What is the SOCI Act and who must comply?

The Security of Critical Infrastructure Act 2018 (SOCI Act) imposes security obligations on operators across 11 critical infrastructure sectors: energy, water and sewerage, transport, communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology. All operators of critical assets must establish and maintain a Critical Infrastructure Risk Management Program (CIRMP).

What are the Enhanced CIRMP Rules enforceable from 9 June 2026?

The Enhanced CIRMP Rules add four specific obligations: (1) Supply chain mapping - comprehensive documentation of your vendor ecosystem and third-party dependencies; (2) FOCI documentation - assessment of Foreign Ownership, Control or Influence risks; (3) Cyber maturity Level 2 - verification against ACSC guidelines; (4) Network segregation - isolation of critical assets from non-essential systems.

What is FOCI and why does it matter for critical infrastructure?

FOCI stands for Foreign Ownership, Control or Influence. Under the Enhanced CIRMP Rules, critical infrastructure operators must document and assess FOCI risks across their entire vendor ecosystem. This ensures that foreign entities cannot compromise Australia's national security through supply chain relationships.

What are the penalties for SOCI Act non-compliance?

Penalties for SOCI Act non-compliance include substantial fines for organizations and personal liability for directors. Board members must provide annual attestation of compliance. Failure to comply can result in enforcement action, civil penalties, and reputational damage.

How does VRG help with CIRMP compliance?

Vetted Review Group provides independent, board-level assurance for CIRMP compliance. We conduct CIRMP health checks, FOCI assessments, supply chain mapping reviews, cyber maturity assessments, and network segregation verification. Our conflict-free approach ensures unbiased verification with no vendor relationships or conflicts of interest.

What sectors does VRG serve?

VRG serves all 11 critical infrastructure sectors under the SOCI Act: energy (electricity, gas, liquid fuel), water and sewerage, transport (aviation, maritime, rail, road), communications, financial services and markets, healthcare and medical, education and research, defence industry, food and grocery, data storage and processing, and space technology.

Independent · No Conflicts of Interest

Could Your Board Defend Its CIRMP Attestation Under Audit?

Independent CIRMP assurance for SOCI Act responsible entities.

VRG provides an independent verdict
on your CIRMP compliance.

Vetted Review Group is an independent assurance firm focused solely on CIRMP compliance under the Security of Critical Infrastructure Act 2018 (Cth).

No software to sell. No implementations to manage. No conflicts of interest.

Just clear, evidence-based assurance so your board knows exactly where it stands.

The Enhanced CIRMP Rules were registered 9 June 2026 and commenced 10 June 2026. The CISC audit program is now active. The annual attestation window is now open and closes 28 September. If your board is signing an attestation this quarter, they need defensible evidence behind that signature.

$72,800director liability per contravention under the SOCI Act•

Openannual attestation window closes 28 September 2026•

ActiveCISC compliance audit program underway•

Evidencerequired on Day 1, not constructed on audit day•

$72,800director liability per contravention under the SOCI Act•

Openannual attestation window closes 28 September 2026•

ActiveCISC compliance audit program underway•

Evidencerequired on Day 1, not constructed on audit day•

Sectors We Serve

Independent Assurance for Australia's Most Critical Sectors

Maritime & Freight Infrastructure

Aviation

Freight Rail

Freight Services & Logistics

Cold Chain & Food Distribution

Energy

Water & Sewerage

Communications

VRG's assurance methodology applies across all 11 SOCI Act sectors. Primary focus areas shown.

Our Method

The VRG Assurance Framework

A structured, five-phase process — from first assessment to ongoing board-level assurance.

CIRMP Health Check — Rapid Gap Identification

Initial Assessment

Fixed fee $990 — delivered within 5 business days
Independent SOCI Act compliance posture review
CIRMP adequacy assessment across all seven hazard domains
Board attestation adequacy review

CIRMP Enhancement & Validation

Enhancement Guidance

Independent review and enhancement recommendations for existing CIRMPs
Alignment across all seven legislated hazard domains per F2026L00701
Regulatory expectations & best practice validation

Board-Level Reporting & Assurance

Reporting

Clear, concise board-level risk reporting
Independent assurance documentation
Director due diligence evidence package

Scenario Testing & Exercise Support

Validation

Realistic tabletop exercises & scenario testing
CIRMP effectiveness validation

Ongoing Compliance Monitoring & Advisory

Continuous

Compliance monitoring updates
Legislative & regulatory intelligence alerts
Best practice guidance & regulatory intelligence

All engagements are tailored to your organisation's sector, scale, and current compliance posture.

Tailored

To your sector and scale, not a template

Independent

No software to sell, no conflicts of interest

Evidence-Based

Every finding backed by documentation

Board-Ready

Built for the people signing the attestation

Fixed-Fee Assurance

Is your board signing off on compliance that hasn't been independently verified?

VRG delivers a conflict-free CIRMP health check — no vendor relationships, no junior staff, no inflated timelines.

Independent·5 Business Days·Board-Ready

Fixed fee $990 — delivered within 5 business days.

Common Questions

What Directors Ask Before Engaging

Visit our full FAQ →