Critical Infrastructure Risk Management Consultants Australia

Specialist SOCI Act compliance consulting. From CIRMP development to annual board attestation.

Australia’s critical infrastructure landscape has fundamentally changed. The Security of Critical Infrastructure Act 2018 (SOCI Act) and its subsequent amendments now require responsible entities across 11 sectors and 13 asset classes to adopt, maintain, and comply with a written Critical Infrastructure Risk Management Program (CIRMP). The first annual reporting period (2024–2025) has passed, and the Department of Home Affairs is actively consulting on further enhancements to the CIRMP Rules.

For boards and executive teams, SOCI compliance is no longer a future obligation. It is an active governance requirement carrying regulatory scrutiny, civil penalties, and reputational exposure. Agilient provides the independent analysis, specialist methodology, and ongoing assurance that responsible entities need to satisfy their CIRMP obligations with confidence.

why choose us

Why Agilient?

Proven Track Record

Agilient has delivered over 250 complex security projects across Australia’s largest government, healthcare, industrial, and defence networks. This includes multi-site critical infrastructure assessments, CIRMP development programs, and long-term security guardianship engagements.

Cleared, Licensed Consultants

Agilient’s team includes NV1-cleared (Secret) consultants holding valid security master licences across Australian jurisdictions. This eliminates common engagement barriers for government and defence-adjacent critical infrastructure entities.

Standards-Based, Defensible Methodology

Every engagement is benchmarked against recognised frameworks, including:

AS/NZS ISO 31000:2018 — Risk Management
AS 4485 — Security for Healthcare Facilities
ISO 22301 — Business Continuity Management Systems
The Protective Security Policy Framework (PSPF)
The SOCI Act 2018 and CIRMP Rules

This ensures that findings, recommendations, and attestation support are repeatable and defensible under regulatory scrutiny.

We Tailor to Your Industry

Operating nationally, Agilient brings a wealth of experience to every engagement, with a genuine understanding of the nuances and individual needs that vary across industries, regions, and organisations. No two clients are the same, and that’s something we take seriously. Whether you’re in healthcare, construction, finance, or beyond, our approach is always tailored, considered, and built around you.

services offered

Critical Infrastructure Services

Agilient is not a generalist consultancy. The firm specialises in high-assurance physical and protective security for critical infrastructure environments. Every engagement is designed to move an organisation from a fragmented or undocumented security posture to a position of proven, standards-aligned maturity.

SOCI Gap Analysis and CIRMP Baseline Review

Agilient conducts a comprehensive desktop discovery of existing policies, procedures, registers, and controls to build a technical baseline against the SOCI Act’s CIRMP requirements. This analysis applies a strict regulatory lens, identifying genuine compliance gaps and material risks rather than cataloguing general security preferences. The output is a clear, prioritised register of what must be addressed to satisfy CIRMP obligations.

Targeted Security Threat and Risk Assessments

Attempting a comprehensive, floor-by-floor campus inspection often bogs critical infrastructure projects down in data and logistics. Agilient employs a targeted “Nerve Centre” methodology, isolating and assessing the highest-consequence zones within a facility — such as ICU departments, main plant rooms, ICT server rooms, control centres, and critical supply chain interfaces.
By concentrating assessment effort on these critical components, Agilient can address the vast majority of regulatory risk efficiently and within practical timeframes. Assessments are conducted in accordance with AS/NZS ISO 31000:2018 (Risk Management) and relevant sector-specific standards.

Risk Control Effectiveness Validation

Recording that a security control exists is not the same as proving it works. Agilient validates Risk Control Effectiveness (RCE) through day and night on-site inspections conducted in live operational environments. This includes verifying that access control systems, CCTV surveillance, intrusion detection, duress alarms, and procedural controls actively detect, delay, or deter threats under real-world conditions.

Tiered Security Uplift Roadmaps

Technical findings are translated into practical, fundable recommendations structured for executive decision-making. Agilient’s uplift roadmaps are categorised into three tiers:

Must-Do — risk-critical rectifications required for mandatory SOCI Act and life-safety compliance.

Consider-Doing — risk-based, cost-efficient security enhancements that materially reduce residual risk.

Nice-to-Have — future-state capabilities and emerging technology options.

This tiered structure allows boards and executive teams to allocate capital with a clear understanding of regulatory priority versus discretionary investment.

Strategic Security Guardianship (Ongoing Assurance)

Maintaining CIRMP compliance is not a one-off exercise. Agilient offers an ongoing security guardianship partnership designed to remove the administrative burden of compliance from internal teams. This includes:

Operational integrity audits against CIRMP requirements.
Asset lifecycle oversight and risk register maintenance.
Preparation and review of the mandatory annual board-approved SOCI attestation report.
Monitoring of regulatory developments, including enhancements to the CIRMP Rules.

Sectors and Asset Classes

The SOCI Act applies across 11 critical infrastructure sectors. Agilient provides risk management services to responsible entities operating within these sectors, including:

Healthcare
Energy
Water and sewerage
Transport
Telecommunications Data storage and processing,
Financial services
Defence industry
Food and grocery
Space technology
Higher education and research

Secure Your Critical Infrastructure

Regulatory obligations under the SOCI Act are increasing, and the Department of Home Affairs continues to consult on enhancements to the CIRMP Rules. Do not wait for a regulatory audit or a critical incident to test your resilience.
Partner with Agilient to build a defensible, risk-based Critical Infrastructure Risk Management Program that protects your people, your assets, and your reputation.

our locations

Operating Nationally

faqs

frequently Asked questions

What is the SOCI Act?

The Security of Critical Infrastructure Act 2018 (SOCI Act) is the Australian Government’s legislative framework for protecting critical infrastructure assets. It establishes obligations for responsible entities across 11 sectors, including mandatory incident reporting, registration requirements, and the adoption of a written Critical Infrastructure Risk Management Program (CIRMP).

Who needs a CIRMP?

Responsible entities for critical infrastructure assets in 13 specified asset classes are required to adopt, maintain, and comply with a CIRMP. These asset classes span sectors including healthcare (designated hospitals), energy, water, transport, telecommunications, data storage, financial services, defence industry, food and grocery, and space technology.

What are the four CIRMP hazard vectors?

The SOCI Act requires CIRMPs to address material risks across four mandatory hazard vectors: physical security and natural hazards, cyber and information security, personnel security (trusted insider threats), and supply chain security.

Sem lectus semper rutrum et

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.

How often must a CIRMP be reported on?

Responsible entities are required to submit an annual report to the Cyber and Infrastructure Security Centre (CISC) and obtain board-level sign-off on the CIRMP each reporting period. The first mandatory reporting period was 2024–2025.

Can Agilient help with the annual SOCI attestation?

Yes. Agilient provides ongoing strategic security guardianship, which includes preparation and review of the annual board-approved SOCI attestation report, as well as continuous monitoring of regulatory changes to the CIRMP Rules.