Australia's CISC Issues Updated CIRMP Guidance to Strengthen Critical Infrastructure Cyber and Supply Chain Risk Controls
Australia's Critical Infrastructure Security Centre (CISC) has published updated Critical Infrastructure Risk Management Program (CIRMP) guidance and a companion snapshot document for responsible entities under the Security of Critical Infrastructure (SOCI) Act 2018. The guidance helps entities identify material risks across seven hazard vectors—all hazards, cyber and information security, credential compromise, lateral movement, personnel, supply chain, and physical security/natural hazards—and document controls and mitigations. It emphasizes that enhanced entities must implement phishing-resistant multi-factor authentication, segregate critical systems for at least three months of resilience, map supply chains, and apply stricter vetting for critical workers. The update references the ASD ACSC Annual Cyber Threat Report 2025-26, which found critical infrastructure incidents made up 10% of all incidents and noted ASD responded to over 1,500 incidents in 2025-26, a 20%+ increase, with malicious activity notifications up almost 80%.
Detalhes técnicos
The CIRMP requires entities to adopt an all-hazards approach under section 30AC/30AH of the SOCI Act, weighing likelihood against impact for each hazard. For enhanced CIRMP assets, entities must comply with Maturity Level 2 of a chosen cyber security framework (e.g., ASD's Essential Eight, ISO 27001/27002, NIST Cybersecurity Framework, Australian Energy Sector Cyber Security Framework), using a five-step equivalency assessment process when selecting alternative frameworks. The guidance flags credential compromise and lateral movement as persistent entry points for broader intrusions, particularly in interconnected IT/OT environments, and highlights supply chain concentration risk where a single supplier incident could disrupt multiple critical services nationally.
Remediação
Entities should maintain phishing-resistant MFA, segment critical systems, conduct supplier risk assessments, apply background checks (e.g., AusCheck) for critical workers, document decisions on reasonably practicable controls, review CIRMPs at least every 24 months, and submit board-approved annual reports to the relevant regulator (Reserve Bank of Australia or Department of Home Affairs) within 90 days of the financial year end. Non-compliance may attract a civil penalty of 150 penalty units.
Linha do tempo
-
Australia's CISC Issues Updated CIRMP Guidance to Strengthen Critical Infrastructure Cyber and Supply Chain Risk Controls
ler a análise desta fonte ocultar
Australia's Critical Infrastructure Security Centre (CISC) has published updated Critical Infrastructure Risk Management Program (CIRMP) guidance and a companion snapshot document for responsible entities under the Security of Critical Infrastructure (SOCI) Act 2018. The guidance helps entities identify material risks across seven hazard vectors—all hazards, cyber and information security, credential compromise, lateral movement, personnel, supply chain, and physical security/natural hazards—and document controls and mitigations. It emphasizes that enhanced entities must implement phishing-resistant multi-factor authentication, segregate critical systems for at least three months of resilience, map supply chains, and apply stricter vetting for critical workers. The update references the ASD ACSC Annual Cyber Threat Report 2025-26, which found critical infrastructure incidents made up 10% of all incidents and noted ASD responded to over 1,500 incidents in 2025-26, a 20%+ increase, with malicious activity notifications up almost 80%.
Technical Details
The CIRMP requires entities to adopt an all-hazards approach under section 30AC/30AH of the SOCI Act, weighing likelihood against impact for each hazard. For enhanced CIRMP assets, entities must comply with Maturity Level 2 of a chosen cyber security framework (e.g., ASD's Essential Eight, ISO 27001/27002, NIST Cybersecurity Framework, Australian Energy Sector Cyber Security Framework), using a five-step equivalency assessment process when selecting alternative frameworks. The guidance flags credential compromise and lateral movement as persistent entry points for broader intrusions, particularly in interconnected IT/OT environments, and highlights supply chain concentration risk where a single supplier incident could disrupt multiple critical services nationally.
Remediation
Entities should maintain phishing-resistant MFA, segment critical systems, conduct supplier risk assessments, apply background checks (e.g., AusCheck) for critical workers, document decisions on reasonably practicable controls, review CIRMPs at least every 24 months, and submit board-approved annual reports to the relevant regulator (Reserve Bank of Australia or Department of Home Affairs) within 90 days of the financial year end. Non-compliance may attract a civil penalty of 150 penalty units.