Skip to content

Home
Services
SOCI
Industries
Inside Tier16
Capabilities
Insights

Contact Us

Home
Services
SOCI
Industries
Partners
Inside Tier16
- About Us
- Careers
Capabilities
Insights

SOCI READINESS CHECk /

Is your organisation actually ready for the SOCI Act, or just assuming it is?

15 checks across the obligations that actually get tested during an audit or an incident.

Tick what’s genuinely true today, not what’s planned. The score updates as you go.

Readiness score0 / 15

0%

CRITICAL GAPS

Significant exposure. Multiple core SOCI Act obligations are likely unmet — this is where regulators and incident responders find the costliest surprises.

Critical gaps0–39

Developing40–64

Substantially ready65–84

Strong position85–100

Book a gap assessment

Talk to Tier Sixteen about the gaps above

01Asset & Register Obligations

We've identified and documented which assets meet the definition of a critical infrastructure asset under the SOCI Act.7 pts We've submitted the required ownership and operational information to the Register of Critical Infrastructure Assets, and update it within 30 days of any change.7 pts We have a documented process for reviewing asset classification when new systems, sites, or ownership structures are introduced.5 pts

02Incident Reporting

We can identify and report a critical cyber security incident to the ASD within 12 hours of becoming aware of it.8 pts We can identify and report a significant (non-critical) cyber security incident within 72 hours.7 pts Our OT and engineering teams know how to escalate a suspected incident so it reaches whoever owns regulatory reporting.6 pts

03Risk Management Program (CIRMP)

We have a written, board-approved Critical Infrastructure Risk Management Program.8 pts Our CIRMP addresses personnel, supply chain, and physical/natural hazards — not just cyber security.7 pts We review and update the CIRMP at least annually, and after any material incident or operational change.6 pts We can produce an annual CIRMP compliance report for our board within statutory timeframes.5 pts

04Enhanced Obligations & Systems of National Significance

We know whether any of our assets are declared, or likely to be declared, a System of National Significance.5 pts If declared a SoNS, we have — or are actively developing — an incident response plan meeting Enhanced Cyber Security Obligations.5 pts We've undertaken, or scheduled, a cyber security exercise or vulnerability assessment covering our OT environment.4 pts

05OT & ICS Readiness

We hold an accurate, current asset inventory of our OT/ICS environment — PLCs, RTUs, SCADA servers, HMIs.6 pts Our OT network is segmented from corporate IT, with monitored boundaries between the two.6 pts We have visibility — logging and monitoring — into anomalous activity on our OT network, not just IT.5 pts

This self-assessment is indicative only and does not constitute legal advice or a formal audit against the Security of Critical Infrastructure Act 2018 (Cth). It's designed to help you gauge readiness ahead of a proper gap assessment. Tier Sixteen can run that assessment against your actual environment — get in touch.

securing critical infrastructure /

We deliver end-to-end OT security services designed to protect industrial environments and ensure SOCI compliance in practice.

Case Studies

Privacy & Cookies Policy

Connect with us!

Sign Up To Our Newsletter

SOCI Compliance

Our Services

Contact Us

Case Studies

Privacy & Cookies Policy

Connect with us!

Sign Up To Our Newsletter

We respect your privacy

To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.

Functional Functional Always active

The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.

Preferences Preferences

The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.

Statistics Statistics

The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.

Marketing Marketing

The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.

Manage options
Manage services
Manage {vendor_count} vendors
Read more about these purposes

View preferences

{title}
{title}
{title}

Scroll to Top