Critical Infrastructure CCTV: SOCI, CIRMP and Grid Guidance

What rules apply to CCTV at critical infrastructure sites?

• The CIRMP baseline: section 11 of the CIRMP Rules requires a responsible entity to identify the physical critical components of its asset, minimise or eliminate material risk from physical security hazards, respond to incidents of unauthorised access, restrict access to critical workers or accompanied visitors, and test that its security arrangements are effective and appropriate to detect, delay, deter, respond to and recover from a breach.¹
• Government guidance: the Cyber and Infrastructure Security Centre (CISC) gives installing CCTV or motion detection sensors to improve the ability of security staff to detect unauthorised access as an example of managing physical hazards. The same guidance lists locking down industrial control systems, including cameras, against attack.²
• The enhanced rules: since 10/06/2026, new section 11A applies to critical broadcasting, domain name system, electricity, energy market operator, freight infrastructure, freight services, gas, liquid fuel and water assets. It requires measures that include maintaining surveillance and security alarm systems such that critical components and critical systems are subject to continuous monitoring.³ Existing assets have until 10/06/2028 to comply.⁴
• Reporting: each CIRMP annual report must be approved by the entity’s board, council or other governing body, and given to the CISC within 90 days of the end of the Australian financial year.⁵
• Electricity networks: ENA DOC 015-2022, National Guidelines for the Protective Security of Electricity Networks, sets baseline operational requirements for video surveillance. These include alignment with the IEC 62676 series, target image quality by location (identification at building entries, recognition at site and substation gates, observation across perimeters and yards), recording at 12 images per second rising to 25 on alarm, and at least 31 days of storage.⁶

What does good critical infrastructure CCTV look like?

The CISC’s 2025 annual risk review highlights copper theft causing power outages and sabotage as a growing tool of geopolitical disruption.⁷ CCTV only helps against these threats when it is designed around the risk and connected to a response. A well designed system has:

• a threat and risk assessment linked to the CIRMP, with an operational requirement for each camera (observe, detect, recognise or identify);
• integration with perimeter intrusion detection, access control and a security management system, so that alarms are verified by video;
• continuous monitoring by an operator or monitoring centre, with a documented response;
• thermal cameras and analytics on long perimeters, tested on site before they are relied on;
• lighting designed to support camera performance;
• cameras and video management systems on segregated networks, patched and supplied by vetted vendors;
• secure retention, evidential export and signage; and
• regular testing, so the CIRMP can show the arrangements work.

How Agilient supports critical infrastructure CCTV

Agilient provides independent CCTV consulting and critical infrastructure risk management for operators: CIRMP physical hazard reviews, operational requirements, electronic security design and specifications, and testing of security arrangements. Agilient does not sell or install equipment. The SOCI Act guide, CIRMP physical security playbook and enhanced CIRMP Rules guide give more detail.