pentagramadvisory

Introduction Across Pentagram Advisory’s engagements with critical infrastructure entities nationwide, we have observed a persistent structural imbalance in how security risk is governed and resourced — one that warrants Board-level attention. Cyber security functions are comparatively established, well resourced, visible and structured. Yet outside cyber, responsibility for the security of critical infrastructure assets is generally

In today’s security environment, organisations that operate critical infrastructure cannot afford to treat workforce screening as a transactional HR activity. Workforce assurance is the structured, risk-based process of understanding, governing and continuously reviewing trust in people with access to critical assets, data and operations. It must be embedded as a long-term organisational capability. For many

Organisations across Australia’s critical infrastructure sectors are increasingly reliant on global talent. Engineers, cyber specialists, data analysts, and technical experts are frequently sourced from overseas to address persistent skills shortages, or are rotated into the Australian subsidiary of a foreign-owned critical infrastructure asset. At the same time, the security environment facing critical infrastructure operators and

Workforce assurance in critical infrastructure series Executive Summary For Australia’s critical infrastructure entities, the greatest personnel security risks rarely arise at the point of hiring. They emerge later as access expands, responsibilities increase, pressures accumulate, and trust is tested over time. Workforce assurance, therefore, cannot stop at pre-employment screening. It must extend across the entire

Workforce assurance in critical infrastructure series Executive Summary Pre-employment screening is often treated as an administrative gateway: a set of standard checks applied uniformly to every role, regardless of consequence or risk embodied in the role. In Australia’s critical infrastructure environment, this approach is no longer adequate, and in some cases, it may even create

Workforce assurance in critical infrastructure series Executive Summary Workforce assurance is now a key national security capability for Australia’s critical infrastructure sectors. As the operating environment becomes more complex, the risks associated with trusted insiders, including employees, contractors and third-party personnel with legitimate access, are increasing. Many organisations continue to rely heavily on the AusCheck

Executive framing: why this distinction matters now As organisations subject to the Security of Critical Infrastructure Act 2018 (SOCI Act) continue to mature in their implementation of the Critical Infrastructure Risk Management Program (CIRMP), many Boards and executives are now asking a sensible question: “Are we compliant, and what does CIRMP maturity actually tell us?” Yet, before