worker suitability requirements. The baseline programme and 2025-26 return were not deferred. Teams should track the provisions and transition dates applicable to their own asset, separately from the completed reporting period.
The enforcement change, without the alarmism
The 2026 independent review urged a move from document-centred supervision towards enforcement of risk management. CISC’s response lists notices, directions, undertakings, infringement notices and prosecution among possible tools. Its examples for escalation include serious or persistent non-compliance and a significant unmitigated national-security threat. Those are examples of regulatory discretion, not automatic outcomes.
Those powers already sit in law. The Act specifies a 150 penalty-unit civil penalty for each of the two reporting duties and 200 penalty units for each duty to adopt and maintain, comply with, review and keep the programme up to date. These are amounts in statutory units, not fines CISC has imposed in this case. Sections 30AG and 30AQ also prevent the respective annual report being admitted against the entity in civil penalty proceedings under the Act. CISC can still review the underlying programme in a compliance audit.
Based on the statutory duties and regulator guidance, BlackTree recommends this evidence check for covered operators:
- Confirm the responsible entity, asset class, applicable rules and reporting recipient, including the separate telecommunications regime where relevant.
- Compare the board statement with hazard and incident records, control tests, supplier access and any directions received. Record discrepancies before approval.
- Keep proof of approval and submission, and retain the programme and supporting control evidence for a possible review.
- Track each applicable enhanced-rule measure and transition date separately from the 2025-26 attestation.
- If a required report was missed, contact CISC promptly with the facts, the roadblocks and a board-approved remediation plan with a timeframe. CISC’s 19 May town hall says it cannot grant an extension of time. Early engagement can inform enforcement decisions, not move the deadline; provide progress updates where remediation is lengthy.
BlackTree’s earlier SOCI explainer describes incident reporting and last-resort government intervention. The current development concerns the ordinary annual assurance cycle: whether an entity’s claims about resilience match the controls protecting the asset before a crisis begins.
This article is general editorial information, not advice on whether a particular organisation or asset is legally in scope.
Sources
- CISC, SOCI Regulatory Philosophy, consulted 28 September 2026. The related regulatory-posture notice is dated 24 September 2026; no publication time was shown.
- CISC, Security of Critical Infrastructure Act overview, consulted 28 September 2026. Regulator’s description of the 2026-27 compliance posture.
- Federal Register, Security of Critical Infrastructure Act 2018, compilation dated 4 June 2026, checked 31 October 2026. Sections 14, 30AB to 30AG, 30AQ and 49C.
- Federal Register, CIRMP Rules, compilation dated 10 June 2026. Asset scope and enhanced-rule transitions.
- Federal Register, Telecommunications Security and Risk Management Program Rules 2025, effective instrument. Telecommunications scope and service threshold.
- CISC, Telecommunications Guidance, April 2025. First telecommunications annual-report period and deadline.
- CISC, annual reporting form, page last updated 17 August 2026. Submission route and report contents.
- CISC, town-hall transcripts, 25 June 2026 and 19 May 2026 events. Enhanced-rule attestation boundary and compliance engagement.
- Independent Review of the SOCI Act, report dated 2 February 2026. Enforcement recommendation.
