Australia's SOCI Act Reforms Are Coming, and They Put Critical Infrastructure Security on the Board's Desk

Australia is preparing a significant second tranche of reforms to the Security of Critical Infrastructure Act, and the clear direction is to make critical infrastructure cyber risk an explicit board level responsibility, not a matter delegated to the security team. In July 2026 the Department of Home Affairs released a consultation paper on the proposed amendments, responding to an independent review of the Act, with the stated aim of reducing complexity, strengthening accountability and modernising the framework (Department of Home Affairs). For any organisation that operates or supplies critical infrastructure, the changes would raise both the obligations and the stakes.

What the reforms would change

The proposals are still being finalised, but the shape of them is consistent and worth understanding now. Legal analysis of the consultation identifies several substantial shifts for responsible entities (Landers):

• Wider scope. New and refined critical infrastructure asset classes would be brought in, including space, health, energy and research assets, pulling more organisations into the regime.
• Board and senior management accountability. Development of a Critical Infrastructure Risk Management Program would require genuine involvement from the board or senior managers, with the program reviewed at least every twenty four months.
• Independent assurance. Entities would need periodic independent assessment of how their risk management program is designed, implemented and actually working, not just a self declaration that it exists.
• Much larger penalties. Maximum civil penalties for non-compliance with ministerial directions under Part 3 would rise from 250 to 2,000 penalty units, an eightfold increase that signals a far tougher enforcement posture.

Taken together, these move critical infrastructure security from a compliance formality toward something closer to the governance and assurance expectations that already apply to financial reporting.

Why this lands on the board, not just the CISO

The single most important change is the emphasis on accountability at the top. Requiring board or senior management involvement in the risk management program, and adding independent assurance, means leadership can no longer treat critical infrastructure security as fully delegated. If the program is inadequate, that is now visibly a governance failure, with penalties attached.

A self assessed risk program that no independent party has tested is exactly the kind of thing that looks fine until an incident or an assurance review proves it was not. The reforms are designed to close that gap.

This mirrors a broader global direction. From the EU’s resilience rules to sector regulators worldwide, the expectation is shifting from having a policy to proving, independently, that controls work. Australian critical infrastructure entities are being brought into line with that expectation.

The intersection with data and incident obligations

Critical infrastructure operators do not face these obligations in isolation. Many also hold significant volumes of personal data and are already subject to the Privacy Act and its notifiable data breach scheme. An incident that affects a critical asset will frequently trigger obligations under both regimes at once. As the SOCI framework tightens, the practical result is that a serious incident becomes a multi front event, spanning operational recovery, SOCI reporting and directions, and privacy breach notification, often on overlapping and unforgiving timelines.

For boards, that reinforces the case for treating resilience and incident response as an integrated capability rather than a set of separate compliance checkboxes owned by different teams.

What entities should do now

The legislation is not final, but waiting for the last word is the higher risk path, because building genuine maturity in a risk management program takes time.

1. Confirm whether you are, or will be, in scope, including through the expanded asset classes and through your supply chain relationships with entities that are.
2. Mature your Critical Infrastructure Risk Management Program now, so it reflects real controls and real testing rather than documentation.
3. Get the board genuinely engaged. Brief leadership on the coming accountability and assurance expectations so involvement is substantive, not a signature.
4. Prepare for independent assurance by having your program reviewed against the likely requirements before it becomes mandatory, while there is time to fix what a review would find.
5. Integrate SOCI, privacy and incident response, so a serious event is handled as one coordinated response across every obligation it triggers.

Where Jaykan fits

Jaykan helps critical infrastructure operators and their suppliers build risk management programs that stand up to independent assurance, integrating the cyber security, monitoring and incident response capabilities that the SOCI framework increasingly demands. We help boards move from a program that exists on paper to one that genuinely reduces risk and can be shown to work.

If you want to know how your current program would fare against the direction of these reforms, a complimentary, senior led assessment will benchmark your posture and give you a prioritised plan to close the gaps before they become a compliance and enforcement problem.

Frequently asked questions

What is the SOCI Act?

The Security of Critical Infrastructure Act 2018 is the Australian law that sets cyber and resilience obligations for operators of critical infrastructure, such as energy, water, health, finance, communications and data assets. It requires responsible entities to manage risks to those assets and report significant incidents.

What are the 2026 SOCI Act reforms?

They are a proposed second tranche of amendments, released for consultation by the Department of Home Affairs in July 2026 in response to an independent review. They would expand the asset classes in scope, strengthen governance and supply chain obligations, require independent assurance of risk management programs, and significantly increase penalties.

Who is affected by the reforms?

Responsible entities for critical infrastructure assets, and the reforms would widen that group by refining and adding asset classes such as space, health, energy and research assets. Many large enterprises and government bodies that supply or operate these assets will fall in scope, directly or through their supply chains.

What should regulated entities do now?

Mature your Critical Infrastructure Risk Management Program, get board or senior management genuinely engaged with it, and prepare for independent assurance. The legislative detail is still being finalised, but the direction is settled, so building the capability early is lower risk than waiting.