Security of Critical Infrastructure Act 2018 (Cth)
Imposes security and mandatory cyber incident reporting obligations on operators of critical infrastructure assets. Most small businesses are not directly regulated, but may be affected through supply-chain requirements from larger customers.
Department of Home Affairs / ASD's ACSC
General information, not legal advice
Australian Digital Duty of Care obligations are subject to legislation and service applicability; this platform does not certify compliance. Digital Care provides tools and records to support your own risk management. It is not legal advice.
The text below is explanatory guidance, not a reproduction of legislation. The official complete text and commencement information control. These steps support your work; they do not guarantee that an obligation is met.
Does it apply to your business?
Direct duties depend on the asset class, statutory thresholds and your role as responsible entity, direct interest holder or another regulated party. A supplier may have contractual duties without being directly subject to the same SOCI provisions.
Digital Care’s categories are a supporting risk record, not a complete statutory critical-infrastructure risk management programme or a substitute for official reporting.
Detailed guidance
The SOCI Act regulates defined critical infrastructure assets and entities. Asset-specific rules can include ownership and operational information, risk management programmes and mandatory cyber-incident reporting.
Small-business status does not itself answer applicability. Identify the actual asset, role and applicable rules, and distinguish legislation from assurances requested by a customer or insurer.
Part 2
Critical infrastructure register
Where covered, provide the prescribed operational or ownership information and maintain updates within applicable requirements. Determine who is responsible for each submission rather than assuming a supplier must register itself.
Part 2A and applicable rules
Risk management programme
Covered responsible entities must adopt, maintain and comply with an applicable written programme. Requirements depend on the asset and rules and may address cyber, personnel, physical and supply-chain hazards.
Part 2B
Cyber-incident reporting
For covered assets, critical cyber incidents generally require reporting within 12 hours of awareness; other reportable incidents generally within 72 hours. Apply statutory impact definitions and current reporting guidance, including written follow-up where an oral report is used.
Other asset-specific provisions
Additional obligations
Data storage or processing services, critical telecommunications and systems of national significance can attract further requirements. Seek qualified advice on the current Act and relevant instruments.
Digital Care action checklist
0 of 4 preparation steps checked · This page only; not saved to your assessment or evidence records.
Determine whether you are a responsible entity, direct interest holder or supplier for a regulated critical infrastructure asset. Obtain specialist advice where asset classification is uncertain.
Keep a record: Asset classification and a documented statutory-versus-contractual distinction.
List only duties applying to your asset and entity. Include register, risk-management programme and cyber-incident obligations where applicable, separately from customer contracts.
Keep a record: Applicable duty register and supporting contract extracts.
For covered assets, prepare to report critical cyber incidents within 12 hours and other reportable cyber incidents within 72 hours of awareness. Check current ACSC guidance and any oral-report follow-up requirements.
Keep a record: Escalation owners, incident timeline and official reporting contacts.
Verify your own applicable obligations and any supply-chain commitments. Do not describe contractual security measures as proof that all SOCI duties have been met.
Keep a record: Dated review and clearly identified unresolved obligations.
Where your plan does not include the risk register or file evidence, retain those records securely outside Digital Care and reference them in your self-review. Legal notifications and technical controls must be completed through the appropriate external channels.
Official full text & sources
Read the complete instrument on the official publisher’s website, including amendments, definitions, exemptions and commencement notes. Official sources may change after this guidance was reviewed.