CISC releases updated critical infrastructure risk management program guidance

The Critical Infrastructure Security Centre (CISC) has released updated guidance to help responsible entities develop, maintain and review their Critical Infrastructure Risk Management Program (CIRMP).

The updated materials include a full guidance document and a snapshot version, both designed to support entities subject to baseline and enhanced CIRMP obligations under Australia's critical infrastructure security framework.

Each chapter of the guidance covers the CIRMP requirements, clarifies key concepts and terminology, and outlines best practice approaches to compliance. Worked examples are included throughout to demonstrate practical application.

The guidance also helps entities identify material risks, understand relevant impacts, and consider appropriate controls and mitigations - and shows how to document each element within a CIRMP.

Entities subject to the Telecommunications Security Risk Management Program (TSRMP) should use the CIRMP guidance as a best practice resource alongside the separate Telecommunications Guidance, the CISC said.

In June, the government said the Enhanced CIRMP Rules coming into effect in 2027 will introduce targeted uplifts to existing risk management requirements for a number of specified asset classes.

These cover critical assets in the areas of energy market operators, electricity, gas, liquid fuel, water, broadcasting, domain name systems, freight services and freight infrastructure.