Telco IT and Cyber Security Australia | SOCI Act and TSRMP

What we hear

What telco operators tell us.

Common pressure points across carriers, CSPs and managed service providers.

Carrier and CSP obligations keep expanding

Carriers, carriage service providers and carriage service intermediaries operate under the Telecommunications Act 1997, the telecommunications security obligations now in Part 2D of the SOCI Act and a growing list of ACMA service standards. Keeping evidence current takes real effort.

TSRMP deadlines

Where are you against the TSRMP dates?

Pick whether you are a carrier or a larger carriage service provider to see the dates that apply and the next one coming.

You are a

4 April 2025
SOCI Part 2D and the TSRMP Rules commenceTelecommunications security moves from the Telecommunications Act into the SOCI Act. Asset registration and incident reporting start.
3 October 2025
Risk management program in placeProgram developed and implemented, covering cyber, personnel, supply chain, physical security and natural hazards.
3 October 2026
Maturity indicator 1 achievedThe first cyber maturity milestone under the rules.
3 October 2027
Maturity indicator 2 for carriersAgainst one listed framework: the Essential Eight, the US DOE C2M2 or the AESCSF Framework Core.

Next deadline

333days to go

Maturity indicator 2 for carriers

Against one listed framework: the Essential Eight, the US DOE C2M2 or the AESCSF Framework Core.

Maturity indicator 1 was due on 3 October 2026. If you are not sure you met it, that is the first conversation to have.

Dates from the TSRMP Rules, as summarised by Allens in March 2025. Confirm your obligations with your legal adviser.

Check your maturity position

What you get

Built for network operators.

SOCI 2D

Telecommunications security obligations support

TSRMP

Risk management program and maturity indicators

APP

Privacy Act and Notifiable Data Breaches readiness

24/7

NOC, SOC and helpdesk augmentation

What we do

Telco sector services.

Capability across compliance, network security, customer data and operations.

SOCI Act telecommunications security support
Practical compliance support for Part 2D of the SOCI Act and the TSRMP Rules: change notifications, the risk management program, maturity indicator evidence, asset registration and incident reporting.
Network security and segmentation
Defence in depth across core, transport and access layers. BGP hardening, DDoS mitigation, signalling protection and clean separation between customer, management and corporate planes.
Customer data and APP compliance
Privacy Act 1988 and Australian Privacy Principles applied to customer data. Notifiable Data Breaches scheme readiness, consent and disclosure controls, and IPND handling aligned to ACMA expectations.
OSS and BSS integration
Integration between billing, provisioning, CRM, ticketing and network inventory. Closing the gaps that cause customer experience issues, revenue leakage and audit findings.
Cloud and hybrid network modernisation
Migrating workloads to Azure, AWS or hybrid platforms while keeping carrier-grade availability. SD-WAN, private connectivity and zero trust patterns for telco-owned and managed services.
NOC, SOC and helpdesk support
Augmenting your in-house operations with after-hours coverage, surge capacity and L2 to L3 escalation. Australian engineers who understand carriers, not generic helpdesk staff.

The Australian telco compliance stack

The Australian telco compliance stack.

Telecommunications Act 1997 obligations, the security obligations that moved from Part 14 of that Act into Part 2D of the SOCI Act on 4 April 2025, the TSRMP Rules, the Privacy Act 1988 and the Australian Privacy Principles, the Telecommunications Consumer Protections Code and a range of ACMA service standards all apply at once.

We help align controls across all of them so the same evidence supports multiple regimes. That keeps audit cost down, reduces duplicated risk assessments and gives the board a single, defensible view of compliance.

SOCI Part 2D change notification process documented
TSRMP risk management program and annual attestation maintained
Privacy Act and Notifiable Data Breaches readiness reviewed
TCP Code, complaints handling and ACMA service standards mapped
Mandatory cyber incident reporting workflows aligned to ASD

Who we support

Who we support across the sector.

Carriers
Licensed by the ACMA, paying the annual Carrier Licence Charge
CSPs
Carriage service providers operating under the Telco Act and TCP Code
MSPs and ISPs
Managed network and internet service providers reselling carrier services
Wholesale
Tower companies, dark fibre and metro carrier ethernet operators

Where to go deeper

The services telco operators ask us about most.

ASD Annual Cyber Threat Report 2025-26

Carriers are infrastructure targets and supply-chain targets.

ASD's 2025-26 report shows data breach incident responses up by more than 66% year on year, and carriers sit in the middle of that picture: large customer data holdings, interconnected infrastructure and regulatory obligations that make both an incident and a slow response expensive. Identity controls and third-party risk management are where the report's findings bite hardest.

The full threat figures ASD's 2025-26 numbers and what they mean, in one place.

Compliance you actually have

The frameworks that apply to telecommunications.

SOCI Act Part 2D, TSRMP Rules, Privacy Act and ACMA aligned. We translate the obligations into a practical control set, implement the technical controls and keep the evidence audit ready.

Telecommunications Act 1997
Carrier licence and CSP obligations. The old Part 14 security obligation moved into the SOCI Act on 4 April 2025.
Security of Critical Infrastructure Act 2018
Part 2D and the TSRMP Rules: a risk management program, annual attestation, maturity indicators and incident reporting.
Privacy Act 1988 and APPs
Customer data, IPND and Notifiable Data Breaches scheme exposure.
Telecommunications Consumer Protections Code
TCP Code, complaints handling and ACMA service standards.

Carrier and CSP obligations keep expanding, and evidence has to keep up.
SOCI, privacy and ACMA obligations overlap, which means duplicated effort if not mapped carefully.
Customer data spans CRM, billing and IPND with different privacy expectations.
NOC and corporate IT pull in different directions without a clear bridge.

Services that fit

Services we deliver into telecommunications.

Pulled from our service catalogue and ranked by what telecommunications environments need first.

Reading for telecommunications

Guides that match this work, and where we already do it.

Plain-English explainers our team wrote, hand-picked for this sector, and the cities and regions where we deliver this kind of work every day.

Who we work with

Aligned to your leadership structure.

Support that fits the way carriers and CSPs are actually organised.

CISO
- Change notification obligations met without surprises
- Risk management program evidence maintained year-round
- Vendor and supply chain risk documented to ACMA expectations
- Cyber incident response exercised across IT and network
- Board-level reporting on telco-specific risk posture
Network Ops
- Carrier-grade availability across core and edge
- DDoS, BGP and signalling protections in place and tested
- Clear separation between customer and management planes
- NOC tooling and runbooks aligned with security operations
- Faster fault isolation through better telemetry
Risk and Compliance
- APP and Privacy Act controls documented across customer data
- Notifiable Data Breaches scheme readiness assessed and rehearsed
- TCP Code obligations mapped to operational processes
- IPND handling reviewed against ACMA guidance
- Internal audit and external assurance evidence ready
Service Delivery
- OSS and BSS integration that reduces handoffs and rework
- Self-service portals supported by reliable back-end systems
- Field crew tools that work reliably in service areas
- Consistent customer data across channels
- Faster onboarding for new products and managed services

How it works

From SOCI assessment to year-round audit-ready.

What we do and what you do at each step.

Step 1Week 1: We assess your SOCI and TSRMP position
A review of your carrier licence or CSP status, your SOCI Part 2D obligations under the TSRMP Rules, your progress against the maturity indicators, and how your NOC, SOC and corporate IT are currently segmented. What you do: You give us access to your compliance lead and your network architecture documentation.
Step 2Weeks 2 to 8: We align controls and build the evidence pack
Change notification process embedded in change management. Risk management program documented. Network segmentation hardened. OSS and BSS integration gaps closed. Privacy Act controls applied to customer data flows. What you do: You approve the remediation plan and we coordinate with your network and operations teams.
Step 3Ongoing: We keep you audit-ready year-round
NOC, SOC and helpdesk augmentation with Australian engineers who understand carriers. Annual TSRMP attestation evidence maintained. Mandatory incident reporting workflows aligned to ASD. What you do: You bring us into renewal, audit and regulator conversations. We handle the evidence.

Industries

Every industry we serve. One team running it.

The same Brisbane engineers look after every sector, so what we learn on a mine site or in a medical practice makes the next client safer too.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask before they call.

What happened to the TSSR?

The Telecommunications Sector Security Reforms used to sit in Part 14 of the Telecommunications Act 1997. From 4 April 2025 the security obligations moved into a new Part 2D of the SOCI Act, with the TSRMP Rules. Carriers, and carriage service providers with more than 20,000 active services or government customers, must run a risk management program, attest to it each year, notify certain changes, register assets and report cyber incidents. Maturity indicator 1 was due by 3 October 2026, and carriers must reach maturity indicator 2 by 3 October 2027. We help map your obligations and build the evidence.

How does the SOCI Act apply to us now?

For carriers and larger CSPs, the SOCI Act is now the main security regime: Part 2D obligations, the TSRMP Rules, asset registration and mandatory cyber incident reporting within 12 or 72 hours. We treat it, the Privacy Act and your ACMA obligations as one integrated programme, so controls, risk assessments and reporting are not duplicated.

What carrier licence and ACMA obligations should we be tracking?

Carriers operate under a licence issued by the ACMA and pay an annual Carrier Licence Charge. CSPs do not currently hold a separate licence but must comply with the Telecommunications Consumer Protections Code, complaints handling rules and a range of service standards. We help track these obligations alongside your security and privacy programme so they are not managed in silos.

How do you handle customer data under the Privacy Act?

We apply controls aligned to the Australian Privacy Principles, the Notifiable Data Breaches scheme and the OAIC guidance for the telecommunications sector. This includes consent, disclosure, retention and access controls across CRM, billing and IPND data flows.

Can you support our NOC and SOC out of hours?

Yes. We run augmented operations models for Australian carriers and CSPs, including after-hours cover, surge capacity for incidents and project work, and L2 to L3 escalation supported by engineers who actually understand carrier networks rather than generic IT support.

Next step

A telco IT partner that speaks carrier.

We assess your SOCI and TSRMP position, your maturity indicator evidence and your network security posture, then build a roadmap that fits how your business actually runs.

Schedule a telco IT review 07 3114 2808