Critical Infrastructure Risk Management Program (CIRMP) Rules 2023
Made under Part 2A of the Security of Critical Infrastructure Act 2018, the Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 require responsible entities to develop, implement and maintain a risk management program that addresses cyber security, personnel security, supply chain security, physical security and other hazards. Entities must also report their risk management program and any significant incidents to the Australian Government in accordance with the Act.
Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 is a compliance framework from Australia (Commonwealth) with 3 domains and 24 controls that map to 4 other frameworks. The largest domains are Part 2 enhanced requirements: additional material risks, cyber, credential, lateral movement, personnel, supply chain and physical (nine asset classes) – Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 (12 controls), Part 2 baseline requirements: material risks and the four hazard families (all CIRMP Rule assets) – Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 (9 controls), Part 1: Application, asset classes, enhanced classes and grace periods – Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Part 1: Application, asset classes, enhanced classes and grace periods – Critical Infrastructure Risk Management Program (CIRMP) Rules 2023
| Code | Title |
|---|---|
| critical-infrastructure-risk-management-program-cirmp-rules-2023::4 | s 4 Which assets the Rules bind: thirteen classes, six-month grace, and the baseline requirements |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::4(4) | s 4(4) Compliance through another Part 2A instrument for an entity holding assets under two instruments |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::4A | s 4A Enhanced requirements: the nine asset classes, precedence over baseline, and the 12- and 24-month grace periods |
Part 2 baseline requirements: material risks and the four hazard families (all CIRMP Rule assets) – Critical Infrastructure Risk Management Program (CIRMP) Rules 2023
| Code | Title |
|---|---|
| critical-infrastructure-risk-management-program-cirmp-rules-2023::10 | s 10 Supply chain hazards: six material risks and impact mitigation, major suppliers listed |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::11 | s 11 Physical security and natural hazards: identify physical critical components, control access, respond to intrusions, test the arrangements |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::6 | s 6 Material risks the program must address |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::7(1) | s 7(1) General all-hazards process: operational context, material risks, minimise and mitigate, review and currency |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::7(2) | s 7(2) CIRMP content the board must have regard to: context outcome, interdependencies, responsible positions, methodology, review circumstances |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::8(2) | s 8(2) Cyber and information security hazards: minimise the material risk and mitigate the impact |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::8(3) | s 8(3) Adopt one of five cyber frameworks, or an equivalent, within 12 months of the grace period |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::9(1) | s 9(1) Personnel hazards: identify critical workers, permit access only on suitability, address malicious, negligent and off-boarding risks |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::9(2) | s 9(2) AusCheck background checks where the CIRMP uses them: criminal history criteria, dual identity verification, notification, Secretary's advice |
Part 2 enhanced requirements: additional material risks, cyber, credential, lateral movement, personnel, supply chain and physical (nine asset classes) – Critical Infrastructure Risk Management Program (CIRMP) Rules 2023
| Code | Title |
|---|---|
| critical-infrastructure-risk-management-program-cirmp-rules-2023::10A(2) | s 10A(2) Supply chain mapping: major suppliers and critical components, risks to critical components and business critical data, maximum acceptable outage, mitigation |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::10A(4) | s 10A(4) Vendor assessment of each existing or proposed major supplier: FOCI legal exposure, sanctions, access and control, combined risk against the MAO, steps |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::11A(1) | s 11A(1) Central management of physical security and natural hazards, with the physical consequences of every hazard family outlined |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::11A(3) | s 11A(3) Enhanced physical controls: access controls for workers, visitors and the public, continuous surveillance and alarms, business and out-of-hours measures, deter-detect-delay-respond-recover, mitigation and response |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::6A | s 6A Additional material risks for enhanced assets: national significance, FOCI, offshore and remote access |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::8A(2) | s 8A(2) Enhanced cyber material risks: patching, legacy systems, and advanced, novel or emerging technology |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::8A(3) | s 8A(3) Enhanced cyber framework: 27001:2023, Essential Eight level two, CSF 2.0, C2M2 v2.1 MIL2 or AESCSF 2023 SP2, or an equivalent |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::8B | s 8B Credential compromise hazards: phishing-resistant multi-factor authentication where the chosen framework does not require it, with central logging |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::8C | s 8C Lateral movement hazards: inventory of critical systems, recovery and continued availability, and network segregation with a three-month independence standard |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::9A(2) | s 9A(2) Enhanced personnel access management: unauthorised or unsupervised access, credential misuse, non-critical-worker access, joiners and leavers |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::9A(3) | s 9A(3) Enhanced suitability: AusCheck plus the entity's assessment, or a security clearance; documented risk where a worker cannot meet it; proactive monitoring |
| critical-infrastructure-risk-management-program-cirmp-rules-2023::9A(5) | s 9A(5) Enhanced suitability upkeep: AusCheck at least every five years for ongoing access, and clearance revalidation before lapse |
Your Compliance Coverage
If you comply with Critical Infrastructure Risk Management Program (CIRMP) Rules 2023, you already cover:
Maps to 4 other frameworks
Coverage is not the same as your position
This page shows what Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 and who does it apply to?
Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 is a compliance framework from Australia (Commonwealth) with 3 domains and 24 controls. Made under Part 2A of the Security of Critical Infrastructure Act 2018, the Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 require responsible entities to develop, implement and maintain a risk management program that addresses cyber security, personnel security, supply chain security, physical security and other hazards. Entities must also report their risk management program and any significant incidents to the Australian Government in accordance with the Act. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 actually require?
Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 has 24 controls organised across 3 domains. The largest domains are Part 2 enhanced requirements: additional material risks, cyber, credential, lateral movement, personnel, supply chain and physical (nine asset classes) – Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 (12 controls), Part 2 baseline requirements: material risks and the four hazard families (all CIRMP Rule assets) – Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 (9 controls), Part 1: Application, asset classes, enhanced classes and grace periods – Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 do I already cover?
Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 maps to 4 other compliance frameworks. The top mapping partners are NIST Cybersecurity Framework 2.0 (14% coverage), Cyber Security Act 2024 (Australia) (6% coverage), ISO 13485:2016 (3% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Critical Infrastructure Risk Management Program (CIRMP) Rules 2023?
Start your Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 24 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required