Signed, sealed, exposed?

The Australian Securities and Investments Commission (ASIC) has issued an unambiguous message to the market: “Do not wait for perfect clarity to address the threat posed by new AI models. Instead, act now, and act with discipline, to strengthen the cyber resilience fundamentals that underpin your business.”

Regulators are now looking for demonstrable, sustained capability – not isolated tools, platforms or dashboards, but systems and end-to-end processes that work together.

While there are ‘only’ four enhanced cyber requirements (and none of them are small), meeting them demands a step change in control maturity, and a fundamental rethink of how IT and operational technology environments are separated.

At the centre of this sits the Critical Infrastructure Risk Management Program (CIRMP). In plain terms, a CIRMP is a board-approved plan that sets out how an organisation identifies and manages its most material risks, including cyber. It must be reviewed at least annually, signed off by the CEO and submitted to government.

Cybersecurity, operational resilience and executive oversight are now bound together in a single, accountable framework.

Here’s what’s striking to me: The Department of Home Affairs has consulted with cyber and risk teams, but responsibility now sits with CEOs and CFOs. Investment decisions, governance trade-offs and annual attestations land at the top.

This means cyber specialists can no longer optimise controls in isolation; they must work with their colleagues to assess, communicate and agree to the trade-offs between protection, usability and business impact.

Three fronts, one set of trade-offs

When leaders hear the word “cyber”, they think “it’s time to buy some software or contract a cyber monitoring service”. But a cyber uplift at this level isn’t a single project. It’s a program with three interdependent dimensions that will inevitably require executives to make some trade-offs:

1. Architecture and controls. This is the technical reality. Under the strengthened SOCI regime, this means an integrated risk-based cyber controls design across IT, operational technology, cloud and third parties, all aligned to real threat scenarios. Fragmented controls that worked “well enough” at low maturity unravel when regulators expect consistency, evidence and resilience across the whole system.
   
   
2. People and process: Controls only work if they are understood, used and embedded in day-to-day operations. The success of any cyber program is as much a test of human change management as of technology implementation. Many organisations have invested in tools, only to find that behaviour, workflows and decisions have not changed. Incident response, access management, vendor onboarding and escalation pathways rely on people knowing what to do.
   
   
3. Funding and governance: Cyber investment rarely sits in a single budget. It is typically spread across capital projects, operational spend, regulatory compliance and tactical remediation. CISOs need to work with CFOs to learn the ‘dark arts’ of unlocking the full funding available across the investment mix. Boards need full visibility and clarity on who takes responsibility.

You won’t be rolling out one platform. Complying with SOCI may mean rolling out a suite of new platforms.

Importantly, it will change the way people work. The two-year window to comply may not be wide enough for cultural change if you start too late.

How do organisations accelerate their maturity?

EY teams work with Australia’s largest critical infrastructure operators and we’ve learnt to treat cyber as a transformation program, not a project. This means designing a multi-year roadmap that builds capability over time, with a focus on sustainable controls.

The consequences are intensifying in line with the threats. Critical infrastructure accounts for 13% of reported cyber incidents, according to the 2024–25 Annual Cyber Threat Report. Critical infrastructure networks are “routinely targeted” by state-sponsored actors to “pre-position for disruption in a crisis”.

That’s why serious breaches of SOCI can attract penalties of up to $330,000 per day, alongside regulatory directions and, in extreme cases, government intervention.