ACSC’s New Critical Infrastructure Cyber Security Framework Released: What Australian Businesses Should Know

By BCyber Security Team | CISSP, CISM Last updated: 24 June 2026

Disclosure: This article references BCyber’s own platforms, control library, and delivery data to illustrate how critical infrastructure compliance is operationalised in practice.

Verification note: Platform statistics cited below are sourced from BCyber’s internal platform inventory as of the last update date and are provided as operational context, not as an industry benchmark.

Australia’s cyber landscape has moved well beyond “best practice” language. For organisations that own, operate, support, or supply critical services, cyber security is now a governance issue, a legal issue, and an operational resilience issue.

That shift is visible across the Security of Critical Infrastructure Act (SOCI Act), ASD/ACSC guidance, and the control baselines many Australian organisations already use, including Essential Eight, the ISM, ISO 27001:2022, and NIST CSF 2.0. For APRA-regulated entities, the bar is even clearer: CPS 234 requires information security capability that is commensurate with threats and that can be evidenced to APRA.

So while the phrase “new critical infrastructure framework” gets used often, the practical reality is simpler: Australian businesses are being asked to prove that controls are designed, implemented, tested, and monitored — not just documented.

What the ACSC’s critical infrastructure framework is really doing

The ACSC’s guidance should be understood as a resilience model with compliance consequences. Its purpose is to help organisations identify critical assets, understand dependencies, reduce systemic risk, and maintain continuity when incidents occur.

That means the objective is no longer just prevention. It is also:

• reducing blast radius,
• preserving service continuity,
• detecting compromise quickly,
• containing incidents decisively,
• and proving recovery capability.

In practice, this is where technical controls meet governance controls. A policy is not enough if privileged access is uncontrolled. A backup strategy is not enough if restore testing never happens. An incident response plan is not enough if escalation paths are unclear or executive decision rights are undefined.

For Australian businesses, the lesson is consistent: controls must work under pressure, and evidence must exist to prove it.

The SOCI Act is the legislative anchor. It places obligations on entities connected to critical infrastructure assets and reflects the view that a cyber failure in one organisation can become a national service disruption. The compliance expectation is systemic because the risk is systemic. In energy, water, communications, transport, healthcare, and data services, one weak supplier or one undocumented workaround can be enough to create downstream impact.

That is why regulators increasingly care about proof. They want to see:

• current asset and dependency registers,
• control ownership,
• incident escalation procedures,
• testing records,
• recovery evidence,
• and remediation tracking.

In other words, the question is not “Do you have security?” but “Can you demonstrate it works when things fail?”

Which Australian businesses are likely in scope

Critical infrastructure obligations are often first associated with obvious sectors such as energy, water, transport, communications, healthcare, finance, and large-scale data services. But scope is broader than most businesses assume.

You may be in scope if you are:

• the owner of a critical asset,
• the operator of a regulated service,
• a responsible entity under the legislation,
• or a supplier whose systems are operationally material to a critical service.

That last category matters more than many organisations realise. Managed service providers, cloud operators, systems integrators, identity providers, and software vendors can become part of the compliance chain even if they never touch the customer’s internal network.

Real-world example: financial services

Real-world example: healthcare

Real-world example: government and service providers

The common thread is this: the function matters more than the label on the business card.

In critical infrastructure environments, compliance is rarely lost in the core controls alone. It is often lost at the edges: suppliers, exceptions, undocumented workarounds, and assumptions that were never tested.

What compliance looks like when it is actually working

1) Asset visibility and dependency mapping

• assets,
• data classes,
• critical services,
• privileged accounts,
• network and application dependencies,
• and third-party relationships.

This is where a lot of organisations underestimate the complexity of their environment. Critical services often depend on multiple overlapping systems: identity, DNS, cloud platforms, SIEM, endpoint controls, backup repositories, and support contracts. If those dependencies are not mapped, then the organisation cannot confidently assess operational impact.

2) Governance and risk ownership

• a board-level risk register,
• defined control owners,
• decision rights for exceptions,
• regular reporting on KRIs/KPIs,
• and formal acceptance of residual risk.

This is especially relevant for APRA-regulated entities under CPS 234, which expects information security capability, testing, and assurance to reflect the nature of the threats faced.

3) Incident readiness

A technically sound response program usually includes:

• a tested incident response plan,
• severity classification criteria,
• escalation trees,
• legal and executive notification paths,
• forensic preservation procedures,
• and recovery sequencing.

From a B2B perspective, the important technical detail is that incidents are often constrained by identity compromise, lateral movement, and restoration integrity — not just by malware execution. That is why logging, MFA, segmentation, and privileged access management matter as much as the response plan itself.

4) Evidence

• policy approval and version history,
• access reviews,
• patch and vulnerability remediation records,
• backup restore tests,
• tabletop exercise outputs,
• incident tickets,
• and exception approvals.

A polished document set is not enough. Organisations need proof that controls were implemented, tested, and reviewed over time.

How the major control baselines fit together

The most effective Australian programs do not treat frameworks as alternatives. They map them together.

Essential Eight

For many organisations, the Essential Eight is the quickest way to move from “we think we’re secure” to “we can show measurable risk reduction.”

ISM

• privileged access,
• logging and monitoring,
• cryptography,
• hardening,
• network segmentation,
• and secure administration.

ISO 27001:2022

• structured risk treatment,
• documented controls,
• internal review cycles,
• continual improvement,
• and audit readiness across multiple business units.

NIST CSF 2.0

• Identify,
• Protect,
• Detect,
• Respond,
• Recover.

It is especially useful for board reporting because it helps leadership understand where controls are mature, partial, or missing altogether.

SOCI Act

APRA CPS 234

The smartest strategy is to build one operational control model and map these frameworks onto it. That avoids duplicate effort and makes audit evidence reusable across compliance obligations.

How BCyber operationalises this in practice

BCyber’s own platform inventory reflects the reality that governance, risk, compliance, resilience, and incident response need to be connected rather than managed in silos. BCyber currently tracks 21 policies, 8 processes, 46 courses, 660 published articles, 365 knowledge hub entries, 9 clients, and 8 fact-find assessments across its delivery environment.

That matters because critical infrastructure readiness is not just a policy exercise. It needs a working control system.

GRACE Portal

• Single Dashboard,
• Cross-product Analytics,
• Executive Reporting,
• Compliance Tracking,
• Real-time Monitoring.

For boards and executives, that is the difference between fragmented reporting and a single source of truth.

Paradigm

• GRC automation,
• risk quantification,
• policy automation,
• and compliance mapping.

This aligns well with organisations trying to operationalise controls across SOCI, Essential Eight, ISM, ISO 27001:2022, and NIST CSF 2.0 without duplicating manual work.

Profiler

That is especially relevant when compliance depends on proving that access is appropriate, privileged activity is monitored, and user behaviour is consistent with role expectations.

TopSpin

For critical infrastructure environments, this is not a “nice to have.” Backup retention, log retention, and forensic storage all create planning and cost pressure. If capacity is mismanaged, evidence and recoverability suffer.

CyberTriage

In practical terms, faster triage helps reduce dwell time, prioritise containment, and preserve evidence before it is overwritten or corrupted.

Perfect Storm

This is highly relevant to critical infrastructure because organisations should test compound scenarios, such as:

• identity compromise plus ransomware,
• supplier outage plus cloud misconfiguration,
• or insider threat plus backup failure.

Scenario simulation is how organisations find failure points before attackers do.

Privacy in Depth

That becomes important in sectors like healthcare, government, and financial services, where cyber incidents often become privacy incidents as well.

Training and capability

In practice, that means board-facing governance content, technical control training, incident response readiness, and privacy obligations should all be connected to the same operating picture.

A practical readiness plan for Australian businesses

Step 1: Confirm scope

Step 2: Run a gap assessment

• SOCI obligations,
• APRA CPS 234,
• Essential Eight maturity,
• ISM control requirements,
• ISO 27001 management system expectations,
• and NIST CSF 2.0 maturity.

A strong assessment should identify both the control gap and the operational impact of the gap.

Step 3: Prioritise the highest-risk remediations

• MFA for privileged and remote access,
• patch management,
• logging and alerting,
• immutable backup testing,
• segmentation of critical systems,
• and incident response execution.

Step 4: Build evidence as you remediate

• test results,
• control sign-offs,
• backup restore outcomes,
• exercise reports,
• risk acceptance decisions,
• and remediation closure evidence.

Step 5: Test continuously

Common mistakes that slow Australian organisations down

Treating compliance as an IT-only task

Relying on policies without operational proof

Underestimating third-party risk

Treating compliance as a project rather than a program

Forgetting recovery

Key takeaways

Australia’s critical infrastructure cyber expectations are part of a broader shift toward resilience, accountability, and evidence. The real change is not just regulatory; it is operational. Businesses are now expected to show that they know what they own, how they are protected, how they respond, and how they recover.

For most Australian organisations, the best path forward is to:

• confirm scope,
• map dependencies,
• benchmark current controls,
• prioritise the highest-risk gaps,
• and build an evidence trail that supports both audit and executive oversight.

If your organisation operates in, or supports, critical infrastructure, cyber security is no longer a back-office function. It is a board-level governance capability.

Sources and further reading

1. APRA CPS 234 – Information Security

1. ASD / ACSC – Essential Eight

1. ASD / ACSC – Information Security Manual (ISM)

1. NIST Cybersecurity Framework 2.0

1. Security of Critical Infrastructure Act 2018 (Australia)

1. ISO 27001 overview

About BCyber

This article is informational and does not constitute legal advice. Organisations should confirm obligations against their own legal structure, regulatory exposure, and contractual commitments.