--- title: What the SOCI Act and IEC 62443 means for Critical Infrastructure Operators description: A plain-English guide to how Australia's SOCI Act obligations and the IEC 62443 standards apply to operational technology sites, and how to use one to meet the other. From NetSeg. image: https://www.netseg.io/hubfs/grok-image-5091ba93-2bc9-4fa4-b6ce-2e5757852682.jpg --- [Skip to content](https://www.netseg.io/netseg-blog/soci-act-iec-62443-ot-sites#main-content) ![](https://www.netseg.io/hs-fs/hubfs/transparent%20white%20logo.png?width=946&height=302&name=transparent%20white%20logo.png)Homepage - [Home](https://www.netseg.io) - [Capabilities](https://www.netseg.io/netsegs-capabilities) - [Thought Leadership](https://www.netseg.io/netseg-thought-leadership) - [Contact](https://www.netseg.io/contact-us) - [OT Maturity](https://www.netseg.io/picsel-maturity) - [Blog](https://www.netseg.io/netseg-blog) - [Home](https://www.netseg.io) - [Capabilities](https://www.netseg.io/netsegs-capabilities) - [Thought Leadership](https://www.netseg.io/netseg-thought-leadership) - [Contact](https://www.netseg.io/contact-us) - [OT Maturity](https://www.netseg.io/picsel-maturity) - [Blog](https://www.netseg.io/netseg-blog) ![](https://www.netseg.io/hs-fs/hubfs/grok-image-5091ba93-2bc9-4fa4-b6ce-2e5757852682.jpg?width=1140&height=623&name=grok-image-5091ba93-2bc9-4fa4-b6ce-2e5757852682.jpg) # What the SOCI Act and IEC 62443 means for Critical Infrastructure Operators ![Leon Poggioli - NetSeg.io](https://www.netseg.io/hs-fs/hubfs/CyberCon%20%20Melbourne%202026%20JMP_2417.jpg?width=48&height=48&name=CyberCon%20%20Melbourne%202026%20JMP_2417.jpg) Leon Poggioli - NetSeg.io October 17, 2026 **Short answer:** The SOCI Act tells many Australian critical infrastructure operators that they must manage cyber and other risks to their assets and report serious incidents; IEC 62443 is the international standard series that has been adopted by Standards Australia and explains how to secure the OT systems those assets run on. NetSeg helps OT sites use IEC 62443 zones, conduits and security levels as the practical engineering basis for SOCI risk management. *This article is general information, not legal advice. Check your specific obligations with the Cyber and Infrastructure Security Centre (CISC) and your own advisers, because the rules and covered asset classes have been amended over time.* ## The SOCI Act in brief The Security of Critical Infrastructure Act 2018 (Cth), as expanded by amendments in 2021, 2022 and 2024, applies to entities responsible for critical infrastructure assets across sectors including energy, water, transport, communications, health, food and grocery, data storage and processing, and others. Not every obligation applies to every asset class, so the first job is to confirm which of your assets are covered and which obligations attach to them. The obligations most relevant to OT sites are: - **Register of critical infrastructure assets:** providing ownership and operational information to the government. - **Mandatory cyber incident reporting:** notifying the Australian Signals Directorate's Australian Cyber Security Centre of cyber incidents that have, or are likely to have, an impact on the asset. Tighter timeframes apply to incidents with a significant impact than to those with a relevant impact. - **Critical Infrastructure Risk Management Program (CIRMP):** for specified asset classes, a written program that identifies and, as far as reasonably practicable, minimises or eliminates material risks across cyber and information security, personnel, supply chain, and physical and natural hazards. It needs board (or equivalent) approval and an annual report to the regulator. - **Enhanced cyber security obligations:** for assets declared Systems of National Significance, which can include incident response planning, exercises and vulnerability assessments. Under the CIRMP rules, the cyber section requires the entity to comply with a recognised framework, such as the Essential Eight, NIST Cybersecurity Framework, ISO/IEC 27001, the Australian Energy Sector Cyber Security Framework (AESCSF) or C2M2, at a specified level, or an equivalent. ## IEC 62443 in brief IEC 62443 is a series of standards for securing industrial automation and control systems (IACS). The parts that matter most to an asset owner are: - **IEC 62443-2-1:** requirements for an asset owner's security program (policies, roles, procedures). - **IEC 62443-2-4:** requirements for service providers and integrators who work on your systems. - **IEC 62443-3-2:** how to run a security risk assessment and partition the system into zones and conduits, each with a target security level. - **IEC 62443-3-3:** system security requirements and security levels (SL 1 to SL 4). - **IEC 62443-4-1 and 4-2:** secure development and component requirements for product suppliers, useful when you write procurement specifications. The core idea is that you do not apply the same controls everywhere. You group assets into zones, decide how strong the protection of each zone needs to be based on risk, and control the conduits between them. ## How the two fit together The SOCI Act sets the *what*: identify material risks, manage them, report incidents and show the board is accountable. Most of the frameworks the CIRMP rules list were written with IT in mind. They are useful for governance, but they say little about PLCs, safety systems, legacy protocols or the fact that you cannot patch a controller mid-production. IEC 62443 fills in the *how* for OT. A practical approach many sites take is to meet the CIRMP framework requirement with one of the listed frameworks at the corporate level, and use IEC 62443 to design and justify the controls inside the OT environment. ## Step-by-step: turning obligations into OT work ### Step 1: Confirm scope List which assets are critical infrastructure assets under the Act, which obligations apply to each, and which OT systems support them. Include the systems that, if they failed, would stop the asset operating, not just the ones that are network-connected. ### Step 2: Build the OT asset and communication inventory You cannot assess material risk without knowing what is there. Use passive monitoring tools, configuration records and site walkdowns. Record vendor remote access paths and third-party connections, because they feed both the cyber and supply chain parts of a CIRMP. ### Step 3: Run an IEC 62443-3-2 style risk assessment Partition the system into zones and conduits, assess the consequence of compromise for each zone (safety, environment, production, regulatory) and set a target security level. This gives you a defensible, documented basis for what “as far as reasonably practicable” means at your site. ### Step 4: Close the gap between target and current state Compare what each zone needs with what it has. Typical early gaps are a missing IT/OT boundary, uncontrolled remote access, shared accounts, no OT-specific monitoring and no tested recovery for controllers and engineering files. ### Step 5: Prepare for incident reporting Agree in advance who decides whether an OT event is a reportable cyber incident, who makes the report and how operations staff escalate. The reporting clock is short, so the decision path needs to exist before an incident, and OT monitoring alerts need to reach someone who can make that call. ### Step 6: Give the board something it can approve The CIRMP annual report needs board (or equivalent) approval. Translate the zone-by-zone gaps into a prioritised, costed plan with named owners. Boards approve plans they understand; a list of technical findings is not a plan. ### Step 7: Bring suppliers into scope Use IEC 62443-2-4 and 4-2 language in contracts and procurement so integrators and vendors meet defined security requirements, and so new equipment arrives at the required security level rather than being retrofitted later. ## A clearly labelled example *Example only:* a water utility might meet its CIRMP cyber framework requirement using the Essential Eight across corporate IT, while using IEC 62443-3-2 to define separate zones for treatment plant control, telemetry and the SCADA servers, each with its own target security level and a documented conduit to the corporate network. ## FAQ **Does the SOCI Act require IEC 62443?** No. The CIRMP rules list several accepted frameworks and allow equivalents. IEC 62443 is not a mandated substitute, but it is widely used to design and justify OT controls within a SOCI risk management program. **Is IEC 62443 certification required?** Not under the SOCI Act. Certification is more common for products and service providers. Asset owners usually benefit from aligning to the standard rather than certifying against it. **Do SOCI obligations apply to my site?** It depends on your sector, asset class and thresholds. Confirm with CISC guidance and legal advice. **What is the most common OT gap?** A common one is a weak or missing boundary between IT and OT, combined with uncontrolled remote access. Both are addressable without stopping production. **How does NetSeg help?** NetSeg runs IEC 62443-aligned risk assessments, designs zones and conduits, and delivers the segmentation work that turns SOCI obligations into controls on the ground. ## Share this post ## Keep reading ### [![](https://www.netseg.io/hs-fs/hubfs/grok-image-e1481c97-ec8a-4680-8151-9a81e3ad295e.jpg?width=1117&height=618&name=grok-image-e1481c97-ec8a-4680-8151-9a81e3ad295e.jpg) How to build and fund a 3–5 year OT security program](https://www.netseg.io/netseg-blog/build-fund-3-5-year-ot-security-program) ### [![](https://www.netseg.io/hs-fs/hubfs/grok-image-b1be8429-497a-4b86-af5b-ff28c2e0431f.jpg?width=1134&height=614&name=grok-image-b1be8429-497a-4b86-af5b-ff28c2e0431f.jpg) How to segment your OT network without stopping production](https://www.netseg.io/netseg-blog/segment-it-from-ot-without-stopping-production) [![](https://www.netseg.io/hs-fs/hubfs/transparent%20white%20logo.png?width=946&height=302&name=transparent%20white%20logo.png)](https://www.netseg.io/) --- [Privacy Policy](https://www.netseg.io/privacy-policy) © 2026. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Leon Poggioli - NetSeg.io", "url" : "https://www.netseg.io/netseg-blog/author/leon-poggioli-netseg-io" }, "dateModified" : "2026-10-17T09:29:29.539Z", "datePublished" : "2026-10-17T09:29:29.000Z", "headline" : "What the SOCI Act and IEC 62443 means for Critical Infrastructure Operators", "image" : [ "https://www.netseg.io/hubfs/grok-image-5091ba93-2bc9-4fa4-b6ce-2e5757852682.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.netseg.io/netseg-blog/soci-act-iec-62443-ot-sites", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.netseg.io/hubfs/transparent%20white%20logo.png" } } } ```