Security of Critical Infrastructure Act 2018 (SOCI) s30AH: Make the program meet the statutory purpose and the CIRMP Rules

A critical infrastructure risk management program must, for each asset, identify each hazard where there is a material risk (judged on likelihood and relevant impact on availability, integrity, reliability or confidentiality) that its occurrence could have a relevant impact on the asset; so far as reasonably practicable minimise or eliminate that risk and mitigate the impact; and comply with requirements in the rules (the CIRMP Rules, LIN 23/006, and for carrier and larger carriage service provider assets the Telecommunications Security and Risk Management Program Rules 2025). Rules may deem risks material, deem actions to minimise or mitigate, require AusCheck background checks with criteria and identity verification for critical workers, and incorporate Standards Australia standards, the Essential Eight, NIST CSF, C2M2, the AESCSF and ASD's Cyber Supply Chain Risk Management as in force from time to time (ss 30AN, 30ANA).