Thinking

On 10 June 2026, the Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (Enhanced CIRMP Rules 2026) commenced, introducing a significant uplift in the way affected responsible entities must understand and manage supply chain risk. The Enhanced CIRMP Rules 2026 amend the Security of Critical Infrastructure (Critical Infrastructure Risk Management Program) Rules 2023 (CIRMP Rules 2023) made under the Security of Critical […]

Many responsible entities have now completed their initial review of the Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (Enhanced CIRMP Rules 2026) and are beginning to consider what the additional legislative obligations mean for their organisations. Understanding the new requirements is an important first step. For Boards and senior executives, however, the

On 10 June 2026, the Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (Enhanced CIRMP Rules 2026) commenced, introducing the most significant expansion of Australia’s Critical Infrastructure Risk Management Program (CIRMP) framework since the Security of Critical Infrastructure (Critical Infrastructure Risk Management Program) Rules 2023 (CIRMP Rules 2023) came into effect. The Enhanced Rules introduce 78 additional legislative

Trust, bias and the challenge of managing human risk in critical infrastructure. Introduction Most Boards and executive teams are now accustomed to discussing cyber security, supply chain disruption, regulatory compliance and operational resilience. These risks are longstanding and hence familiar. They appear on risk registers, in audit reports, in regulatory briefings and in executive dashboards.