Who makes the suitability decision, who owns the risk, and how ongoing assurance should work in practice
On 10 June 2026, the Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (the Enhanced CIRMP Rules 2026) commenced, introducing a significant uplift in the security requirements applying to affected responsible entities.
The Enhanced CIRMP Rules 2026 amend the Security of Critical Infrastructure (Critical Infrastructure Risk Management Program) Rules 2023 (the CIRMP Rules 2023), made under the Security of Critical Infrastructure Act 2018 (the SOCI Act). Those amendments are now incorporated into the current CIRMP Rules.
For personnel security, section 9A is central to the Enhanced Rules. It introduces enhanced requirements for access management, critical worker suitability and ongoing personnel assurance, with implementation staged across 10 June 2027 and 10 June 2028.
Suitability is directly linked to access
Section 9A creates a direct relationship between critical worker suitability and access to critical components.
Subsection 9A(2) establishes the access management foundation, requiring responsible entities to manage material risks associated with unauthorised or unsupervised access, credentials and privileged access, non-critical workers, and incoming and outgoing critical workers.
Subsection 9A(3) then establishes the conditions under which a critical worker may be permitted access to critical components. A critical worker may be permitted access where they have been assessed as “suitable” under subsection 9A(4), or where they traverse the risk-managed pathway in subsection 9A(3)(a)(ii).
Identification as a critical worker does not itself authorise access. The responsible entity must determine whether the applicable requirements for access have been met and whether the proposed access is appropriately managed. The key question for responsible entities is:
Is there sufficient assurance to permit this critical worker the access required for the role, having regard to the security risks associated with that access?
The answer will depend on the role, the nature and level of access, and the potential consequences if that access is misused or compromised.
The Explanatory Statement to the Enhanced CIRMP Rules 2026 reinforces this connection. It describes subsection 9A(3) as ensuring the suitability of the critical workforce before access to critical components is granted, while paragraph 9A(3)(b) requires responsible entities to proactively monitor developments or changes that may affect ongoing suitability. It also makes clear that these requirements establish a minimum standard rather than replacing broader organisational suitability and HR practices.
This creates an ongoing obligation. Changes in the individual’s circumstances, role, access or threat environment may require the responsible entity to reconsider whether the existing level of assurance remains sufficient to permit access.
Critical workers without direct access to critical components
Not every critical worker will necessarily require direct access to a critical component. Under the statutory definition in section 5 of the SOCI Act, an individual may be a critical worker because they have access to, or control and management of, a critical component, provided the other elements of the definition are also met. A person may therefore be critical because of their control or management responsibilities even where direct access is not operationally required.
In those circumstances, the access gate in subsection 9A(3)(a), and the prescribed suitability pathways in subsection 9A(4), do not operate in the same way because the responsible entity is not permitting the individual access to a critical component.
Paragraph 9A(3)(b), however, is expressed more broadly. It requires the responsible entity to proactively monitor, identify and take action in relation to developments or changes that may affect the ongoing suitability of a critical worker.
Responsible entities should therefore consider how proportionate, role-based organisational suitability arrangements will apply to critical workers whose control and management responsibilities create material personnel security risk, even where direct critical-component access is not required.
Three pathways to critical component access
Against this background, section 9A provides three practical pathways through which a critical worker may be permitted access to critical components:
- AusCheck + responsible entity suitability assessment
- Relevant security clearance — NV1+
- CIRMP risk-managed pathway.
These pathways differ in terms of:
- the assurance or risk treatment they rely on
- who makes the relevant determination
- what responsibility remains with the responsible entity.
The table below summarises those distinctions.
| Pathway | What it establishes | Who makes the key determination? | What remains with the responsible entity? | Ongoing suitability assurance |
| AusCheck + responsible entity suitability assessment | Prescribed government background check information supporting the organisational suitability decision | AusCheck provides the CIBCO; the responsible entity makes the subsection 9A(4)(a) suitability decision | Operational need, access authorisation and management of organisation, role, access and asset risk, and repeat AusCheck requirements | Ongoing suitability under 9A(3)(b) + repeat AusCheck at least every five years where ongoing critical component access is required |
| Relevantsecurity clearance — NV1+ | An active relevant Australian Government security clearance satisfying the prescribed 9A(4)(b) route | AGSVA determines eligibility and suitability to hold the security clearance | The responsible entity still determines operational need, access conditions and authorisation, and manages its CI asset and access risk, and oversees clearance currency, including ensuring revalidation or transition before lapse or expiry | Clearance maintenance and revalidation + responsible entity’s ongoing suitability obligation under 9A(3)(b) |
| CIRMP risk-managed pathway | A documented risk assessment and treatment basis for access where subsection 9A(4) cannot be met. It does not constitute a subsection 9A(4) suitability finding. | The responsible designs the risk assessment process andmakes the personnel risk and access decision | The responsible entity manages the personnel, access and asset risk and the effectiveness of the controls relied upon | Organisation-designed monitoring and review against the original risk, controls and changing circumstances |
1. AusCheck background check + responsible entity suitability assessment
Under subsection 9A(4)(a), the critical worker must first undergo an AusCheck background check. AusCheck then issues a Critical Infrastructure Background Check Outcome (CIBCO), which records the outcome of the prescribed checks.
Objective of the AusCheck background check: to provide prescribed government background check information that helps the responsible entity assess whether a critical worker is suitable to access critical infrastructure. The Explanatory Statement links the background check requirement to mitigating personnel hazards and protecting critical infrastructure, national security, public safety and economic stability.
What AusCheck assesses: prescribed information including relevant criminal history, ASIO security assessment information, identity and, where relevant, work rights. The resulting CIBCO provides this information to support the responsible entity’s decision-making.
AusCheck does not determine whether the worker is suitable for the role or whether access to critical components should be granted. It is one of the information inputs for the decision maker.
Following completion of the AusCheck background check, the responsible entity must make its own suitability assessment, having regard to the matters in subsection 9(5) of the CIRMP Rules.
Objective of the responsible entity’s suitability assessment: to determine whether the individual is suitable to have access to the organisation’s critical components in the context of the organisation, the role and the proposed access.
What the responsible entity must consider: the AusCheck advice, whether permitting the worker access to critical components would be prejudicial to security, and any other information that may affect the person’s suitability to have that access.
In practice, this is where organisation-specific and role-specific personnel security risks should be brought into the decision. This approach provides the organisation with the opportunity to determine whether the available assurance is sufficient and whether any remaining risk associated with the proposed access is appropriately controlled.
The responsible entity therefore makes the section 9A suitability decision and remains responsible for the access decision and associated security risk.
For workers requiring ongoing access to critical components, the AusCheck background check must be repeated at least every five years.
2. Relevant security clearance
Under subsection 9A(4)(b), a critical worker may be assessed as suitable where they hold a relevant active security clearance at Negative Vetting level 1 (NV1) or higher at the time they are identified as a critical worker. A worker relying on this pathway does not also need to undergo an AusCheck background check for the purposes of section 9A.
For critical infrastructure organisations, this is the Australian Government Security Vetting Agency (AGSVA) security clearance pathway.
Objective of the security clearance: to determine whether an individual is eligible and suitable to hold the required Australian Government security clearance, providing confidence in their ability to protect Australian Government resources and resolving any doubt in the national interest.
What the security clearance assesses: a whole-person assessment based on relevant, reliable and independently verified information and defined adjudicative risk factor areas. These include external loyalties, influences and associations; personal relationships and conduct; financial considerations; alcohol and drug usage; criminal history and conduct; security attitudes and violations; and mental health disorders.
This is therefore a substantially broader and different assurance framework from an AusCheck background check.
That breadth should be understood in context. The AGSVA security clearance framework is designed to determine whether an individual is eligible and suitable to hold an Australian Government security clearance and can be trusted to protect Australian Government resources, with suitability considered against national interest security risks.
The AGSVA security clearance is not an assessment of the responsible entity’s particular critical infrastructure asset, operating environment, role design, access architecture or organisational risk appetite. A responsible entity should therefore interpret the assurance provided by the clearance through the lens of its own enterprise, role and access specific security risks, and determine what organisation-specific controls and assurance are still required.
Holding the required security clearance satisfies the section 9A suitability pathway, but does not itself grant access to the organisation’s critical components. The responsible entity still determines whether access is operationally required, what level of access is appropriate, and how that access is authorised and controlled through its access management arrangements.
The responsible entity therefore retains the access decision and responsibility for managing the security risk associated with that access, even though the underlying suitability assurance is provided through the AGSVA security clearance framework.
The responsible entity must also have a process to ensure that, before the clearance lapses or expires, the worker either undergoes clearance revalidation or transitions to the AusCheck pathway and is assessed as suitable by the responsible entity.
3. CIRMP risk managed pathway
Subsection 9A(3)(a)(ii) provides an alternative where a critical worker is unable to meet the requirements of subsection 9A(4). In those circumstances, access to critical components may still be permitted where the responsible entity has outlined in its CIRMP:
- the risk associated with the worker’s employment; and
- the actions taken, or to be taken as soon as reasonably practicable, to minimise or eliminate the risk to the asset.
The Explanatory Statement identifies offshore workers and delays in obtaining an AusCheck background check or relevant security clearance as examples of circumstances in which this pathway may be used. It describes the approach as one of risk assessment and risk minimisation or elimination.
Objective of the risk-managed pathway: to enable the responsible entity to make and manage an access decision where the subsection 9A(4) suitability requirements cannot be met. It gives the responsible entity the opportunity to tailor its assessment to the enterprise, asset, role and access-specific security risks, and to determine what controls are required to minimise or eliminate the risk to the asset.
What it assesses: the personnel security risk associated with the worker’s employment and proposed access, the assurance that is available, any gaps or uncertainty in that assurance, the potential consequences if the worker or their access were compromised, and the controls available to manage that risk.
In practice, a mature assessment should also consider the residual risk remaining after controls are applied, determine whether that risk can be accepted under the organisation’s existing risk governance arrangements, and establish how the risk will be monitored and reviewed while access continues.
Importantly, this pathway does not result in the worker being assessed as suitable under subsection 9A(4). The responsible entity is instead making a documented personnel security risk and access decision, supported by appropriate controls and ongoing oversight.
The three pathways can all support access to critical components, but they are fundamentally different in purpose, scope and assurance. They assess different information and risk factors, rely on different decision makers, and involve different forms of assurance and risk treatment. The responsible entity must therefore understand what each pathway establishes, what it does not establish, and what organisation-specific assurance is still required.
This is particularly important for ongoing suitability. A responsible entity needs an organisational framework capable of bringing these different sources of assurance back into the context of its own enterprise, role and access risks, evaluating any remaining risk, and maintaining confidence in the access decision over time.
One continuing obligation across the critical workforce: ongoing suitability
The three pathways support access through different forms of assurance and risk treatment at the point a critical worker is permitted access to critical components. Paragraph 9A(3)(b), however, creates a continuing obligation that applies across the critical workforce.
Responsible entities must establish and maintain a process or system in their CIRMP to proactively monitor, identify and take action in relation to developments or changes that may affect the ongoing suitability of a critical worker.
The significance of this requirement goes beyond periodic rechecking. The initial pathway
establishes the basis on which access is permitted. Ongoing suitability requires the responsible entity to maintain confidence that the trust decision remains justified as circumstances change.
That change can occur at several levels:
- Enterprise and threat environment. New threat intelligence, geopolitical developments, changes to the operating environment or emerging patterns of insider risk may alter the significance of circumstances that were previously considered acceptable.
- Role and access. A critical worker may move roles, gain additional privileges, assume greater authority, obtain remote or offshore access, or become responsible for different critical components. The person may be unchanged while the consequence associated with their access has materially increased.
- Individual circumstances and behaviour. Changes in personal circumstances, conduct, security behaviour, external relationships, financial pressures, reportable events or other relevant information may alter the assurance available to the organisation.
This is why ongoing suitability should be understood in the context of enterprise risk, role and access risk, and individual assurance. A change at any one of these levels may require the responsible entity to revisit the original access decision.
The practical implication is important: the responsible entity needs a mechanism capable of recognising relevant change, bringing information together, determining whether the change affects the risk associated with the worker’s access, and taking proportionate action where required.
Ongoing suitability does not operate the same way under each pathway
Paragraph 9A(3)(b) applies across the critical workforce, but the mechanisms available to support ongoing suitability differ significantly depending on the pathway through which access was permitted.
1. AusCheck pathway
For critical workers relying on the AusCheck pathway, subsection 9A(5)(c) requires a new AusCheck background check at least every five years where the person requires ongoing access to critical components.
That five-year requirement is important, but it should not be confused with the broader obligation in paragraph 9A(3)(b). Five years is the maximum statutory interval for repeating one background check mechanism; it is not the interval at which the organisation should reconsider ongoing suitability.
The CIBCO framework does provide some continuing inputs and relies on self-reporting. For example, a person who has been granted access to a critical infrastructure asset must notify AusCheck within seven days if they are convicted of a security-relevant offence, and CIBCO holders are expected to keep relevant personal details current.
The scope of those mechanisms remains narrower than the organisation’s ongoing suitability obligation. Changes in role, access, workplace conduct, security behaviour, external circumstances or the threat environment may all become relevant well before a repeat AusCheck background check is due.
For responsible entities using this pathway, the practical implication is clear: the AusCheck cycle needs to sit within a broader organisation-specific ongoing suitability process capable of identifying relevant change and reassessing whether the original suitability and access decision remains appropriate.
2. AGSVA security clearance pathway
The AGSVA pathway is different because Australian Government security clearances already sit within a much more developed ongoing assurance framework.
The PSPF expressly recognises that a security clearance is based on a point-in-time assessment and that the reliability of that assessment begins to decay from that point. Ongoing security management is therefore required to maintain confidence in the clearance holder’s eligibility and suitability.
The framework distributes responsibilities across AGSVA, the sponsoring entity and the clearance holder. Sponsoring entities are required to actively assess, monitor and manage ongoing suitability, monitor clearance maintenance obligations and conduct annual security checks. Clearance holders have reporting obligations for changes in circumstances that may affect their suitability, while concerns can trigger an AGSVA review for cause and, ultimately, formal revalidation.
This provides substantially more ongoing assurance than a periodic background check alone. It does not, however, remove the responsible entity’s section 9A obligation.
The security clearance framework is concerned with the person’s continuing eligibility and suitability to hold the Australian Government security clearance. The responsible entity still needs to understand whether the worker’s role, access and organisational risk remain appropriate within its own critical infrastructure environment.
This distinction becomes especially important where the responsible entity is relying on a clearance sponsored or maintained through another arrangement (i.e. the responsible entity is not the clearance holder’s sponsor). In practice, the organisation needs confidence that the clearance remains active and appropriate, that relevant maintenance obligations are being met, and that material information affecting the worker’s access can be identified and acted upon through appropriate governance arrangements.
Subsection 9A(6) reinforces this responsibility by requiring the responsible entity to ensure that, before the clearance lapses or expires, the worker either undergoes revalidation or transitions to the AusCheck pathway and is assessed as suitable by the responsible entity.
3. CIRMP risk-managed pathway
The risk-managed pathway presents a different challenge again. There is no equivalent external background check cycle or security-clearance maintenance framework supporting the ongoing decision.
The responsible entity therefore needs to design the ongoing assurance mechanism itself.
That mechanism should remain connected to the basis on which access was originally permitted: the identified personnel security risk, the available assurance, any gaps or uncertainty, the controls applied and any residual risk accepted by the organisation.
As circumstances change, the organisation needs to be able to ask whether those assumptions still hold. A change in role, expansion of access, change in the threat environment, new security information, behavioural concerns, failure of a compensating control or new information about the individual may all require the risk assessment and access decision to be revisited.
Across all three pathways, the practical objective is the same: the responsible entity needs enough current and relevant information to determine whether the trust supporting critical component access remains justified.
The difference is in how much of that ongoing assurance is provided externally, how much must be generated within the organisation, and how those sources of information are brought together into a defensible decision.
Ongoing suitability and insider threat
Paragraph 9A(3)(b) does not expressly require a responsible entity to establish an insider threat program. Its requirement to proactively monitor, identify and take action in relation to developments or changes affecting ongoing suitability does, however, intersect closely with capabilities typically associated with an effective insider threat program.
The Commonwealth’s Protective Security Policy Framework (PSPF) provides a useful point of comparison. Requirement 51 of the PSPF requires entities that manage Baseline to Positive Vetting security clearance subjects to implement an insider threat program to manage insider risk. The PSPF describes an effective program as holistic and coordinated, bringing together security governance, personnel security, security culture and awareness, access controls, physical and ICT security controls, and review, reporting and response processes.
For SOCI responsible entities outside the PSPF, Requirement 51 does not itself become a section 9A obligation. It does, however, raise an important implementation question:
Where a responsible entity subject to the Enhanced CIRMP requirements relies on relevant AGSVA security clearances at NV1 or higher for critical workers, does CISC expect an insider threat program, or equivalent integrated personnel security arrangements, to form part of satisfying paragraph 9A(3)(b)? To what extent may the responsible entity rely on existing security clearance maintenance, sponsor reporting and ongoing suitability arrangements, and what organisation-specific capability is still expected?
Pentagram’s view is that, irrespective of terminology, responsible entities will need an integrated personnel security capability that can identify relevant change, bring together information from across organisational functions, assess its significance in the context of enterprise, role and access risk, escalate concerns appropriately, and support proportionate action.
From requirement to implementation: building a defensible critical worker suitability and assurance framework
The implementation objective should be to understand what the organisation already has, then retain, validate, strengthen, expand or establish the capabilities required to create one coherent personnel security architecture.
At a high level, implementation should deliver eight connected outcomes, moving from current state and risk context through to suitability, access, ongoing assurance and governance.
1. Confirm the current state, governance and priority gaps.
Practical output: current state assessment, governance model and prioritised gap register.
2. Anchor personnel security in enterprise and asset risk.
Practical output: agreed personnel security risk context and risk criteria.
3. Validate critical workers and operational access need.
Practical output: validated Critical Worker Register and access/operational-need mapping.
4. Translate role and access risk into organisational suitability criteria.
Practical output: role-risk model and documented organisational suitability framework.
5. Map each critical worker to the appropriate assurance and access pathway.
Practical output: critical worker assurance pathway map and access conditions.
6. Define decision rights for suitability, access and personnel security risk.
Practical output: decision rights and risk ownership model.
7. Embed ongoing suitability across the workforce lifecycle.
Practical output: ongoing suitability and workforce lifecycle framework.
8. Maintain assurance currency, evidence and governance.
Practical output: assurance calendar, evidence framework, governance reporting and implementation roadmap.
What does “suitable” mean in practice?
Section 9A does not create a single universal measure of suitability. The three pathways to critical component access rely on different forms of assurance and risk treatment, developed for different purposes and against different risk frameworks.
For the responsible entity, the enduring task is to bring that assurance back into the context of its own enterprise risk, role, access and critical infrastructure environment, and to keep the decision current as circumstances change.
Ultimately, the Board-level question is:
Do we have sufficient, current and relevant assurance to continue trusting this person with this role, authority and access – and can we demonstrate who made that decision, who owns the risk and what would cause us to reconsider it?