SOCI is Australia’s law for protecting critical infrastructure. Its obligations are ongoing, and since June 2026 they’re stricter for high-risk assets like water, electricity and gas.
Overcyte helps operators stay compliant all year round, replacing annual spreadsheet exercises with real-time tracking against the frameworks SOCI recognises.
The Security of Critical Infrastructure Act 2018 is Australia's primary legislation for protecting critical infrastructure from cyber and physical threats. It establishes a legal framework that defines which assets are considered critical infrastructure, who is responsible for protecting them, and what obligations those responsible entities must meet.
The intent is straightforward: ensure that the systems Australians depend on, power, water, transport, and communications, are resilient enough to withstand serious disruption.
The Act has been amended several times since 2021, and each round has widened its scope and tightened obligations. The most recent change came on 10 June 2026, when the enhanced CIRMP rules took effect for nine high-risk asset classes, including critical water, electricity and gas assets.
The SOCI Act applies to anyone who owns, operates, or holds a direct interest in a critical infrastructure asset across eleven sectors:
Not all obligations apply to every sector and asset class. Check the CISC's sector-specific guidance to confirm what applies to you. If your organisation is in scope, the three obligations below apply, and Overcyte is built to help you manage all of them.
Most critical infrastructure operators are subject to three Positive Security Obligations (PSOs) under the Act. These are the core compliance requirements, ongoing, not one-off, and increasingly subject to active enforcement. Overcyte maps directly to all three, giving your team continuous visibility across each obligation rather than a once-a-year compliance exercise.
Operators designated as Systems of National Significance (SoNS) by the Minister for Home Affairs face four additional Enhanced Cyber Security Obligations: mandatory incident response plans, cybersecurity exercises, vulnerability assessments, and provision of system information to the government.
The SOCI Act requires operators to meet their CIRMP cybersecurity obligations against a recognised framework. It doesn't prescribe which one, but it does recognise several:
All four frameworks are built into Overcyte, so whichever one your organisation uses for its CIRMP, compliance tracking is already mapped and ready. The August 2024 grace period for meeting a recognised framework has closed, so this is no longer optional.
Most SOCI guidance is written with IT environments in mind. For energy, water and utilities operators, the reality is more complex. Critical infrastructure runs on operational technology, SCADA systems, industrial control systems, PLCs and RTUs, which don't behave like IT and can't be managed like it. Think pump stations, treatment plants and substations, not office laptops.
Patching cycles are a good example. OT systems often can't be patched on standard IT timescales due to vendor dependencies, change management requirements and operational uptime constraints. Network segmentation and compensating controls become the practical response, but they need to be documented, maintained and defensible under audit. For high-risk assets under the enhanced CIRMP rules, network segregation is now a requirement, not just good practice.
The CIRMP's all-hazards approach demands continuous visibility, not a point-in-time assessment. Organisations that complete an annual review and file it away are meeting the letter of the obligation but not its intent, and with CISC now conducting active audits, that gap is exactly what assessors will be looking for.
Meeting SOCI obligations isn't a project with an end date. The register needs to stay current, incidents need to be reportable at short notice, and the CIRMP needs to reflect your actual risk posture, not last year's assessment.
Overcyte maps directly to the three Positive Security Obligations. It supports CIRMP development, evidence collection and compliance workflows across your critical assets. AESCSF, Essential Eight, ISO 27001 and NIST CSF are all built in, so your framework alignment is tracked in real time. When 28 September comes around, your board report is already there.
You can be set up within minutes, and our team can help you move across from existing spreadsheets. Built by practitioners who understand the gap between IT compliance and OT reality, Overcyte is designed for energy, water and utility operators.
.png)
