---
title: "Map SOCI Act cyber-reporting duties and CIRMP gaps for the asset"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/map-critical-infrastructure-cyber-reporting-duties-for-the-asset/commonwealth"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-T1-R15-CTH"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["CTH"]
last_reviewed: "2026-09-23"
---

# Map SOCI Act cyber-reporting duties and CIRMP gaps for the asset

> Match systems to the 22 asset classes under the SOCI Act 2018 (Cth), list reporting clocks, and draft a CIRMP for cyber, personnel, physical and supply-chain hazards.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/map-critical-infrastructure-cyber-reporting-duties-for-the-asset/commonwealth  
Last reviewed: 2026-09-23

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Match systems to the 22 asset classes under the SOCI Act 2018 (Cth), list reporting clocks, and draft a CIRMP for cyber, personnel, physical and supply-chain hazards. |
| What the lawyer must review | Confirm the asset class Report critical incidents to the ACSC within 12 hours and others within 72 Keep SOCI reports separate from NDB and the Cyber Security Act report Check telco assets, which moved into SOCI in April 2025 Send CIRMP annual reports to the sector regulator, not ASD |
| Written for | Commonwealth |
| Applies to | [Map critical-infrastructure cyber reporting duties for the asset](https://ailawframework.com/practice/privacy-data-protection-and-cyber/map-critical-infrastructure-cyber-reporting-duties-for-the-asset.md) |

## Checking plan

**Lawyer review required**

The responsible lawyer reviews the work against the instructions, sources and intended use.

- What the AI does: Potential support includes preparing preliminary structure or wording and identifying points for review. Confirm the tool’s capability and permitted scope.
- What the lawyer does: Set the scope, verify the evidence, resolve exceptions and approve the final output for its intended use.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Suggested checking approach based on the task guidance. Complete the assessment for the actual tool, information and jurisdiction.
- Why: The plan reflects the described work and review requirements. Policy colours are not used to determine permission or checking.

## Checks the lawyer makes

1. Review the original source set for relevant material absent from the output, including contrary evidence, qualifications and unresolved gaps.
2. Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
3. Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
4. Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.

## Notes

- Confirm the required checking with the responsible lawyer before work starts. The checking approach does not establish permission to use AI.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*