pentagramadvisory

Recently, many critical infrastructure responsible entities covered by the Security of Critical Infrastructure Act 2018 (SOCI Act) are likely to have noticed a significant evolution in the annual Critical Infrastructure Risk Management Program (CIRMP) reporting process, with the FY2025–26 reporting cycle signalling a broader shift in regulatory expectations surrounding governance, resilience, and Board accountability. The revised annual reporting […]

Why exit and post-employment risk are the missing pieces in workforce assurance Listen to the audio version of this article below: Executive Summary For many organisations, workforce assurance begins at hiring. Significant effort is often invested in pre-employment screening, background checks, and initial suitability assessments. Increasingly, organisations are also strengthening their approach to ongoing suitability,

The fire at Viva Energy’s Geelong refinery should be treated as more than an industrial incident. Initial media reporting points to equipment failure stemming from inadequate maintenance. There is, as of 17 April 2026, no public evidence of sabotage. But focusing on cause alone risks missing the broader point. For operators of critical infrastructure — and for

Observing the absence of usual and the presence of unusual Introduction: The Illusion of Sudden Insider Risk Insider incidents are often described as unexpected. A data breach occurs. A policy is violated. Sensitive information is disclosed. The event appears sudden, and the question that follows is predictable: How did this happen? However, in most cases, the

Organisations responsible for protecting government resources or critical infrastructure assets have, over time, built increasingly sophisticated security architectures. Policies are codified, controls are implemented, monitoring capabilities are expanded, and compliance frameworks are strengthened. These mechanisms are necessary, and in many cases, highly effective. They provide structure, consistency, and a defensible basis for managing security risk

Understanding how personnel risk develops over time Organisations responsible for protecting critical infrastructure invest significant effort in pre-employment screening. Background checks, security clearances, verification processes and role-suitability assessments help ensure that individuals entrusted with sensitive systems, operational technology or critical information demonstrate the integrity, judgement and reliability required for high-trust roles on which the organisation