Threats are rising, and so are the regulatory obligations
The obligations have moved past transition. The risk management program obligation is switched on for 13 asset classes. Programs had to be in place from August 2023, and the cyber framework element from August 2024. A Critical Infrastructure Risk Management Program (CIRMP) must address four hazard vectors: cyber and information security, personnel, supply chain, and physical security and natural hazards. The cyber component requires alignment to are cognised framework at a specified level, whether AS ISO/IEC 27001, the NIST Cybersecurity Framework, the Essential Eight, C2M2, the AESCSF or an equivalent. A board-approved annual report is due within 90 days of financial year end, and cyber incident reporting runs to 12 hours for a significant impact and 72 hours for a relevant impact.
The bar moved again in June 2026. The enhanced CIRMP Rules commenced on 10 June 2026 and replace principle with prescription for nine high-risk asset classes: electricity, energy market operator, gas, liquid fuel, water, broadcasting, domain name system, freight infrastructure and freight services. Those entities have until 10 June 2027 to address additional material risks, specified cyber risks and personnel access management, and until 10 June 2028 for framework maturity at current versions, credential compromise, lateral movement, critical worker vetting, supply chain and foreign ownership, control and influence, and physical security.
Enforcement has caught up. The Critical Infrastructure Security Centre (CISC) ran trial audits in 2023-24, balanced education with compliance activity through 2024-25, and has signalled a stronger assurance and audit focus for2025-26. Core risk management duties carry penalties of up to $364,000 for a body corporate per contravention, and the January 2026 Independent Review recommended a shift away from light-touch, documentation-focused compliance. Mandatory independent assurance of programs is now on the table. The board approves the annual report, and it does so on the record.
For financial services entities the picture is more complicated again. Banking, superannuation, insurance and market infrastructure sit inside the SOCI regime and under APRA. CPS 230 and CPS 234 overlap materially with the CIRMP cyber vector and SOCI incident reporting, but the regulators, thresholds and timeframes differ. Without a crosswalk, entities end up with duplicated effort and conflicting response pathways.
