Australia's Security of Critical Infrastructure Act 2018 organizes its duties into parts: critical infrastructure risk management programs (Part 2A), notification of cyber security incidents (Part 2B) and enhanced cyber security obligations (Part 2C). Evidence should show you know which parts apply to your assets and can prove each duty is met.
What does the Act look like?
The Federal Register of Legislation lists the Act as administered by the Department of Home Affairs, with its latest compilation dated 4 June 2026. Its table of contents shows Part 2A, which begins with a requirement for a responsible entity to have a critical infrastructure risk management program, and notes rules that can set detail. Part 2B covers notification of critical cyber security incidents. Part 2C covers enhanced cyber security obligations and starts with a statutory incident response planning obligation.
Which duties apply depends on the sector and asset class, and on what rules and declarations say. The Act and its rules are the authority, and the Critical Infrastructure Security Centre site is the regulator's place for guidance. Time limits and thresholds are in the text and the rules, so check them there. This post does not restate numbers it could not confirm.
What evidence helps for each part?
Scope. A register of your assets and the asset classes they might fall into, with the analysis behind each decision, the date, and who approved it. Include a record of whether you are a responsible entity, an operator or hold a relevant interest.
Part 2A, risk management program. Evidence: the written program itself, version history, approval by the board or equivalent as the rules require, the hazards considered, the controls selected, how they are tested and how the program is reviewed. For the software side, show how you manage supply chain and vendor risk: a component inventory, vendor records, vulnerability handling records and change control. Check the rules for the required form of any annual reporting.
Part 2B, incident notification. Evidence: a runbook that defines who judges whether an event is notifiable, the clock that starts at awareness, contact details for the reporting channel, and a log of drills and real events with timestamps. Confirm timeframes in the Act.
Part 2C, enhanced obligations. These apply to assets specifically declared. Evidence: incident response plans, exercises, vulnerability assessments and system information reporting, if you are subject to them.
A constructed example: a regional water operator runs a control network supplier's remote access tool. Its risk program lists the tool, the supplier contact, patch history and an assessed risk. When the supplier discloses a vulnerability, the operator can show from its inventory which sites are affected and the date it decided on a mitigation. That record is evidence for the risk program and speeds a notification decision.
How do you keep it audit ready?
Assign a control owner for each item, store evidence with a date and a source system, and review quarterly. Run one tabletop a year that includes a supply chain scenario.
Safeguard's asset discovery, SBOM and dependency scanning, and compliance automation can help build the inventory and organize evidence. They do not make you compliant and Safeguard does not certify against this Act.
What to do
- Read the Act and the current rules, and determine which asset classes and duties apply to you.
- Create the asset and responsible entity register with decisions recorded.
- Write or update the risk management program and map controls to hazards.
- Build the software and vendor inventory that supports it.
- Write the incident notification procedure and rehearse it.
- Collect evidence with owners and dates, and review quarterly.
- Ask counsel or the regulator when classification is unclear.
Quick check
Does the Act apply to every Australian company?
No. Duties depend on whether you own or operate assets in sectors and classes the Act and its rules cover, and on any declarations.
Where do I find the incident reporting deadlines?
In Part 2B of the Act and related rules on the Federal Register of Legislation. Check the current compilation instead of relying on summaries.
Sources
- Security of Critical Infrastructure Act 2018, Federal Register of Legislation
- Critical Infrastructure Security Centre
Last reviewed: 18 October 2026.
