SOCI Act 2.0

SOCI Act 2.0: What Australia’s Critical Infrastructure Reforms Mean for SAP-Run Operators

The Rules Are About to Be Rewritten

The Security of Critical Infrastructure Act has expanded steadily since 2018, but 2026 marks its biggest inflection point yet. Having accepted in principle all six recommendations from an independent review of the Act, the Federal Government is now consulting on a comprehensive restructure — one designed to remove regulatory duplication and enable more meaningful enforcement across Australia’s 11 critical infrastructure sectors.

Consultation on this first tranche closed at the end of July 2026, with enhancements to the Critical Infrastructure Risk Management Program rules already in effect from June 10, 2026, and rolling out over 12 to 24-month grace periods depending on the measure.

What’s Already Locked In for 2026

• Mandatory IoT security standards for smart devices supplied to critical infrastructure operators take effect March 4, 2026
• Enhanced CIRMP rules covering cyber, supply chain, physical, and personnel security have already commenced for high-risk asset classes
• New Ministerial Directions powers are under consultation, including provisions for high-risk vendors and civil penalties for non-compliance
• Critical cyber incidents must still be reported to the Australian Signals Directorate within 12 hours of an entity becoming aware

Why This Is an SAP Conversation, Not Just a Legal One

For energy, water, healthcare, and transport operators running SAP as their core operational and financial system, SOCI’s Positive Security Obligations translate directly into ERP-level questions: Who has privileged access to systems that control or report on critical assets? Can you demonstrate that access is reviewed on a defined cadence? Is there a documented, board-approved risk management program covering the SAP layer specifically?

Directors carry personal duty-of-care exposure here — failing to approve and oversee the CIRMP can breach Corporations Act obligations, which puts SAP access governance squarely on the board’s radar, not just IT’s.

Turning SOCI Obligations Into an SAP Action Plan

• Map which SAP systems and data touch your registered critical infrastructure assets
• Run a gap assessment against current CIRMP requirements for cyber, supply chain, and personnel security
• Build continuous SAP access monitoring so quarterly board risk updates are backed by real data, not point-in-time snapshots
• Prepare audit-ready evidence now, ahead of the next tranche of reforms

Get Board-Ready Before the Next Tranche Lands

SimpAudit gives critical infrastructure operators real-time SAP access monitoring, SoD analysis, and audit-ready reporting — the exact evidence base SOCI’s reformed framework will expect. Book a free demo to see where your SAP landscape stands today.

Click Here To Learn More: