SOCI Act Supply Chain Reforms: What Critical Infrastructure Operators Need to Be Able to Answer

Australia's critical infrastructure regime is entering its most significant revision since the Security of Critical Infrastructure Act was introduced in 2018. On 3 July 2026 the Department of Home Affairs released the second tranche of proposed amendments for consultation, responding to the Independent Review that Dr Jill Slay completed in January 2026. Much of the commentary so far has concentrated on cyber security and on the penalties that attach to non-compliance. The reforms also carry a quieter but consequential change in how operators are expected to understand their supply chains, and that change is worth examining on its own terms.

For operators of electricity, water, gas and communications assets, the supply chain provisions are not primarily about cyber. They are about operational dependency, which is to say the network of third parties whose continued performance your critical function quietly relies on. The reforms ask a more demanding question than the register-based approach that many programs have settled into. They ask what happens to the function when one of those dependencies is no longer there.

What is changing for supply chains

The central new concept is the "relevant operator." A relevant operator is a third party that can operate, configure, maintain, restore or materially influence a critical infrastructure asset or a function that supports it, where the responsible entity depends on that party for the continued operation, availability, integrity or security of the asset. The definition turns on what a party actually does rather than on how its contract is labelled, so a control-system maintenance provider, an outsourced operations centre or a platform vendor can fall within scope even where the commercial arrangement never described them in those words.

Under the proposals, responsible entities would identify these relevant operators, provide information about them to the Cyber and Infrastructure Security Centre, and maintain contractual, governance or operational arrangements sufficient to support oversight, incident response, assurance and remediation. The risk management program would then need to address the dependency itself, including the continuity of the function if the operator fails, withdraws or is compromised. The reforms also widen a number of asset definitions, bringing further freight and logistics infrastructure such as distribution and cold chain facilities into clearer view.

From listing dependencies to understanding them

A dependency register tells you that a relationship exists. It does not tell you what the loss of that relationship would do to the service you are obliged to keep running. The three circumstances named in the reforms are, in practice, three different questions about the same dependency.

When an operator fails, the question is one of availability. If this party became unavailable tomorrow, how far does the disruption travel into the critical function, and how quickly does it arrive. When an operator withdraws, the loss is foreseeable, and the useful question becomes which response holds the function up at an acceptable cost, whether that is an alternate provider, a buffer, a reconfiguration or a contractual right you already hold. When an operator is compromised, the failure is one of integrity rather than availability, and the path the disruption takes through the system is often different again.

Answering those questions well is less a documentation exercise than an analytical one. It calls for a view of how the parts of the system connect to one another, so that the effect of removing any single part can be reasoned about rather than guessed at.

What readiness looks like in practice

The practical work divides into four areas, and none of it requires waiting for the amendments to be finalised. It begins with visibility, which means mapping the third parties your critical functions depend on operationally and being honest about those whose loss would be difficult to absorb. From there it moves to consequence, forming a defensible view, for each material dependency, of what its failure, withdrawal or compromise would do to the function, expressed in terms that a board and an assurer can follow. The third area is arrangement, ensuring that the contractual and governance terms with those parties actually give you the access, cooperation and information an incident would demand, since the reforms expect precisely that. The last is continuity, knowing for each material dependency which response preserves the function and what it costs, so that the plan reflects a considered choice rather than a placeholder.

The reforms also introduce periodic independent assurance that the risk management program is designed and operating effectively. Assurance of this kind tends to reward analysis that is reproducible and reasoned over narrative that rests on a single workshop. An operator who can show why a particular mitigation was chosen, and what the loss of a dependency would have cost without it, stands on firmer ground than one who can only show that a plan exists.

The direction of travel

Read together, the supply chain provisions move the regime from recording dependencies toward understanding them, and from asserting that a plan exists toward showing that it would hold. For critical infrastructure operators, the sensible response is not to wait for the final drafting. It is to build the capability to answer the continuity question for the dependencies that matter most, because that capability is what the reforms, the assurance process and the underlying risk all point toward.

‍