What Boards and senior executives should prioritise ahead of the 10 June 2027 and 10 June 2028 implementation milestones
On 10 June 2026, the Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (the Enhanced CIRMP Rules 2026) commenced, introducing a significant uplift in the security requirements applying to affected responsible entities.
The Enhanced CIRMP Rules 2026 amend the Security of Critical Infrastructure (Critical Infrastructure Risk Management Program) Rules 2023 (the CIRMP Rules 2023), made under the Security of Critical Infrastructure Act 2018 (the SOCI Act). Those amendments are now incorporated into the current CIRMP Rules.
For personnel security, the most significant change is section 9A. It introduces enhanced requirements for access management, critical worker suitability and ongoing personnel assurance, with implementation staged across 10 June 2027 and 10 June 2028.
Building on the section 9 personnel security foundation
For most responsible entities, the starting point is not a blank page. Organisations already make daily decisions about who they employ or engage, what access people require, how suitability and conduct are managed, and how access changes as people move through or leave the organisation.
Since the CIRMP Rules commenced in 2023, responsible entities have also been building and implementing the personnel security arrangements required under section 9, including identifying critical workers, assessing suitability for access to critical components, managing risks arising from malicious or negligent personnel, and addressing offboarding. Section 9A, introduced by the Enhanced CIRMP Rules 2026, builds on that baseline foundation.
In many organisations, the individual building blocks of an enterprise personnel security architecture already exist. HR and recruitment teams manage screening and employment processes. People and Culture / HR business partners support managers across the workforce lifecycle, including role changes, conduct, wellbeing and organisational change. Securitymanages physical access. Cyber and IT manage identities, credentials and privileged accounts. Procurement and contract managers oversee suppliers and contractors. Line managers observe performance, behaviour and changing circumstances.
The implementation challenge is whether these arrangements operate together as a coherent, risk-based and evidence-supported enterprise-level personnel security capability that meets the enhanced requirements and provides confidence that personnel security risks are being effectively managed today as the operating and threat environment changes.
What section 9A adds to personnel security
Section 9A introduces greater structure and specificity to how access, critical worker suitability and ongoing personnel assurance are governed, implemented and demonstrated.
Pentagram’s analysis identified 16 additional personnel security obligations under the Enhanced Rules, 14 of which are expressed as “must” requirements. By comparison, 5 of the 9 baseline personnel security obligations are “must” requirements. The shift brings more prescribed minimum processes, controls and assurance requirements that affected responsible entities must establish and maintain.
The enhanced requirements operate across two connected areas.
First, subsection 9A(2) strengthens access management by requiring processes or systems to address unauthorised or unsupervised access to critical components, compromise or misuse of credentials and privileged access, access to the CI asset by people who are not critical workers, and risks associated with incoming and outgoing critical workers.
Second, the remaining section 9A requirements strengthen critical worker suitability and ongoing assurance. For critical workers requiring access to critical components, the Enhanced Rules establish more defined suitability pathways, require responsible entities to proactively identify and act on changes that may affect ongoing suitability, and introduce requirements for maintaining the currency of AusCheck background checks or relevant government security clearances.
The practical effect is significant. Personnel security increasingly needs to operate as a lifecycle capability: beginning with the role and operational need for access, continuing through critical worker identification and suitability assessment, and extending through access authorisation, ongoing suitability monitoring, role changes and eventual removal of access.
For Boards and senior executives, section 9A therefore raises the level of assurance expected from the organisation. Management needs to be able to show how these decisions connect, who owns them, which personnel security risks they address, what evidence supports them, and how the arrangements remain effective as people, roles, access, assets and suppliers change over time.
Section 9A does not operate in isolation. Its personnel security requirements intersect with other Enhanced CIRMP requirements, including the additional material risks in section 6A, particularly offshore or remote access to critical components; the credential and access controls in section 8B, where applicable; and the physical access and all hazards requirements in section 11A. Supply chain arrangements under section 10A may also be relevant where suppliers or third party personnel have access to critical components. Together, these requirements reinforce the need to manage people, access, technology, physical security and third party dependencies as an integrated security system.
Two implementation horizons — one personnel security architecture
Section 9A is deliberately staged. For in-scope assets that were already critical infrastructure assets when the Enhanced Rules commenced, subsection 9A(2) must be implemented by 10 June 2027, with the remaining section 9A requirements applying from 10 June 2028. Assets becoming critical infrastructure assets later receive equivalent 12- and 24-month implementation periods.
These should be treated as two milestones within one implementation program, rather than separate projects. Decisions made for 2027 around governance, access, critical worker identification and workforce lifecycle processes will shape the organisation’s ability to implement the more prescriptive suitability and ongoing assurance requirements that follow in 2028.
The practical priority is therefore to design the 2027 foundation with the 2028 end state already in view.
Start with risk: enterprise → role → individual
A defensible personnel security architecture should begin with risk, rather than with a list of screening checks. Pentagram recommends connecting three levels of assessment:
- Enterprise risk: What threats, vulnerabilities and potential consequences matter to the organisation and its critical infrastructure?
- Role or position risk: What risk exposure does the position create through its access, authority, privilege and potential consequence if compromised?
- Individual suitability: What information and level of assurance are then relevant to determining whether an individual is suitable for that particular role?
This approach is consistent with AS 4811:2022 Workforce screening, which recommends that workforce screening risk management be integrated into organisational management and decision making, recognise the dynamic nature of human behaviour and culture, and apply a level of screening commensurate with the risk posed by the particular role.
Its risk assessment framework also distinguishes between risks to organisational objectives and risks associated with the individual candidate.
The practical question is: What personnel security risks matter to our organisation, which roles create the greatest exposure, and what level of workforce assurance is proportionate to that risk?
10 June 2027: build the access management and workforce lifecycle foundation
The first implementation milestone focuses on access management. By 10 June 2027, for assets subject to the 12-month transition period, subsection 9A(2) requires responsible entities to establish and maintain a process or system in their CIRMP to manage material risks associated with unauthorised or unsupervised access to critical components; compromise or misuse of credentials and privileged access; access to the CI asset by people other than critical workers; and incoming and outgoing critical workers.
A useful implementation distinction is to think about two layers of access.
- Access to the CI asset is the broader security perimeter. It may involve employees, contractors, suppliers, vendors and other people who are not critical workers. Access should have a legitimate business or operational need, be appropriately authorised and controlled, and be reviewed when circumstances change.
- Access to critical components is the higher assurance layer. Here, organisations need particular visibility over unauthorised or unsupervised access and, where the individual is a critical worker, the more prescriptive suitability requirements that apply from 2028.
This distinction matters because the population with some form of access to the CI asset may be substantially larger than the population requiring access to critical components. Applying one undifferentiated access model can result in excessive controls for some people and insufficient assurance around the people and access that matter most.
That makes operational need an important starting point. Before deciding what controls or personnel assurance should apply, organisations should be able to answer: Why does this person need access, to what, at what level, for how long, and could the function be performed with less access?
Access should therefore be considered across its practical characteristics:
- What: is being accessed
- How: physically, logically or remotely
- Level: privileged or unprivileged
- Authority: authorised or unauthorised
- Oversight: supervised or unsupervised; accompanied/escorted where relevant
- Duration: ongoing, temporary or emergency/exceptional
Against that foundation, the key implementation priorities for 10 June 2027 are to:
- Establish a documented personnel security governance framework, with clear ownership, responsibilities, decision rights and accountabilities.
- Confirm the in-scope CI assets and critical components that form the basis for access and personnel security decisions.
- Define and document access and operational need, including physical, logical, remote, privileged, supervised and temporary access.
- Map current and required access: who has or requires access, what they can access, why it is required, and the characteristics of that access.
- Review and validate the Critical Worker Register against the current statutory definition, while keeping proposed SOCI Act reforms under review. The 2026 reform proposals remain proposals rather than current law.
- Define and implement access management controls appropriate to the two access layers, including arrangements for supervised, temporary and exceptional access.
- Strengthen identity, credential and privileged access management, including how access is approved, reviewed, modified and removed.
- Embed workforce lifecycle security for incoming and outgoing critical workers, including onboarding, transfers and role changes, changes in access, and offboarding.
By June 2027, the organisation should have a governed and repeatable way of connecting people, roles, operational need, access and critical components, with access changing when the underlying need or risk changes.
For Boards, the assurance question is: Do we know who can access our CI assets and critical components, why they need that access, how it is controlled, and whether our processes will identify in a timely manner when that access should change or end?
Who is actually a critical worker?
Critical worker identification remains one of the more challenging and judgement intensive parts of the CIRMP framework. The SOCI Act sets a specific statutory test, but the responsible entity must apply that test within the context of its own assets, critical components and operations.
Under the current definition in section 5 of the SOCI Act, an individual is a critical worker only where all three conditions are satisfied:
- they are an employee, intern, contractor or subcontractor of the responsible entity
- their absence or compromise would prevent the proper functioning of the asset or could cause significant damage to it, as assessed by the responsible entity, and
- they have access to, or control and management of, a critical component.
A practical method starts with positions and functions, then applies the statutory test to the individuals occupying them:
- map the critical components first
- identify the roles that interact with them
- understand the access or control and management those roles carry
- assess the potential consequence if the person occupying the role were absent or compromised.
Criticality therefore should not be inferred from seniority, job title or general organisational importance. Equally, access to the broader CI asset does not automatically make someone a critical worker. The determination needs a documented rationale that can be applied consistently across employees, contractors and subcontractors.
The resulting Critical Worker Register should be treated as a living assurance record, linked to roles, critical components and access arrangements, and revisited when people, roles, systems, suppliers or access change.
10 June 2028: build the suitability and ongoing assurance regime
The second implementation horizon builds on the access management foundation established for 2027 and focuses more directly on critical worker suitability and ongoing assurance.
For critical workers requiring access to critical components, section 9A provides three practical pathways before access can be permitted:
- AusCheck background check + responsible entity suitability assessment: the background check is an input; the responsible entity must still make its own suitability decision, having regard to the matters in subsection 9(5).
- Relevant security clearance. A critical worker who holds a relevant active Australian Government security clearance at NV1 or higher at the time they are identified as a critical worker can meet the prescribed suitability requirement through that pathway.
- The CIRMP risk managed pathway. Where a critical worker is unable to meet the subsection 9A(4) requirements, the CIRMP must identify the personnel risk and the actions taken, or to be taken as soon as reasonably practicable, to minimise or eliminate the risk to the asset.
Importantly, the 2028 requirements extend beyond the decision made before access is granted. Responsible entities must proactively monitor developments or changes that may affect a critical worker’s ongoing suitability and maintain the currency of the assurance relied upon.
The Explanatory Statement describes these requirements as establishing a minimum standard for critical workers with access to critical components, while recognising that organisations will continue to apply their broader HR and personnel security practices.
The key implementation priorities for 10 June 2028 are to:
- Confirm the critical workers requiring access to critical components and identify the applicable suitability pathway for each.
- Establish a documented suitability and access authorisation process so the required assessment occurs before critical component access is granted.
- Implement the prescribed suitability pathways: AusCheck followed by the responsible entity’s organisational suitability assessment, or a relevant active security clearance at NV1 or higher.
- Establish the documented risk managed pathway for circumstances where a critical worker is unable to meet the subsection 9A(4) requirements, including the personnel risk and the actions taken or planned to minimise or eliminate risk to the asset.
- Establish ongoing suitability arrangements to proactively identify and act on developments or changes that may affect the suitability of critical workers.
- Maintain the currency of assurance: repeat AusCheck at least every five years for workers requiring ongoing critical component access, and ensure relevant security clearances are revalidated before they lapse or expire, or transition the worker through the AusCheck and organisational suitability pathway.
- Maintain evidence and assurance records demonstrating how critical worker status, suitability, access decisions, ongoing monitoring and reviews are managed through the CIRMP.
One point is particularly important: an AusCheck background check does not, by itself, determine that a person is suitable. Where the AusCheck pathway is used, the responsible entity must subsequently assess the individual as suitable, having regard to the matters prescribed under subsection 9(5). The suitability decision remains with the responsible entity.
For Boards, the assurance question is: Can management demonstrate that every critical worker requiring access to a critical component has an appropriate and current suitability pathway, and that changes affecting suitability will be identified, assessed and acted upon over time?
Building the architecture around the enterprise
Section 9A should be implemented as part of the organisation’s broader personnel security capability, connecting risk, roles, access, critical worker identification, suitability and ongoing assurance.
Implemented well, section 9A can strengthen more than compliance. It can support a more mature Trusted Workforce capability, providing assurance around the trust organisations grant to employees, contractors and third parties with access to their most critical assets, systems and information – their organisational “crown jewels”.
The greater the level of access and potential consequence, the stronger the assurance around that trust should be.