Australia's Security of Critical Infrastructure Act 2018 puts duties on the responsible entities that run critical infrastructure assets, not on every software supplier. Suppliers feel it through contracts: owners need evidence of supply chain risk control, incident notification and asset visibility from you. Work out whether you are in scope, then build that evidence.
What does the Act actually contain?
The consolidated Act on the Federal Register of Legislation (compilation C2026C00213, dated 4 June 2026) is organised in parts. The ones that matter for a supplier are:
- Part 2A: a responsible entity must have a critical infrastructure risk management program (section 30AC), comply with it, review and update it, and submit an annual report (section 30AG).
- Part 2B: notification of cyber security incidents, split between critical cyber security incidents (30BC) and other incidents (30BD).
- Part 2C: enhanced cyber security obligations, starting with statutory incident response planning.
- Part 6A: declaration of systems of national significance by the Minister.
The Act also defines asset classes, among them critical banking assets, critical insurance assets, critical superannuation assets, critical broadcasting assets, critical financial market infrastructure and critical data storage or processing assets. Which entities and assets are covered by each obligation depends on the Act and on rules made under it, so read the current text rather than relying on a summary.
Step 1: Decide whether you are a responsible entity or a supplier
A software company that owns or operates a covered asset is itself a responsible entity. One example is a firm that runs a critical data storage or processing asset as defined in section 12F. Most software companies are suppliers to such entities instead.
Construct a case. You make a claims platform used by an insurer. The insurer is the responsible entity for its assets. You are a supplier whose product sits inside the insurer's risk program. You have no direct duty under Part 2A, but your customer must account for you in theirs.
Check the Critical Infrastructure Security Centre site for the current guidance and ask your customer in writing which of their assets your service touches.
Step 2: Prepare for supply chain questions in the risk program
Expect to be asked what you hold, who can access it, and how you learn about vulnerabilities in your own components. Have a current software bill of materials for every release that you deliver, and a note on how you track new advisories against it.
Step 3: Prepare for incident notification
Part 2B means your customer may have to notify the authorities about a cyber security incident. The Act decides who must notify and how quickly, so your contract should oblige you to tell the customer quickly enough for them to meet it. Write the internal runbook now: what counts as an incident, who calls the customer, and what facts you will have to hand.
Step 4: Be able to show asset visibility
Responsible entities have to understand their own assets, including software. Offer an inventory export: product, version, hosting location, data held, administrators. If you can produce it in an afternoon, you are easy to work with.
Step 5: Plan for audits and exercises
Part 2C is about stronger duties for the most important systems, including incident response planning. If your customer is in that group, expect requests to join exercises or share plans.
How to check or apply this
- Read the current Act text and the CISC guidance for your sector.
- Ask each customer which assets your product supports and which obligations they treat as relevant.
- Produce a component inventory for each delivered release.
- Write and rehearse an incident notification runbook.
- Put notification time limits and audit cooperation into your standard contract.
- Keep a dated record of what you told each customer and when.
Quick check
Is a software supplier directly regulated by the SOCI Act?
Only if it is itself a responsible entity for a covered asset. Otherwise it is bound through the contract with its customer.
Where should I check which assets are covered?
The Act's definitions and the rules made under it, together with the CISC guidance. Do not rely on a vendor summary.
This is not legal advice. Take advice on your own position.
Sources
- Security of Critical Infrastructure Act 2018, Federal Register of Legislation
- Critical Infrastructure Security Centre
- NIST SP 800-161 Rev. 1
Last reviewed: 18 October 2026.
