Australia SOCI Act
Amended Australia · In force Jul 11, 2018 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Jul 8, 20224 years ago | Mandatory cyber incident reporting starts for most assetstentative | 4.2 years ago |
| Jul 11, 20188 years ago | SOCI Act commences | 8.2 years ago |
Summaries for reference, not legal advice. Check the official text.
What it does
Australia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.
- Who it applies to
- Responsible entities and direct interest holders for critical infrastructure assets across 11 sectors, including energy, water, communications, data storage and processing, financial services, health, transport and food.
- Penalties
- Civil penalties for failing to register, report incidents or keep a risk management program. Amounts are set in penalty units in the Act and are not captured here.
- Enforced by
- Department of Home Affairs (Cyber and Infrastructure Security Centre); Australian Signals Directorate receives incident reports
- Official name
- Security of Critical Infrastructure Act 2018
- Citation
- Act No. 29, 2018; amended by Acts of 2021, 2022 and 2024
- Topics
- cybersecurity, breach-notification
Research notes
The 2021 (SLACI), 2022 (SLACIP) and 2024 (Enhanced Response and Prevention) amending Acts are on the Federal Register. The incident reporting start date is calculated, not stated, so it is marked tentative. Risk management program dates are not captured here.
Related
Questions about Australia SOCI Act
- What are the Australia SOCI Act compliance deadlines?
- Jul 11, 2018: SOCI Act commences. Jul 8, 2022: Mandatory cyber incident reporting starts for most assets (tentative).
- When does Australia SOCI Act take effect?
- Australia SOCI Act took effect on Jul 11, 2018.
- Who does Australia SOCI Act apply to?
- Responsible entities and direct interest holders for critical infrastructure assets across 11 sectors, including energy, water, communications, data storage and processing, financial services, health, transport and food.
- What are the penalties under Australia SOCI Act?
- Civil penalties for failing to register, report incidents or keep a risk management program. Amounts are set in penalty units in the Act and are not captured here.