Screening expert warns firms to be prepared ahead of August legislation change in Australia

Firms supplying critical infrastructure solutions across Australia need to begin preparations as the compliance date for the amended Security of Critical Infrastructure Act (SOCI) nears. That’s according to employment screening and identity expert, Sterling.

The Act – which was initially rolled out in 2018 – has been expanded to place requirements on responsible entities across 11 critical sectors, with August 2024 marking the end of all legislative grace periods and the time at which businesses need to be prepared. While compliance with the legislation is only required for those firms that supply into the critical infrastructure of Australia, Sterling has urged all companies that provide services in the country to check if they are liable under the reforms.

The core purpose of SOCI is to enhance the country’s resilience and mitigate against national risks. Responsible Entities and Direct Interest Holders that own and operate critical infrastructure assets in any of the 11 sectors need to be able to demonstrate they have plans in line with three core Positive Security Obligations:

• An Information Provision PSO: Requires firms to register critical assets with the federal government now and as new assets are added to the company’s infrastructure.
• A Mandatory Cyber Incident Breach Notification PSO: Outlines that a business will immediately notify the Australian Cybersecurity Centre (ACSC) via phone or the ACSC website of any cyber incident, before providing written notification.
• A Risk Management PSO: Defines a clear plan around how the company will identify risks and deal with hazards that fall under four key categories:
  • Supply Chain Hazards
  • Cyber & Information Hazards
  • Physical Hazards
  • Personnel Hazards

As Mick Roche, ANZ Head of Sales Sterling explained, this is a positive, but complex initiative from the Australian government, with the personnel hazards presenting a core challenge:

“There’s no doubt that this move will be beneficial to Australia, its citizens, and businesses. A failure in services or a cyber-attack on any sector or firm that falls under the critical infrastructure category could have a domino impact on others, so mitigating risks and planning for hazards is crucial.

“Of all the areas that employers need to create plans for, though, it is the personnel hazards that arguably present the greatest challenges and the biggest threats. Employees are the ones controlling critical infrastructure assets and have access to multiple facets within companies which could expose infrastructure and systems to risks. It’s vital that employers put the necessary screening and re-screening programs in place now to meet the SOCI Act legislation requirements ahead of the 11 August deadline”

“While it may seem like an overwhelming and difficult challenge to navigate, there are a wealth of resources available to support businesses as they prepare for the August deadline. From a personnel screening point of view, I would urge employers to be mindful of the fact that the cost of implementing the required checks are minimal in comparison to the potentially catastrophic impact of inaction.”

This content is offered for informational purposes only. First Advantage is not a law firm, and this content does not, and is not intended to, constitute legal advice.  Information in this may not constitute the most up-to-date legal or other information.

Readers of this content should contact their attorney or lawyer to obtain advice concerning any particular legal matter.  No reader, or user of this content, should act or refrain from acting on the basis of information in this content without first seeking legal advice from counsel or lawyers in the relevant jurisdiction.  Only your individual attorney or legal advisor can provide assurances that the information contained herein – and your interpretation of it – is applicable or appropriate to your particular situation.  Use of, and access to, this content does not create an attorney-client relationship between the reader, or user of this presentation and First Advantage.