Frameworks · SOCI Act CIRMP
Coming soonCritical infrastructure risk management program readiness
SOCI Act CIRMP readiness is coming soon to TrustProof: it will take you through the critical infrastructure risk management program Rules: cyber and information security, personnel, supply chain, and physical and natural hazards, including the enhanced requirements that started on 10 June 2026. There is no CIRMP certification: your board approves an annual report to the regulator, and TrustProof will keep the evidence and drafts behind it.
Key facts
What you can check
- Four hazard areas
- Items across the all-hazards rules, cyber and information security, personnel, supply chain, and physical and natural hazards, in TrustProof's own words with rule numbers only.
- Baseline, enhanced or supplier
- You will record whether your asset has the baseline or the enhanced 2026 requirements, or whether you are a supplier supporting a critical infrastructure customer. That decides which items apply.
- Annual report draft
- A working draft of the annual report your board approves, following the government form. You submit the official form yourself; TrustProof does not.
- Read-only AWS role
- TrustProof connects through a read-only IAM role you create from our CloudFormation template and can remove at any time. No passwords, no stored keys.
- Hosted in AWS Sydney
- TrustProof runs on AWS in the Sydney region (ap-southeast-2), encrypted at rest and in transit.
What TrustProof does
- Will walk you through each rule with plain-language questions
- Will track the enhanced requirements and their grace periods
- Will keep your risk register, critical worker register and supply chain map with review dates
- Will collect AWS evidence through a read-only role
- Will prepare an annual report draft and record your board approval
What TrustProof doesn't do
- TrustProof does not certify, and there is no CIRMP certification.
- It does not register assets, submit the annual report or give legal advice, and it does not cover telecommunications carrier assets.
- TrustProof is not affiliated with or endorsed by the Department of Home Affairs or the Cyber and Infrastructure Security Centre.
FAQ
Frequently asked questions
Does this apply to us?
The CIRMP Rules apply to responsible entities for listed critical infrastructure asset classes, such as electricity, gas, water, data storage and processing, and food and grocery. Check the Rules or get legal advice; suppliers to those entities can use TrustProof to support their customers.
What are the enhanced requirements?
Rules that started on 10 June 2026 for some asset classes, such as phishing-resistant MFA, separating critical systems, supply chain mapping and stronger background checks. Grace periods run to June 2027 and June 2028.
Does TrustProof submit our annual report?
No. Your board approves the report and you submit the official form to the regulator within 90 days of the end of the financial year. TrustProof prepares a working draft from your evidence.
When will SOCI Act CIRMP readiness be available?
It is coming soon. The free read-only AWS scan and One-Button Fix are available today. Talk to us if you would like to hear when it opens; this page will be updated when it does.
What does it cost?
The first AWS scan is free. One-Button Fix is A$1,499 one-off. Plans are a one-off Readiness Programme plus Continuous Monitoring from A$899 a month. All prices are in Australian dollars and include GST.