Regulatory Signal · Australia · 28 September 2026
The Cyber and Infrastructure Security Centre (CISC) has announced a stronger enforcement posture under the Security of Critical Infrastructure Act 2018. From 2026–27 it intends to move from mostly administrative engagement to risk-based enforcement — including infringement notices.
For regulated customers with an outstanding report. High priority this week for relevant suppliers.
2025–26 CIRMP annual report. The Act allows no extensions.
In the announcement. Applicability to each organisation and customer is unverified.
A change in regulatory posture — not an AWS or entityOS vulnerability.
CISC is evolving its compliance posture in response to the threat environment and the 2026 Independent Review of the SOCI Act. Voluntary compliance still comes first — but escalation is now explicit.
CISC updates its SOCI guidance with an evolving regulatory posture.
A shift from primarily administrative engagement towards enforcement where risk warrants it.
For serious or persistent non-compliance, or a significant unmitigated national-security threat.
The 2025–26 annual report, approved by the board or other governing body.
Prescriptive rules commenced for nine higher-risk asset classes.
Enhanced measures are not reported for 2025–26 — but they will be from next year.
“Move from a ‘light touch’ compliance approach … to that of a penalty-based risk management process with the real enforcement of penalties.”
2026 Independent Review of the SOCI Act — recommendation cited by CISCSOCI obligations sit with the responsible entity for a critical infrastructure asset. A cloud supplier is not regulated simply by being one — but it inherits the evidence burden when its service forms part of a customer’s documented critical-infrastructure supply chain.
Own or operate a critical infrastructure asset in a SOCI sector. They carry the register, incident-reporting and risk-management-program obligations — and now face the firmer enforcement posture.
Act nowServices named in a customer’s CIRMP, supply-chain map or risk register. Not directly regulated by this announcement, but expected to evidence their controls when a regulated customer asks.
Assurance review this weekOrganisations outside the eleven SOCI sectors, or whose use of entityOS supports no critical asset. This announcement creates no new obligation for them.
MonitorBeing in a sector is not enough on its own — the Act defines each asset class and its thresholds. Whether a particular customer or service is in scope needs confirming case by case.
This is a change in regulatory posture. It is not an AWS or entityOS vulnerability, and it does not indicate that any customer or service has been compromised.
The SOCI Act obliges responsible entities to notify their data storage or processing providers. A customer that has given entityOS that notice is in scope for this review — start there.
Each action names its owner: the regulated customer, entityOS as a supplier, or both. None of them waits for next year.
Confirm which customers and supported assets are subject to SOCI and CIRMP obligations, and who owns each reporting responsibility. Start with customers in the eleven sectors and any that have notified entityOS as a responsible entity.
The CIRMP annual report is due within 90 days of the financial year end — 28 September 2026 — and must be approved by the board, council or other governing body. The Act allows no exemptions or extensions: a late report should still be lodged, and early contact with CISC is better than silence.
Confirm the report addresses significant personnel, physical, natural, cyber and information, and supply-chain hazards experienced during the period — and what was done in response. Generic reports that skip a hazard class are the ones that attract scrutiny.
Prepare the records customers may request: AWS architecture and dependency records, IAM controls, privileged-access reviews, CloudFront, WAF and API logs, Lambda role boundaries, RDS backup and recovery evidence, incident-response tests and material supplier risks. The evidence pack is set out below.
Review contracts and incident procedures so entityOS can rapidly support a customer’s SOCI notifications, evidence requests and regulatory enquiries. Customers’ cyber-incident reporting clocks run from 12 hours for a significant impact to 72 hours for a relevant impact — a supplier that takes a day to answer is on their critical path.
Add the enhanced 2026 CIRMP measures to the next assurance cycle rather than assuming this year’s submission completes the obligation. The first enhanced deadlines fall on 10 June 2027.
entityOS supports a customer’s SOCI obligations; it does not own them. The responsible entity’s governing body still approves and lodges its own report.
CISC’s stated approach: encourage voluntary compliance, escalate proportionately, and deploy enforcement when necessary. Its tools, from least to most severe:
CISC says its response is proportionate to the nature and seriousness of the risk, behaviour or non-compliance. Current, evidenced controls are the strongest position to be in when it looks.
The Enhanced CIRMP Rules commenced on 10 June 2026 for nine higher-risk asset classes. CISC has confirmed that responsible entities do not report on the enhanced measures for 2025–26. For assets already critical at commencement, the grace periods end on two dates.
All-hazard, cyber and personnel material risks — including foreign ownership, control or influence, offshore remote access to business-critical data and OT control systems, unsupported or legacy components, and credential misuse.
ss 6A, 8A(2), 9A(2)Cyber framework at Maturity Level Two, phishing-resistant MFA, critical-systems segregation, personnel checks and monitoring, supply-chain mapping, vendor assessment, and a physical and natural hazard plan.
ss 8A, 8B, 8C, 9A, 10A, 11AThe enhanced rules bring suppliers inside the compliance boundary through contracts, tenders and evidence requests. These are the measures most likely to reach entityOS.
Customers must map major suppliers and assess them. Expect structured questionnaires and evidence requests.
entityOS: the evidence pack above.
Who can reach business-critical data from outside Australia, and how that access is controlled.
entityOS: access only via allowlisted addresses and issued certificates, so every path in is known and reviewable.
Credential-compromise controls for access to critical systems.
entityOS: Stage 2 client certificates.
Limiting lateral movement between critical and non-critical systems.
entityOS: the staged closed-internet model — Stage 1 onward.
A recognised cyber framework met at Maturity Level Two.
entityOS: see Standards.
Patch, replace or mitigate unsupported critical components and legacy systems.
entityOS: serverless — host patching sits with AWS; runtime versions are the part to evidence.
A second tranche of SOCI reforms (consultation paper released 3 July 2026) proposes “relevant operator” duties for service providers able to operate, configure or materially influence a critical asset — enforceable directly against the provider. It signals where supplier obligations are heading.
The Cyber and Infrastructure Security Centre has announced a stronger enforcement posture under the SOCI Act. Regulated organisations should confirm completion of current CIRMP reporting obligations and ensure their cyber, resilience and supply-chain controls are supported by current evidence. This announcement does not indicate that any customer or service has been compromised.
Use as written. It states the change, the action and the absence of compromise — and makes no claim about any individual customer’s status.
This briefing is general information for entityOS customers, current at 28 September 2026. It is not legal advice; confirm your organisation’s obligations against the Act, the CIRMP Rules and your own advisers.