Security of Critical Infrastructure Act 2018 (SOCI)
What is Security of Critical Infrastructure Act 2018 (SOCI)?
Australian legislation mandating security obligations for owners and operators of critical infrastructure assets across 11 sectors, including cyber incident reporting, risk management programs, and enhanced cyber security obligations for systems of national significance.. It comprises 32 controls organised across 6 domains, published by AICPA, and applies in Australia.
How Security of Critical Infrastructure Act 2018 (SOCI) maps to other frameworks
All 32 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 6 domains Security of Critical Infrastructure Act 2018 (SOCI) groups its controls into
Frameworks that share controls with Security of Critical Infrastructure Act 2018 (SOCI)
Each of these has at least one control mapped to a control in Security of Critical Infrastructure Act 2018 (SOCI). The number is how many Security of Critical Infrastructure Act 2018 (SOCI) controls are shared, counted from the mapping graph.
SSAE 18 - Attestation Standards (SOC Reporting)
10 shared controlsTelecommunications Sector Security Reforms (TSSR)
7 shared controlsTISAX - Trusted Information Security Assessment Exchange
7 shared controlsUK AI Regulation Framework
6 shared controlsVirginia CDPA
4 shared controlsUruguay DPL
4 shared controlsUK GDPR (UK General Data Protection Regulation)
4 shared controlsTexas Data Privacy Act
4 shared controlsTraining on frameworks that overlap Security of Critical Infrastructure Act 2018 (SOCI)
There is no course on Security of Critical Infrastructure Act 2018 (SOCI) itself. These cover frameworks that share controls with it, so the material carries across even though the standard named is different.
Where Security of Critical Infrastructure Act 2018 (SOCI) overlaps with the standards you already hold
What an auditor will ask you for
All 35 Security of Critical Infrastructure Act 2018 (SOCI) controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.
Read the Security of Critical Infrastructure Act 2018 (SOCI) evidence request listWhat Security of Critical Infrastructure Act 2018 (SOCI) means in your sector
What Security of Critical Infrastructure Act 2018 (SOCI) means for your job
Questions people ask about Security of Critical Infrastructure Act 2018 (SOCI)
What is Security of Critical Infrastructure Act 2018?
Where does Security of Critical Infrastructure Act 2018 apply?
How do I get started with Security of Critical Infrastructure Act 2018 compliance?
Query Security of Critical Infrastructure Act 2018 (SOCI) programmatically
Security of Critical Infrastructure Act 2018 (SOCI), its 32 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
Security of Critical Infrastructure Act 2018 (SOCI) API reference and MCP config →What Security of Critical Infrastructure Act 2018 (SOCI) requires, control by control
Each page carries the requirement text for one Security of Critical Infrastructure Act 2018 (SOCI) control and what an assessor expects to see as evidence.
- SOCI-CIRMP-PERSONNEL CIRMP hazard vector: Personnel
- SOCI-CIRMP-PHYSICAL CIRMP hazard vector: Physical security and natural hazards
- SOCI-CIRMP-SUPPLY CIRMP hazard vector: Supply chain
- SOCI-S30AC Obligation to adopt a CIRMP
- SOCI-S30AD Compliance with CIRMP
- SOCI-S30AE Annual review of CIRMP
- SOCI-S30BC Notification of critical cyber security incidents (12 hours)
- SOCI-S30BD Notification of other cyber security incidents (72 hours)
- SOCI-S30CB Statutory incident response planning
- SOCI-S30CU Vulnerability assessments
How ready are you for Security of Critical Infrastructure Act 2018 (SOCI)?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.