Map SOCI Act cyber-reporting duties and CIRMP gaps for the asset
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Match systems to the 22 asset classes under the SOCI Act 2018 (Cth), list reporting clocks, and draft a CIRMP for cyber, personnel, physical and supply-chain hazards.
- What the lawyer must review
- Confirm the asset class
- Report critical incidents to the ACSC within 12 hours and others within 72
- Keep SOCI reports separate from NDB and the Cyber Security Act report
- Check telco assets, which moved into SOCI in April 2025
- Send CIRMP annual reports to the sector regulator, not ASD
- Written for / version
- Commonwealth versionCth
Rules that apply
The document starts from the task name. Change it if this piece of work is different.
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes preparing preliminary structure or wording. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.