Would anyone actually tell us we are captured?
Usually not. The SOCI Act is self-executing: it captures organisations by operation of its definitions, not by issuing a notice, so the absence of a letter is not evidence you are outside the regime.
If your organisation meets the definition of a responsible entity for a critical infrastructure asset, you are regulated from that moment, whether or not anyone has told you and whether or not you have realised it. The responsibility to work out your status sits with you.
The practical risk is discovering the obligation late, during an incident or an assurance review, rather than deciding it deliberately.
What actually makes you a regulated entity?
A four-part test, all assessed against the definitions rather than granted to you: the asset sits in one of the 11 sectors, it fits a defined asset class and any threshold, the rules for that class are switched on, and you hold a qualifying role.
The 11 sectors span energy, communications, financial services and markets, data storage or processing, water and sewerage, health care and medical, transport, food and grocery, higher education and research, space technology, and defence industry, across 22 defined asset classes. Some classes carry a size or criticality threshold and some do not.
The role catches people out. The obvious role is the responsible entity, generally the owner or operator. But a direct interest holder, broadly an entity holding an interest of at least 10 per cent or a position that lets it influence or control the asset, is also a reporting entity. The proposed Tranche 2 reforms would add a 'relevant operator' concept, pulling in managed service providers and others with practical control. You can be captured without owning anything.
So does anyone ever tell you? The three ways status arrives
Three ways, and only two involve a notice: self-assessment (the default, no notice), a private ministerial declaration (you are notified), and a Systems of National Significance declaration (notified in writing within 30 days).
The default is self-assessment against the asset-class definitions, with no notice issued. A private ministerial declaration is used where an asset is critical but not otherwise captured, and you are notified. A Systems of National Significance declaration is reserved for the most critical assets, which the Minister must notify to the responsible entity in writing within 30 days.
Even with a Systems of National Significance declaration, the enhanced obligations that come with it only apply once the Secretary of Home Affairs gives specific written notice.
What is the Register, and do we get 'added' to it?
The Register of Critical Infrastructure Assets is an asset register, not an organisational directory, and it is confidential rather than public. You are not added to it as recognition of your status; if the register obligation applies, you must report your own asset.
It is organised around each critical infrastructure asset, not around companies, and it is held by the Cyber and Infrastructure Security Centre. Because it is confidential, you cannot look yourself up to confirm your status.
If the register obligation applies to your asset class, you must report your own asset, giving operational information about what the asset is and who operates it, and interest-and-control information about who owns it and who can influence or control it. Notifiable changes must be reported within 30 days, and a single asset can have more than one reporting entity, since both the responsible entity and any direct interest holders report against it.
Five questions to establish your SOCI status
- Map your assets to the 11 SOCI sectorsMap every asset to the sector list before anything else, and do not stop at the obvious one.
- Check the asset class and any thresholdTest each asset against the CISC asset-class definitions. Some classes carry a size or criticality threshold, some do not.
- Confirm the rules are switched onObligations commence per asset class. Confirm the current status with CISC rather than assuming.
- Establish your roleResponsible entity, direct interest holder, or the proposed relevant operator. Obligations differ by role, and you can be caught without owning the asset.
- Meet the register and reporting obligationsIf captured, report the asset to the Register of Critical Infrastructure Assets where the obligation applies, and notify changes within 30 days.
Martin Barnier is Principal Consultant at Lumaris, an Australian-owned, vendor-neutral advisory firm specialising in AI, data, cyber security, cloud, and critical infrastructure. He has over a decade of experience architecting security and technology across government, defence, national security, and health, including programs bound by APRA, Essential Eight, PSPF, and SOCI Act obligations.
View LinkedIn profile