Utilities IT and OT Security Australia | SOCI Act, CIRMP, AESCSF

What we hear

What utility operators tell us.

The realities Australian electricity, gas and water businesses are dealing with right now.

Network uptime affects entire communities

Power, water, and gas outages cascade through homes, hospitals and industry. Your IT and OT environments need to be more resilient than the public expects, not less.

SOCI obligations check

Could you show the CISC your obligations are met?

Six core positive security obligations under the SOCI Act. Tick what you could evidence today and copy the gaps for your next board paper.

Tick what you could show the Cyber and Infrastructure Security Centre today. These are the core positive security obligations under the Security of Critical Infrastructure Act 2018.

Assets on the Register of Critical Infrastructure AssetsOwnership and operational information given to the Cyber and Infrastructure Security Centre and kept up to date.
A critical infrastructure risk management programCovers cyber and information security, personnel, supply chain, physical and natural hazards.
A board-approved annual CIRMP reportGiven to the regulator within 90 days after the end of the Australian financial year.
A recognised cyber framework at the required levelFor example the Essential Eight at Maturity Level One, or AESCSF, NIST CSF or ISO 27001 equivalents.
Critical cyber incidents reported within 12 hoursWhere an incident has a significant impact on the availability of the asset.
Other cyber incidents reported within 72 hoursWhere an incident has a relevant impact on the asset.

Where you stand

0of 6 obligations in place

6 gaps to close.

Assets on the Register of Critical Infrastructure AssetsOwnership and operational information given to the Cyber and Infrastructure Security Centre and kept up to date.
A critical infrastructure risk management programCovers cyber and information security, personnel, supply chain, physical and natural hazards.
A board-approved annual CIRMP reportGiven to the regulator within 90 days after the end of the Australian financial year.
A recognised cyber framework at the required levelFor example the Essential Eight at Maturity Level One, or AESCSF, NIST CSF or ISO 27001 equivalents.
Critical cyber incidents reported within 12 hoursWhere an incident has a significant impact on the availability of the asset.
Other cyber incidents reported within 72 hoursWhere an incident has a relevant impact on the asset.

Which obligations apply depends on your asset class and the rules for it. Check your sector rules with the CISC.

Review your SOCI position

What you get

Built for critical infrastructure.

SOCI Act

CIRMP and annual board attestation support

AESCSF

Recognised approved framework for energy sector

IEC 62443

OT security architecture and segmentation

24/7

Incident response and critical asset monitoring

What we do

Utility sector IT and OT services.

Pragmatic capability across cyber, comms, control systems and asset management.

OT and IT convergence
Secure integration of operational technology with corporate IT. Network segmentation aligned to the Purdue model, IEC 62443 controls, and AESCSF maturity uplift across generation, distribution and treatment environments.
Distributed site connectivity
Reliable WAN across substations, pump stations, treatment plants and depots. Failover paths, bandwidth management, and end-to-end monitoring so a single link failure does not take a site offline.
SCADA and control system monitoring
Passive visibility into distributed control systems. Anomaly detection, alerting, and performance dashboards that work alongside your existing engineering tools, not in place of them.
SOCI Act and CIRMP support
Practical support for the Critical Infrastructure Risk Management Program. Hazard assessments, control mapping, and annual board attestation evidence aligned to the four hazard vectors including cyber and information security.
Crew and control centre comms
Unified comms for control rooms, field crews and remote sites. Radio integration, mobile telephony, Teams or Webex Calling, and resilient platforms that keep working when conditions get hard.
Asset and performance management
Systems to track asset health, work orders, lifecycle status and performance metrics across distributed infrastructure. Predictive maintenance signals fed into ERP and CMMS without ripping out what already works.

SOCI Act, CIRMP and AESCSF

SOCI Act, CIRMP and AESCSF in plain English.

The Security of Critical Infrastructure Act 2018 was expanded by the SLACIP amendments and the CIRMP rules now require responsible entities to maintain a documented risk management program covering cyber, personnel, supply chain and physical hazards.

For the cyber hazard, the rules require alignment to a recognised framework, such as AS ISO/IEC 27001, the Essential Eight at Maturity Level One, the NIST Cybersecurity Framework, the C2M2 or the AESCSF, or an equivalent. We help you choose the right one for your environment and prepare the evidence the Cyber and Infrastructure Security Centre expects. AS IEC 62443 then guides how the controls are built inside the OT environment.

CIRMP risk management plan written, reviewed and maintained
AESCSF maturity assessment and uplift roadmap for energy operators
Mandatory cyber incident reporting workflows aligned to ASD ACSC
Annual board attestation evidence pack prepared and reviewed
Personnel and supply chain hazards mapped alongside cyber

Who is covered

Sectors covered under the SOCI Act.

Electricity
Generation, transmission, distribution and market operators
Gas
Production, transmission, distribution, storage and processing
Water
Storage, treatment, distribution and wastewater operators
Liquid fuels
Refining, storage, distribution and bulk transport operators

Where to go deeper

The services utility operators ask us about most.

ASD Annual Cyber Threat Report 2025-26

Critical infrastructure obligations make the basics mandatory.

ASD's 2025-26 report shows identity-first attacks as the most common ways in, and Electricity, Gas, Water and Waste services filed 17% of reports to the report's critical infrastructure partner channels, the third-largest share. Utilities carry those attacks alongside critical infrastructure obligations under the SOCI Act, and the report also anchors the ASD Essentials operational technology chapter, which is the framework direction for the control systems that keep essential services running.

The full threat figures ASD's 2025-26 numbers and what they mean, in one place.

Compliance you actually have

The frameworks that apply to utilities and energy.

SOCI Act, CIRMP and AESCSF aligned. We translate the obligations into a practical control set, implement the technical controls and keep the evidence audit ready.

Security of Critical Infrastructure Act 2018
CIRMP rules and mandatory cyber incident reporting to ASD.
AESCSF
Australian Energy Sector Cyber Security Framework, recognised under CIRMP.
AS IEC 62443 series
Industrial automation and control system security architecture.
Privacy Act 1988
Customer and workforce information still attracts APP obligations.

Outages cascade into homes, hospitals and industry within minutes.
OT and IT segmentation is still flat in many distribution networks.
Legacy PLCs and RTUs cannot be patched the way IT systems can.
Field crew comms drop blow out restoration times when conditions get hard.

Services that fit

Services we deliver into utilities and energy.

Pulled from our service catalogue and ranked by what utilities and energy environments need first.

Reading for utilities and energy

Guides that match this work, and where we already do it.

Plain-English explainers our team wrote, hand-picked for this sector, and the cities and regions where we deliver this kind of work every day.

Who we work with

Aligned to your leadership structure.

Each role gets the visibility and support they need to meet their obligations.

CISO
- SOCI Act and CIRMP obligations met with documented evidence
- AESCSF maturity uplift roadmap with measurable milestones
- OT and IT integration delivered without operational risk
- Cyber incident response plans tested and exercised
- Board-level reporting on resilience and security posture
Network Ops
- Real-time visibility into field assets and substations
- Reliable comms for distributed crews and contractors
- Predictive maintenance signals that prevent unplanned outages
- Fast incident response when things break in the field
- Systems that support 24/7 operations rather than hinder them
Risk and Compliance
- CIRMP risk management plan documented and maintained
- OT controls implemented without operational disruption
- Annual report and board attestation evidence prepared
- Mandatory cyber incident reporting workflows in place
- Privacy Act and Australian Privacy Principles handled for customer data
Field Crews
- Mobile devices that actually work in service areas
- Real-time job dispatch, work orders and asset records
- Access to customer and asset information without delays
- Comms that hold up in remote and outage conditions
- Tools that simplify the job rather than add steps

How it works

From CIRMP assessment to board-ready evidence.

What we do and what you do at each step. No production changes without engineering sign-off.

Step 1Week 1: We assess your CIRMP and OT posture
A review of your SOCI Act status, CIRMP readiness, AESCSF maturity baseline, OT and IT segmentation, and where legacy control systems sit in your risk picture. What you do: You give us access to your operations lead and your SCADA and network architecture documentation.
Step 2Weeks 2 to 8: We secure OT without disrupting operations
Purdue model segmentation applied. Passive monitoring on legacy assets. Compensating controls where patching is impossible. CIRMP risk plan documented. Crew comms hardened. All staged around plant outages. What you do: You approve the plan and we coordinate with your engineering teams. No production changes without sign-off.
Step 3Ongoing: We keep you audit-ready and resilient
24/7 incident response and critical asset monitoring. Annual board attestation evidence maintained. AESCSF uplift roadmap tracked. Mandatory cyber incident reporting aligned to ASD ACSC. What you do: You bring us into board, regulator and insurer conversations. We handle the evidence.

Industries

Every industry we serve. One team running it.

The same Brisbane engineers look after every sector, so what we learn on a mine site or in a medical practice makes the next client safer too.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask before they call.

How do we meet our SOCI Act and CIRMP obligations?

The Security of Critical Infrastructure Act 2018 and the Critical Infrastructure Risk Management Program (CIRMP) rules require responsible entities to identify and manage hazards across cyber, personnel, supply chain and physical security. We help map your environment to the CIRMP requirements, adopt an approved framework such as AESCSF, ISO 27001 or the Essential Eight, and prepare the annual report and board attestation evidence required by the Cyber and Infrastructure Security Centre.

What is AESCSF and do we need it?

The Australian Energy Sector Cyber Security Framework, maintained by AEMO, is recognised as an approved cybersecurity framework for the CIRMP rules. For energy sector responsible entities it is the most direct route to demonstrating CIRMP compliance for the cyber hazard. We run AESCSF assessments, identify Anti-Pattern findings, and build a measurable uplift roadmap.

How do you secure SCADA without disrupting operations?

We work to the Purdue Reference Model with proper segmentation between corporate IT, operations DMZ and control system zones. Monitoring is passive where it needs to be. Patching is scheduled around plant outages. Compensating controls are used where legacy assets cannot be touched. No production changes happen without engineering sign-off.

What happens during a serious cyber incident?

Under the SOCI Act there are mandatory reporting obligations to the Australian Signals Directorate within set timeframes for critical cyber security incidents. We maintain documented incident response plans, run tabletop exercises, and coordinate with ASD ACSC, the Cyber and Infrastructure Security Centre, and your insurer if an incident occurs.

Can you support legacy control equipment that cannot be patched?

Yes. Network isolation, allow-listing, behaviour monitoring and compensating controls are standard practice in Australian utility environments. We secure around legacy assets using defence-in-depth so you can extend their useful life without compromising your CIRMP risk position.

Next step

Protect the services communities depend on.

We assess your CIRMP position, baseline your AESCSF maturity, and build a roadmap to a defensible cyber posture across IT and OT.

Schedule a critical infrastructure review 07 3114 2808

Keep reading

Checked 30 October 2026. Threat figures from ASD's Annual Cyber Threat Report 2025-26. Obligations from the Security of Critical Infrastructure Act 2018 and the CIRMP Rules. Cyber and Infrastructure Security Centre: SOCI Act; ASD Annual Cyber Threat Report 2025-26 (business.gov.au summary)