Does the SOCI Act Catch You? Incident Duties and IT Buying

Zac Tassone

Published 19 October 2026 · Updated 22 October 2026

Most Sydney small businesses are not responsible entities under the Security of Critical Infrastructure Act 2018 (SOCI Act). Some are, though, and others supply businesses that are. The Cyber and Infrastructure Security Centre (CISC) publishes guidance on the mandatory cyber incident notification duties under the Act, and it is worth understanding if your sector, ownership structure or supply relationships could bring you close to scope. This post gives you a plain scoping test you can run on your own operations, even if you are new to SOCI compliance. It is a starting point, not legal advice.

You will start with why the guidance matters to Sydney operators and what the scoping test is and is not. Then you will work through four steps: sector fit, responsible entity status, supply relationships, and the significant or relevant impact test. You will also see when the reporting clock starts. We then cover how the rules have tightened through the Risk Management Program and the 2024 cyber security reforms, and what all this changes when buying managed IT. Finally, you will learn how to assess a managed security service provider, get confirmation before you commit, and make your next three moves.

Why the CISC’s Incident Notification Guidance Matters to Sydney Operators

The CISC, part of the Department of Home Affairs, administers the SOCI Act. Its Notification of Cyber Security Incidents guidance is the reference for reporting incidents under the Act. It covers what counts as a cyber security incident, how to judge a significant or relevant impact, when reporting is due, what a report must contain, and the consequences of late or no reporting.

Scope turns on sector, the specific assets you own or operate, and in some cases your supply relationships. That means a Sydney operator can be close to scope without ever thinking of itself as critical infrastructure, and equally, many businesses in a listed sector sit outside it. Read the guidance alongside the SOCI Act text, not in isolation. If duties apply to you, or to a customer who passes them on by contract, detection, logging and reporting become procurement criteria when you buy managed IT and security services.

Before You Start: What This Scoping Test Is and Is Not

This test is a self-assessment starting point, not a legal determination. The asset class definitions in the Act and its rules, and the impact test in the CISC guidance, govern, not this article.

Check the current wording of that guidance and the SOCI Act 2018 itself before acting. The Act has been amended several times since 2018, and asset classes and obligations can change.

Three terms recur:

• Critical infrastructure asset: an asset that falls within one of the asset classes defined in the Act or prescribed by the rules.
• Responsible entity: the entity the Act names as responsible for that asset, often its owner or operator, depending on the asset class.
• Cyber security incident: in broad terms, unauthorised access to, modification of, or impairment of computer data, programs, electronic communications or computers.

Where your honest answer is “maybe”, get legal or sector-specific advice. A documented, reasonable position beats an assumption.

Step 1: Does Your Sector Sit Inside a SOCI Asset Class?

The SOCI Act covers 11 sectors: communications, data storage or processing, financial services and markets, water and sewerage, energy, health care and medical, higher education and research, food and grocery, transport, space technology, and the defence industry. Within those sectors it defines specific asset classes, and the incident notification duty applies only to the asset classes the rules specify. The guidance lists them under Asset classes with notification of cyber security incidents obligation.

Being in a listed sector is not the same as owning a critical infrastructure asset. Many asset classes are defined by function and by thresholds set in the Act or rules, such as size, capacity or the services provided, so two businesses in the same sector can land on opposite sides of the line.

Ask three questions:

• What do you physically or digitally operate?
• Who depends on it?
• Would disruption be felt by a listed asset class, for example an energy, water, health care or data storage asset?

If you supply a business in a listed sector, for example hosting or data processing for a hospital group, record that answer now. It feeds directly into Step 3.

Step 2: Are You the Responsible Entity?

SOCI incident notification duties attach to the responsible entity for a critical infrastructure asset. The Act defines who the responsible entity is for each asset class, often the entity that holds the relevant licence or owns or operates the asset. If you are not the responsible entity, the notification duty generally sits with whoever is, although obligations may still reach you through contract.

Ask: do you own, operate, or both? Leases, outsourced operations and managed service arrangements complicate the answer, so read the documents rather than assume. Note that “direct interest holders” are a separate category under the Act with their own registration duties; holding an interest in an asset does not by itself make you the responsible entity.

For certain asset classes, responsible entities must also maintain a Risk Management Program and give the CISC an annual report on it, approved by their board or governing body. That obligation is covered later in this post.

If you contract or supply to a responsible entity, obligations often reach you through contract rather than statute. Contractual duties are still binding on you.

Record your conclusion with the date and the source you relied on, so the position can be revisited when the rules change.

Step 3: Could a Supply Relationship Pull You In?

Supplying a responsible entity does not, on its own, make you a responsible entity. There is one route where it can matter directly, though: the Act includes a data storage or processing asset class, which can capture providers that store or process business critical data as a service for the responsible entity of another critical infrastructure asset. The 2024 amendments also clarified that data storage systems holding business critical data can form part of a critical infrastructure asset itself. Whether either applies turns on detailed definitions, so confirm with the CISC or your adviser.

Supply chain is also a named hazard domain under the Risk Management Program, alongside cyber and information security, personnel, and physical and natural hazards. Responsible entities must manage risks in their supply chains, which is why suppliers get asked questions.

Map Your Dependencies

List upstream and downstream dependencies. For each, ask one question: if this fails, would a listed asset class or its operator be affected? Record yes, no or unclear.

The Contract Reality

In practice, compliance tends to travel down contract chains. Because responsible entities must manage supply chain risk and meet tight reporting deadlines, they often ask vendors and service providers to commit to notification, logging and reporting duties, whether or not the Act catches those suppliers directly.

If you supply managed IT, cloud or hosting to an in-scope operator, expect to be asked for evidence. That is where what a managed IT services provider actually does becomes a compliance question rather than a convenience one.

Step 4: Does the Incident Meet the Significant or Relevant Impact Test?

With your supply relationships mapped, the last gate is the incident itself. The Act distinguishes critical cyber security incidents, which have a significant impact on the availability of the asset, from other incidents that have a relevant impact on the asset’s availability, integrity, reliability or confidentiality. The CISC guidance explains both, and the category decides which deadline applies.

That test is not a technical severity score. Ask what the incident means for the asset and the essential goods or services it supports, not how alarming the alert looked. Draft your internal criteria using the guidance’s own wording, then convert them into a threshold document: who decides, on what evidence, and within what time. Keep the assessment record, because a documented, reasonable judgement is your best evidence later if the decision is questioned. Next, when does the clock start?

When Does the Clock Start? Becoming Aware, Timelines and Report Contents

The reporting clock starts when the responsible entity becomes aware of the incident, and the CISC guidance has a dedicated section on what “becoming aware” means. Read that section in full before relying on any summary, including this one.

At the time of writing, the guidance sets two timeframes: a critical incident with a significant impact must be reported within 12 hours of becoming aware, and an incident with a relevant impact within 72 hours. Where the first report is made orally, a written report must follow within a set period. Reports go to the Australian Signals Directorate’s Australian Cyber Security Centre. Confirm the current timeframes in the guidance before writing them into a policy.

The required report contents explain why logs, evidence and timestamped internal notes must exist before an incident. Late or missing reports are a compliance exposure separate from the incident. Our guide to cyber incident reporting in Australia covers the wider reporting landscape.

Awareness is therefore an operational process, not a legal technicality. Alerts sitting in an unattended queue or an after-hours inbox can delay the moment someone actually becomes aware, and make it harder to show when that moment was.

Why the Rules Are Tightening: The Risk Management Program and the 2024 Reforms

Awareness and timeframes explain the “what”. The “why” is a steadily tightening framework.

The Risk Management Program (RMP) rules, which took effect in 2023, require responsible entities for specified asset classes to adopt and maintain a written program covering four hazard domains: cyber and information security, personnel, supply chain, and physical and natural hazards. They must give the CISC an annual report approved by their board or governing body. Several of those domains reach into vendor relationships.

In late 2024, Parliament passed a cyber security legislative package. The Cyber Security Act 2024 introduced, among other things, mandatory reporting of ransomware payments for businesses above a turnover threshold set in the rules, and that duty is not limited to critical infrastructure. Companion amendments to the SOCI Act strengthened the government’s powers to respond to incidents and clarified how data storage systems are treated. Check the CISC and Home Affairs websites for the current position.

Direction of travel: governance, supply chain and evidence, not just technical controls. The ASD Essential Eight is a sensible baseline for the technical side.

What This Changes About Buying Managed IT

Contracting priorities shift once notification duties apply to you or your customers. The question stops being who answers the phone and becomes who can prove detection, logging and reporting inside your timelines.

Detection. Ask about monitoring coverage, alert triage hours, and how fast the provider escalates to a named person. With a 12-hour window for critical incidents, escalation speed matters.

Logging. Confirm retention period, tamper resistance and time synchronisation across cloud and on-premises systems. Then ask whether a report matching the guidance’s required contents can be produced without a manual scramble.

Reporting. Settle who drafts the notification, who approves it, and whether the provider commits to supporting a regulator request within a defined window.

Put all of it in the contract with service levels attached. That separates generic IT support from genuine incident notification capability.

How to Assess a Managed Security Service Provider (MSSP)

With escalation settled, compare a managed security service provider (MSSP) against four criteria: Australian data residency, monitoring coverage that matches your risk and timeframes, evidence of past incident response, and a named individual accountable for escalation.

Ask for the notification workflow in writing: the trigger, the decision-maker, the draft turnaround time, and who submits the report if you are in scope.

Test whether the provider will map its service to your asset class and impact test, or whether that work quietly stays with you.

An MSSP specialises in monitoring and response. A broader managed IT security agreement covers the systems that generate the logs. Many Sydney businesses need both, or one provider credible at both.

Zectron is a managed IT provider in Norwest serving the Hills district and greater Sydney. We provide 24/7 monitoring, with our helpdesk available Monday to Friday, 9am to 5pm, plus patching, security configuration and help keeping the records an incident report draws on.

Avoid the trap of buying a tool and calling it compliance. The obligation is about timelines and evidence, not licence counts.

Tips: Getting Confirmation Before You Commit

Before you sign, confirm rather than assume. Read the current CISC guidance and check the asset classes, reporting timeframes and impact test yourself, then write only what you have verified into any policy or supplier contract. If your honest answer on scope is “maybe”, confirm it with the Cyber and Infrastructure Security Centre or get legal or sector-specific advice, and record the reasoning and source so the position is defensible rather than accidental.

Next, review every provider contract for notification clauses, log retention periods and audit rights, and align them to the duties you identified in the scoping test. Re-run that test annually, and again after any change of ownership, operations or major supplier, because scope can change.

Finally, keep one register: asset, sector, responsible entity role, key dependencies, notification obligations, and the source you relied on. That single document turns compliance from guesswork into evidence you can produce on request.

Your Next Three Moves

With your register started, here are three moves to make this week.

1. Run the four gates. Work through asset class, responsible entity role, supply relationships and the impact test in that order. Write the answer to each, even where it is unclear.

2. Fix awareness before anything else. The reporting clock begins when you become aware, so read how the guidance defines that moment, then route alerts to a named person with out-of-hours cover so it is not delayed.

3. Convert duties into contracts. Turn the guidance’s required report contents into terms for your managed IT security services: escalation, log retention and draft turnaround, each with a service level attached.

SOCI scope is a moving target, so treat it as a repeatable process rather than a one-time answer. Choose a provider that can evidence detection, logging and reporting, not uptime alone. Whether or not the Act applies to you, the same habits will help with every other incident reporting duty you face.

Talk to Zectron. Our Norwest team can review your monitoring, logging and incident response setup and recommend next steps. Book a free IT Health Check or call 1300 133 770.