CISC sets live CIRMP requirement to address security risks

The Cyber and Infrastructure Security Centre has set live its Critical Infrastructure Risk Management Program (CIRMP) requirement, aiming to address the risks that organisations face and create a baseline for security across all critical infrastructure sectors in the Australian economy.

The rules address risks that include cyberattacks and ransomware, fires and floods, malicious insiders and malign foreign powers.

With the rules, responsible entities for critical infrastructure (CI) assets are required to adopt, maintain and comply with a risk management program that identifies and manages material risks of hazards that could have a relevant impact on a critical infrastructure asset.

The plan must identify each hazard where there is a risk that the occurrence of that hazard could have a relevant impact on the asset, and should address how it would minimise or eliminate any risk of the hazard occurring.

CIRMP is the third and final of the three positive security obligations legislated within recent amendments to the Security of Critical Infrastructure Act 2018.

The other two obligations are Mandatory Cyber Incident Reporting, and the Critical Infrastructure Asset Register requirement.

These obligations aim to elevate Australia’s critical infrastructure security and resilience, protecting Australia’s essential services.

Minister for Home Affairs, Clare O’Neil, activated the CIRMP rules on 17 February 2023, following a consultation process which incorporated feedback from critical infrastructure stakeholders that has made the rules easier to implement.

The inclusion of a requirement for a board or governing body to sign an attestation regarding the CIRMP moves the issue of risk management and security from an operational level to the board level.

Secretary of the Department of Home Affairs, Michael Pezzullo AO, also has the power to review a responsible entity’s plan, to ensure actions are being taken appropriately.

Following the rules being set to live, there is a six-month transition period for responsible entities to adopt a written CIRMP, and any new entities will have to meet the requirements within six months of becoming a critical infrastructure asset.