LETS TALK

How to Meet Your SOCI Obligations

The Security of Critical Infrastructure Act 2018 (SOCI) is a key compliance obligation that cuts to the core of
Australia’s cyber security strategy.
SOCI is in the news because the Government wants to make Australia a world leader in cyber security by 2030.
As part of this, SOCI’s obligations have been significantly broadened and strengthened across Australia’s 11
new critical infrastructure sectors. The clock is ticking to meet these obligations, with the compliance grace
period running out on 17 August this year.

SOCI Act : Key compliance dates

20 June -
8 July 2022 8 Oct 2022 17 Aug 2023 17 Aug 2024
28 Sept 2024

Grace period ended
for mandatory Cyber
Incident Reporting
Grace period ended Grace period ended First annual report due End of grace period to
for registering for the Critical (must be submitted achieve cyber security
ownership and Infrastructure Risk within 90 days after legislation
operational Management Program the end of the requirements against
information (CIRMP) obligation financial year) a recognised
framework (AESCSF,
NIST, ISO2700X, E8)
or an equivalent

Apart from these critical infrastructure must-dos, there’s also an opportunity to adapt and thrive under the
Government’s vision for a prosperous and secure cyber future for Australia. Are you ready?

Your 3+1 Security Obligations

If you are a responsible entity for an Australian critical infrastructure asset, you must comply with the SOCI Act, and your Board-equivalent must
report annually to the Government. Beyond this, it’s critical to understand that SOCI is almost certain to change again, with Government considering
another five reforms resulting from its 2023 Cyber Security Strategy.

Currently, to comply with the SOCI Act, you need to do four things:

1 2 3 4

Register your asset with the
Cyber and Infrastructure
Security Centre (CISC), part
of the Department of Home
Affairs.
Implement and maintain a
Critical Infrastructure Risk
Management Program
(CIRMP), which is a plan that
identifies and addresses the
risks to your asset.
Report any cyber incidents
that have a significant or
relevant impact within
specified time periods
ranging from hours to days.
Finally, if Government
designates you as a super-
critical “System of National
Significance” or SONS,
there’s additional, and
substantial, obligations you
must meet.

Who’s Going To Need To Pay Attention To SOCI?

SOCI applies to Australia’s 11 new critical infrastructure sectors, including their supply chains!
These sectors are:

Communications Data storage or processing Defence Industry

Higher education and Financial Services and

Energy
research Markets

Food and Grocery Health Care and Medical Space Technology

Transport Water and Sewerage

SOCI brings both unique security requirements and a Board-level obligation to report annually to Government on how they are being met.
Technically, issues such as IT/OT convergence, data sovereignty, automation, AI, Cloud, insider threat, SIEM/SOC capabilities, a true Zero Trust
approach, and immutable backups can all impact on how successful critical infrastructure companies will be in meeting their SOCI obligations. A
business-as-usual approach to these new obligations is unlikely to be good business.

Why Choose NEXTGEN for SOCI Solutions?

The NEXTGEN Group has the knowledge, experience, and ecosystem to help you meet SOCI’s obligations by enhancing
the security and resilience of your critical infrastructure assets. We offer:

A comprehensive portfolio of
security solutions from
leading vendors that will help
you meet and exceed your
compliance obligations.
A dedicated team of cyber
and data resilience experts
that can support you with
assessing your environment
and finding solutions that
bring complex technologies
together for better cyber
security and resilience.
The support of a robust
demand generation engine,
and dedicated resources, to
help identify SOCI-related
business opportunities as
these sectors grapple with
their evolving compliance
requirements.
The strategic guidance of a
distributor that operates
across the APAC region and
has a deep understanding of
its challenging and dynamic
cyber security space.

How to Get Started with

SOCI Solutions?
The NEXTGEN Group and its security vendors can
help you deliver superior SOCI solutions. Let’s talk!
Use the form below to drop us a note and we will be
back in touch soon.

Learn more by talking to an expert

Our Vendors/Partners