On 10 June 2026, the Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (Enhanced CIRMP Rules 2026) commenced, introducing the most significant expansion of Australia’s Critical Infrastructure Risk Management Program (CIRMP) framework since the Security of Critical Infrastructure (Critical Infrastructure Risk Management Program) Rules 2023 (CIRMP Rules 2023) came into effect.
The Enhanced Rules introduce 78 additional legislative obligations for specified higher-risk critical infrastructure asset classes, representing a significant expansion of the CIRMP regulatory framework and the regulatory expectations placed on affected responsible entities.
Much has already been written about what has changed.
This article takes a different approach.
Rather than examining every legislative provision individually, we explore what the Enhanced CIRMP Rules reveal about the evolving direction of Australia’s critical infrastructure regulatory framework, what they mean for Boards and senior executives, and why organisations should begin thinking about implementation now rather than waiting for the legislative deadlines to arrive.
In doing so, we examine how the Enhanced Rules reflect the continuing evolution of Australia’s risk management framework for critical infrastructure, with an increasing emphasis on governance, implementation, evidence and demonstrable security capability.
Drawing on Pentagram’s detailed analysis of the Enhanced Rules, we also share practical implementation considerations to assist responsible entities in preparing for the staged commencement of the new obligations.
This is the first article in a series examining the Enhanced CIRMP Rules. Subsequent articles will explore key areas of change—including personnel security and supply chain security—and discuss practical approaches to translating the legislative requirements into an integrated, risk-based security program that supports both regulatory compliance and meaningful security effect.
The Enhanced CIRMP Rules: Key Facts
One of the most important things to understand is that there are now two layers of CIRMP obligations.
The first is the Baseline CIRMP framework, established under the Security of Critical Infrastructure Act 2018 (SOCI Act) and the CIRMP Rules 2023, with 59 legislative obligations that continue to apply to responsible entities required to adopt and maintain a CIRMP.
The second is the Enhanced CIRMP framework, which introduces 78 additional legislative obligations for specified higher-risk critical infrastructure assets.
The Enhanced Rules apply only to the following asset classes:
- critical broadcasting assets
- critical domain name system assets
- critical electricity assets
- critical energy market operator assets
- critical freight infrastructure assets
- critical freight services assets
- critical gas assets
- critical liquid fuel assets
- critical water assets.
Rather than replacing the existing Baseline CIRMP framework, the Enhanced Rules build upon it.
Responsible entities captured by the Enhanced Rules must continue to comply with the Baseline CIRMP obligations while progressively implementing the additional enhanced requirements. Where an inconsistency exists between the two, the Enhanced Rules prevail.
The additional obligations span six broad areas:
- additional material risks
- cyber and information security
- credential compromise and lateral movement
- personnel security
- supply chain security
- physical security and natural hazards.
Importantly, organisations are not expected to implement all of the new requirements immediately.
The Enhanced Rules 2026 provide two staged implementation horizons.
The first applies to section 6A (Additional material risks), subsection 8A(2) (Cyber and Information Security) and subsection 9A(2) (Personnel), which must be implemented by 10 June 2027.
The remaining enhanced obligations—including sections 8A (other than subsection (2)), 8B, 8C, 9A (other than subsection (2)), 10A (Supply Chain) and 11A (Physical Security and Natural Hazards)—must be implemented by10 June 2028.
These implementation periods acknowledge that many of the new obligations require organisations to develop additional governance arrangements, establish new processes, strengthen existing security capabilities and embed new ways of working.
There are also several practical implications that are important to note from the outset.
First, existing section 51 declared assets are not automatically subject to the Enhanced CIRMP Rules. A separate declaration is required before the enhanced obligations apply.
Secondly, some organisations may find themselves operating under multiple security frameworks simultaneously. For example, an organisation operating both a critical electricity asset and a critical telecommunications asset may be required to comply with the Enhanced CIRMP Rules for its electricity asset while continuing to comply with the Security of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules 2025 for its telecommunications asset.
Finally, while most of the new obligations benefit from transitional implementation periods, subsections 4A(3) and 4A(4) commenced immediately on 10 June 2026.
These provisions are significant because they establish the relationship between the Baseline and Enhanced CIRMP frameworks.
For responsible entities captured by the Enhanced Rules, this means the work has already begun on 4A(3) and 4A(4).
Organisations should now:
- determine whether the Enhanced Rules apply to their assets
- understand how the Enhanced Rules interact with their existing CIRMP obligations
- establish governance and implementation planning to support compliance with the 2027 and 2028 implementation milestones.
The transition periods should therefore be viewed as an opportunity—not to delay implementation, but to plan and deliver a structured, risk-based uplift in organisational security capability.
Understanding the Evolution of the CIRMP Framework
To understand the significance of the Enhanced CIRMP Rules 2026, it is helpful to revisit the philosophy underpinning the original CIRMP framework.
The 2022 amendments to the SOCI Act introduced the CIRMP as an all-hazards, principles-based and risk-based framework. Responsible entities were required to identify material risks, minimise those risks so far as reasonably practicable, and mitigate the impact of hazards affecting their critical infrastructure assets.
The accompanying Regulation Impact Statement emphasised proportionality, flexibility and recognition that responsible entities operate in different environments with varying levels of maturity and existing regulatory obligations.
Similarly, the Advisory Report of the Parliamentary Joint Committee on Intelligence and Security and the 2026 Independent Review of the Security of Critical Infrastructure Act 2018 highlighted the importance of consultation, proportionality, risk-based regulation and industry engagement in the continuing evolution of Australia’s critical infrastructure framework.
Against that background, Pentagram Advisory undertook a detailed analysis of the legislative obligations across both the Baseline and Enhanced CIRMP frameworks.
Our analysis identified:
- 59 legislative obligations under the Baseline CIRMP framework
- 78 additional obligations introduced by the Enhanced CIRMP Rules 2026
- 137 legislative obligations across the Baseline and Enhanced CIRMP frameworks that affected responsible entities will ultimately need to understand, implement and govern by 10 June 2028.
The increase in obligations is significant.
More significant, however, is the nature of those additional obligations.
The original CIRMP framework largely described the security outcomes organisations were expected to achieve.
The Enhanced Rules describe many more of the minimum security capabilities, processes and controls expected to exist.
Yet, despite providing considerably more detail, the legislation still deliberately avoids prescribing exactly how those capabilities should operate together within an organisation.
One way to think about this is to imagine building with Lego.
The original CIRMP Rules described the structure organisations were expected to build.
The Enhanced Rules provide many more Lego bricks that should now form part of that structure.
What they do not provide is the instruction manual.
Responsible entities must determine how those individual building blocks fit together to create an integrated security capability appropriate to their unique operational context, governance arrangements and risk appetite.
In Pentagram’s view, this is where the most significant shift has occurred.
The Enhanced Rules remain fundamentally risk-based and principles-based. However, they are increasingly prescriptive in relation to the minimum security capabilities that organisations are expected to establish and maintain.
They place greater emphasis on documented processes, demonstrable implementation, supporting evidence and ongoing assurance, while promoting greater consistency in security capability across regulated entities. They are inherently more auditable than the Baseline CIRMP Rules.
Our analysis suggests that the regulatory emphasis has evolved from asking organisations to demonstrate how they manage material risks towards demonstrating that an increasingly defined set of security capabilities and controls has been established and is operating effectively.
Importantly, while the Government increasingly specifies what should exist, responsible entities remain responsible for determining how those capabilities are integrated, governed and operated within their own organisation.
Responsibility for implementation, and ultimately for managing security risk, remains firmly with each responsible entity.
What Boards and Senior Executives Need to Know
For Boards and senior executives, the Enhanced CIRMP Rules represent more than additional compliance obligations. They raise the minimum expectations for how security is governed, implemented and assured across the organisation.
Key implications include:
- Higher minimum expectations: the Enhanced CIRMP Rules 2026 establish more defined and expansive minimum expectations for protective security capability across regulated sectors.
- Greater emphasis on implementation: demonstrating that security controls are operating effectively will become as important as documenting their existence.
- Additional organisational capability: successful implementation will require investment in governance, people, processes and supporting systems.
- Integrated security governance: cyber, personnel, supply chain and physical security can no longer be managed in isolation; they must operate as an integrated security program.
- Board assurance: Boards will require greater confidence that security controls are effective, supported by evidence and delivering the intended security outcomes.
- Avoiding “artefact compliance”: documentation alone will not demonstrate compliance if it is not supported by implemented and operating security capability.
The key takeaway is simple.
The Enhanced CIRMP Rules should be viewed as a multi-year security uplift program—not simply another compliance exercise.
The staged implementation periods provide organisations with an opportunity to strengthen governance, build capability, prioritise investment and progressively achieve both compliance and meaningful security effect.
Why Readiness Matters
One practical observation emerged repeatedly during our analysis.
Traditional maturity assessments evaluate the effectiveness of security capabilities that already exist.
The Enhanced CIRMP Rules, however, introduce additional capabilities that many organisations are still in the process of designing and implementing.
Assessing organisational security maturity alone therefore provides only part of the picture.
During the transition period, organisations also need to understand how prepared they are to implement the Enhanced Rules within the applicable legislative timeframes.
This is the thinking behind Pentagram Advisory’s new Enhanced CIRMP Readiness Assessment Module, which complements our existing CIRMP Security Maturity Assessment and Evaluation Model.
Rather than assessing the maturity of existing CIRMP capability, the Readiness Module focuses on an organisation’s preparedness to implement the additional Enhanced CIRMP obligations.
A distinguishing feature of the Module is CIRMP Compliance Horizon, which aligns each assessment requirement with its legislative implementation horizon, enabling Boards and executives to distinguish between:
- current Baseline CIRMP obligations
- Enhanced CIRMP obligations requiring implementation by 10 June 2027
- Enhanced CIRMP obligations requiring implementation by 10 June 2028.
The objective is not simply to understand where the organisation is today, but also whether it is on track to meet future implementation milestones and where implementation effort should be prioritised.
As the Enhanced Rules are progressively implemented, we believe this concept of readiness will become an increasingly important complement to traditional maturity assessment.
An important practical implication of the implementation timetable is that responsible entities will need to begin incorporating the first tranche of Enhanced CIRMP obligations into their CIRMP well before the 2027 implementation deadline. This will support the annual CIRMP attestation due on 28 September 2027, which will follow the commencement of the first implementation phase.
Conclusion
The Enhanced CIRMP Rules are not simply another regulatory update.
They provide an opportunity for Boards and executives to strengthen governance, build organisational capability and take a more strategic approach to protecting critical infrastructure.
Those organisations that use the implementation period to plan, prioritise and progressively uplift their security capability will be better positioned for both future compliance and long-term resilience.
Our next article examines the enhanced personnel security obligations introduced by section 9A and explores what they mean in practice.