Thinking

A supply chain is only as strong as its weakest known link Australia’s critical infrastructure sectors depend on complex and interlinked supply chains that now sit at the centre of national resilience. This article describes an eight-step framework for risk-based supply chain mapping and categorisation aligned with theSecurity of Critical Infrastructure Act 2018 (SOCI Act) and its […]

The challenge of identifying critical workers Across Australia’s critical infrastructure sectors, one of the most persistent challenges in implementing the Security of Critical Infrastructure Act 2018 (SOCI) and its subordinate Rules has been identifying and managing critical workers – those individuals whose absence, compromise, or misconduct could disrupt essential services or cause significant harm to the operations of

Despite years of investment in cyber security policies, controls and monitoring, insider threats remain one of the toughest risks to manage.  Firewalls and detection tools can block opportunity, but they cannot eliminate people’s intent.  At the heart of the issue is not just cyber security systems, but people. What drives employee behaviour is often nested in the psychological

Foreign interference: an identified and recognised threat Australia’s intelligence and security community has delivered an unequivocal warning.  In the 2024 Annual Threat Assessment, ASIO Director-General Mike Burgess stated that espionage and foreign interference sit at CERTAIN – the highest level on the scale.  By 2025, ASIO assessed that hostile regimes were increasingly willing to disrupt or destroy critical infrastructure to impede

Prologue Environmental, Social, and Governance (ESG) is now a decisive force in investment and corporate strategy.  The Global Sustainable Investment Review 2022 reported that ESG investing has captured more than US$30 trillion in assets. Setting aside debates about ideology and contemporary drivers, ESG’s practical purpose is to balance risk and return in external investment choices, while

August 2025 marks the second anniversary of the Critical Infrastructure Risk Management Program (CIRMP) requirements under the Security of Critical Infrastructure Act 2018 (SOCI Act).  Over the past two years, Australia’s critical infrastructure sectors have worked hard to embed CIRMPs as structured, proactive approaches to managing four key hazard vectors: cyber and information security, personnel, supply chain, and physical