The SOCI Act asks responsible entities to run a risk management program across all hazards, maintain it, and report on it. Most programs we review are scoped around cyber alone and were written once. We help operators build the version that holds up.
The Enhanced CIRMP Rules commenced in June 2026, with staged deadlines in June 2027 and June 2028. Cyber security framework compliance falls in the later one — and the framework most operators nominated is being retired on roughly the same schedule.
Four engagements, depending on whether you are building a program, checking one, aligning it to a framework, or proving it works.
We build a CIRMP that covers all five hazard vectors, not just cyber, and that reads as a live process rather than a document written once.
You have a program already. We assess it against the obligations and tell you where the evidence would not hold up.
Choosing which framework to nominate, mapping your current controls onto it, and finding what the mapping does not cover.
Building and exercising the response capability that enhanced obligations expect, before a declaration makes it urgent.
Knowing which obligations apply to your assets decides what your program has to demonstrate, and how much of it you need now rather than later.
Longer analysis of the obligations, the frameworks, and where programs tend to fall short.
What a telecommunications risk management program has to cover, and where entities leave it thin.
Plain definitions for the acronyms this regime runs on.
The baseline duty every responsible entity carries under the SOCI Act.
What a SoNS declaration is, and what it switches on beyond the baseline.
O/IT Cyber© O/IT Cyber 2026