Security of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules 2025

The Rules introduce and presume several core concepts that determine coverage and downstream obligations. Those concepts are expressed both in new definitions (Part 1) and in specification of the classes of assets and risks the Secretary and a responsible entity must treat seriously.

Relevant critical infrastructure asset: The instrument defines a relevant critical infrastructure asset as either (a) a critical telecommunications asset owned or operated by a carrier, or (b) a “relevant carriage service provider asset” (s 5). The latter is a critical infrastructure asset used in connection with the supply of at least 20,000 active total carriage services or one used in connection with carriage services supplied to a Commonwealth entity (s 4 definition of relevant carriage service provider asset). The instrument notes that a qualifying data storage system is taken to be part of the critical infrastructure asset per subsection 9(7) of the Act (s 5 note).

CIRMP: Short for “critical infrastructure risk management program.” The Rules specify what a CIRMP must identify and achieve: operational context, material risks (including a catalogue of specified risks in s 8), minimisation/elimination to the extent reasonably practicable, mitigation of relevant impacts, regular review mechanisms and currency maintenance (s 9).

Material risks and hazards: Section 8 enumerates material risks that must be treated as material for the Act’s purposes. These include stoppage/major slowdown, impairment prejudicial to social/economic stability or national security, substantive loss or manipulation of critical components, interference with ICT essential to the asset, storage/processing of operationally relevant information outside Australia, remote access to operational control/monitoring systems, compromise/theft/manipulation of communications, unauthorised use by major suppliers/critical workers/managed service providers, and impacts on availability/integrity/reliability/confidentiality of business-critical data storage (s 8).

Hazard-specific content: The Rules require that CIRMPs include hazard-specific processes for cyber and information security (s 11), personnel hazards including identifying critical workers and controlling their access (s 12), background checks (s 13), supply-chain hazards and listing major suppliers (s 14), and physical and natural hazards including identification of physical critical components and access control/testing (s 15).

Frameworks and maturity levels: For cyber/information security, the Rules require compliance with one of prescribed international/ national frameworks as in force from time to time (s 11(3) table items 1-5) and, for assets owned or operated by carriers, stricter maturity level requirements (s 11(4) table). The Act’s sections 30AN and 30ANA are referenced as the mechanism to incorporate those documents as in force (s 11 notes).

Background checks and AusCheck: “Background check” is defined by reference to the AusCheck Act; the Rules permit but do not require responsible entities to use the AusCheck scheme (s 13(1) note). If AusCheck is used, the check must include assessment of AusCheck Act matters (paras 5(a)-(d) of that Act), criminal history criteria as specified, and both electronic and in-person identity verification (s 13(2)). The Rules also require the responsible entity to notify the Secretary if a background check is no longer required (s 13(3)).

Notification obligations: The responsible entity must provide to the Secretary all information reasonably necessary to assess proposed changes and, as far as reasonably practicable, the enumerated items in s 17(2). The list includes risk assessment, written evidence of evaluation of controls and alternatives, hardware/software details, major supplier contracts, schematics, network-to-network interface descriptions, and a project timeline.

Transitional timing: Part 3(2) disapplies Part 2A of the Act for a specified transitional period, defined as ending on the later of 6 months after registration of the Rules and 6 months after the asset becomes relevant (s 7(2)). The framework compliance timelines in s 11(3)-(4) are measured from the end of that applicable transitional period.

Together, these concepts establish the perimeter (what assets), the required substance of mitigation (what a CIRMP must do and document), the timelines for meeting framework standards, and the notification duties for proposed changes.

The Rules target a narrow set of entities and assets within the telecommunications sector and any third parties whose actions are implicated by required assessments or notifications.

Responsible entities: The primary legal duty-bearer is the responsible entity for a relevant critical infrastructure asset as understood under the Act, which the Rules prescribe in relation to critical telecommunications assets owned or operated by carriers and relevant carriage service provider assets (s 5; s 6; s 16). Responsible entities are required to prepare, adopt, maintain, review and keep current a CIRMP that meets the detailed content rules (s 9-15). They must also provide notifications to the Secretary about certain changes or proposed changes to a telecommunications service or system and supply the specified material in s 17.

Carriers: The instrument singles out assets owned or operated by carriers for heightened requirements. A CIRMP for a carrier-owned/operated critical telecommunications asset must comply with a framework in an enumerated list and meet specified maturity-level conditions within 24 months after the end of the transitional period (s 11(4)). The Rules therefore impose a differentiated standard on carriers as a class.

Relevant carriage service providers: A second class of affected entities are responsible entities for “relevant carriage service provider assets,” defined by a threshold of 20,000 active total carriage services or use in connection with carriage services supplied to a Commonwealth entity (s 4). These entities fall within the “relevant critical infrastructure asset” definition (s 5) and must comply with the CIRMP content and notification requirements.

Major suppliers and managed service providers: While not directly made responsible for CIRMPs by the Rules, major suppliers and managed service providers are foregrounded as sources of material risk (s 8(h), s 14). The Rules require responsible entities to list and assess major suppliers in the CIRMP and to consider risks arising from misuse of privileged access or supply-chain disruption (s 14). That produces an indirect compliance demand on major suppliers to provide contract and technical details to responsible entities on request (s 17(2)(d)).

Critical workers: The Rules define “critical workers” (drawn from the Act’s definitions) and require responsible entities to list them, control access to critical components, and assess their suitability (s 12). The Rules also apply to contractors and other persons who act as critical workers because access controls, background checks, off‑boarding and access revocation obligations apply equally (s 12, s 13).

The Secretary and Commonwealth agencies: The Secretary is the recipient of various notifications and may use AusCheck advice when considering suitability (s 13(4)). The Rules also reference Commonwealth entities as users of carriage services that trigger the relevant carriage service provider threshold (s 4).

Third‑party vendors and systems with interconnections: Any third-party system with network-to-network interfaces to a relevant critical telecommunications asset may fall into the notification and CIRMP documentation obligations, because those interfaces must be documented under s 17(2)(e)(iv) and a CIRMP must describe interdependencies (s 10(b)).

Who pays and who decides: Practically, responsible entities will bear the direct costs of preparing and complying with CIRMPs, performing background checks (including AusCheck checks if chosen), implementing cybersecurity frameworks and testing physical security, and assembling and disclosing documentation to the Secretary (s 9-15; s 17). The Secretary is the decision-maker for assessing notifications and receives material and advice under the AusCheck scheme (s 13(4)-(5)). The Rules allocate compliance costs to responsible entities while certain assessment and enforcement functions rest with the Secretary under the Act.

The Rules specify duties for responsible entities and outline procedural rights by reference to the Act. Below are the substantive duties the instrument creates or clarifies, linked to the relevant sections.

Duty to treat specified assets as relevant: The Rules prescribe that a relevant critical infrastructure asset includes a carrier-owned/operated critical telecommunications asset and a relevant carriage service provider asset (s 5). This makes Part 2A obligations (CIRMP obligations) and Part 3 notification obligations apply to those assets (s 6, s 7(1), s 16).

CIRMP content duties: Responsible entities must prepare and adopt a CIRMP that, at minimum, identifies the operational context; identifies material risks including the specific list in s 8; minimises/eliminates material risks so far as reasonably practicable; mitigates the relevant impact of hazards; and includes mechanisms for review and maintaining currency (s 9(a)-(e)). These requirements operationalise paragraph 30AH(1)(c) of the Act.

Duty to consider certain matters when adopting a CIRMP: When deciding whether to adopt a CIRMP, a responsible entity must have regard to outcome descriptions, interdependencies with other assets, the positions responsible for developing/implementing the CIRMP and for review/updating, contact details for those positions, the risk management methodology, and circumstances triggering review (s 10(a)-(f)).

Cyber and information security duties: CIRMPs must include processes to minimise or eliminate material cyber/information security risks and to mitigate their impacts (s 11(2)). They must also comply with one of the prescribed frameworks (table in s 11(3)) and meet specified maturity levels within 12 months after the end of the transitional period (or 24 months for carrier-owned assets, s 11(3)-(4)), or establish and maintain an equivalent framework (s 11(5)).

Personnel and background check duties: Responsible entities must identify critical workers and only permit access to critical components where a worker is assessed as suitable (s 12(1)(a)-(b)). They must minimise or eliminate material risks from malicious/negligent persons and manage off-boarding risks (s 12(1)(c)). If the entity elects AusCheck for suitability assessments, it must ensure checks include matters from the AusCheck Act (paras 5(a)-(d) of that Act) and criminal history criteria, and must perform both electronic and in-person identity verification (s 13(1)-(2)). The entity must notify the Secretary if a background check requirement is removed for a critical worker (s 13(3)). When assessing suitability, the responsible entity must consider AusCheck advice under specified AusCheck Regulations provisions and assess whether access would be prejudicial to security (s 13(4)).

Supply chain duties: CIRMPs must, as far as reasonably practicable, minimise or eliminate material supply-chain risks (unauthorised access, misuse of privileged access, disruption due to supply chain issues, threats to people/assets/equipment/products/services/distribution/IP, major suppliers, and failures in other assets/entities in the supply chain) and mitigate their relevant impacts (s 14(1)). Entities must have regard to listing major suppliers and describing supply-chain hazards in the CIRMP (s 14(2)).

Physical and natural hazards duties: CIRMPs must identify physical critical components, minimise/eliminate and mitigate material risks from physical security hazards and natural hazards, respond to unauthorised access incidents, control access to physical critical components (restrict to critical workers or accompanied visitors), and test security arrangements for effectiveness in detecting, delaying, deterring, responding and recovering (s 15(1)(a)-(e)). Entities must have regard to describing critical components, hazards, security arrangements and natural hazards in the CIRMP (s 15(2)).

Notification duties for proposed change: Responsible entities for carrier-owned critical telecommunications assets must provide the Secretary with all information reasonably necessary for an assessment of a proposed change and, as far as reasonably practicable, the detailed items listed in s 17(2) , risk assessment, written evidence of controls and alternative options, software/hardware details (including version numbers), major supplier contracts, detailed schematics and system documentation, timelines, and any other relevant information (s 17(1)-(2)).

Procedural rights and discretion: The Rules reflect that responsible entities have some discretion: for example, they are not required to use AusCheck (s 13(1) note), and they may comply with an “equivalent” framework instead of a named framework (s 11(5)). The Rules also require “as far as it is reasonably practicable to do so,” which embeds a proportionality or practicability consideration in several duties (s 9(c), s 11(2), s 14(1)(a), s 15(1)(b)). However, what is reasonably practicable is not defined in the Rules; it will be assessed against the Act and administrative practice.

Who decides: The responsible entity decides what internal positions will be responsible for implementation and review (s 10(c)-(d)), whether to use AusCheck for background checks (s 13(1) note), and whether to adopt an equivalent cybersecurity framework (s 11(5)), but the Secretary assesses notifications and receives AusCheck-related advice (s 13(4)). The Rules therefore partition operational discretion to entities and assessment/discretion to the Secretary under the Act.

The Rules do not themselves specify criminal offences, penalty amounts or enforcement mechanisms in express terms. Instead they operate by prescribing matters for the purposes of provisions in the Security of Critical Infrastructure Act 2018 and referencing the Secretary’s assessment role under the Act. The enforcement regime therefore depends on the Act’s enforcement and penalty provisions.

Prescriptive function rather than standalone sanctions: Sections 6, 7(1) and 16 explicitly apply portions of the Act to the specified assets by prescription (s 6 applies s 30EB; s 7(1) applies paragraph 30AB(1)(a); s 16 applies subsection 30EC(1)). Those sections in the Act contain obligations and, in the Act, are linked to compliance requirements and possible contraventions. The Rules make assets subject to those Act provisions, but the Rules themselves do not create separate fines or criminal penalties.

Notification and Secretary assessments: The duty to provide the Secretary with information for proposed changes is set out in s 17. The Secretary’s statutory power to require information and to assess changes comes from the Act (the Rules reference the Secretary’s assessment function under subsection 30EC(1)). Non-provision of required notifications or of “all information reasonably necessary” for assessment may give rise to compliance action under the Act; any specific penalties would arise from the Act rather than the Rules.

Background checks and AusCheck interface: The Rules require that, if an entity chooses to use the AusCheck scheme, the check must include specified elements and that the entity must consider AusCheck advice specified in the AusCheck Regulations (s 13(2)-(4)). The AusCheck scheme and its regulations contain separate statutory frameworks and obligations; the Rules require coordination but do not restate AusCheck enforcement measures.

Compliance deadlines and framework attainment: The Rules require entities to meet conditions in prescribed cybersecurity frameworks within fixed periods after the end of the transitional period (12 months for assets in s 11(3); 24 months for carrier-owned assets in s 11(4)). Failure to meet those conditions will be non-compliance with the CIRMP content requirements and thus with the Act’s Part 2A obligations, and may therefore attract enforcement under the Act.

Administrative discretion: The Rules repeatedly require actions to be taken “as far as it is reasonably practicable to do so” (for minimisation or elimination of risks in s 9(c), s 11(2), s 14(1)(a) and s 15(1)(b)). That standard signals that enforcement will involve assessment of proportionality and practicability, and such assessment will be administered under the Act by the Secretary or authorised officers.

What is not provided here: The Rules do not list the Act’s specific enforcement powers, coercive information powers, civil penalties, criminal offences, or particulars of remedial directions. Those are governed by the Act itself. A practitioner must therefore consult the Security of Critical Infrastructure Act 2018 for explicit penalty provisions, enforcement mechanisms and processes that apply when these Rules are contravened.

The Rules are expressly formulated to interact with the Security of Critical Infrastructure Act 2018 and with the AusCheck Act and Regulations. They also incorporate external technical and standards documents via the mechanism in the Act.

Primary interaction with the Act: The Rules operate by prescribing assets and CIRMP requirements “for the purposes of” particular Act provisions: subsection 30EB(1) (s 6), paragraph 30AB(1)(a) (s 7(1)), subsection 30AB(3) (s 7(2) transitional carve-out), subsection 30AH(8) (material risks - s 8), paragraph 30AH(1)(c) (CIRMP content - s 9 and s 11-15), subsection 30AKA(1) (adoption criteria - s 10 and various s 12-15 cross‑references), and subsection 30EC(1) (notification obligations - s 16-17). The Rules therefore function as subordinate legislation that fills content requirements and applies the Act to particular classes of telecom infrastructure. Any breach of the obligations in the Rules will be interpreted against and enforced under the Act.

Interaction with AusCheck Act and Regulations: The Rules define “background check” by reference to the AusCheck Act and treat background checks under that scheme as an authorised way to assess critical workers (s 4 definition; s 13(1)). They require that AusCheck checks, if used, include matters in paragraphs 5(a)-(d) of the AusCheck Act and criminal history criteria as specified by the Rules (s 13(2)). The Rules also require consideration of advice from the Secretary under particular provisions of the AusCheck Regulations (s 13(4)(a)(i)-(iv)). This creates a procedural cross-dependence: responsible entities may rely on AusCheck processes, but that reliance integrates the AusCheck regulatory gatekeeping and information flows into the CIRMP regime.

Interaction with standards and external frameworks: Section 11(3)-(4) requires compliance with frameworks contained in listed documents “as in force from time to time,” and the notes reference sections 30AN and 30ANA of the Act as the incorporation mechanism. That ties the Rules to external documents (AS/NZS ISO/IEC 27001:2023; Essential Eight; NIST Cybersecurity Framework; DOE C2M2; AESCSF Framework Core), and leaves scope for those frameworks to be updated without amending the Rules directly. The Rules permit equivalent frameworks as an alternative (s 11(5)). Practically, this means alignment of CIRMPs with recognised cybersecurity standards and a mechanism for the Act to capture updates to those documents.

Telecommunications law connection: The Rules use the term “communications” as defined in the Telecommunications Act 1997 (s 4 definition note referencing Telecommunications Act). The definition of “relevant carriage service provider asset” turns on the supply of carriage services (broadband, fixed telephone, public mobile services, voice-only services) and active service thresholds (s 4). This creates an intersection between the Act/Rules and the Telecommunications Act ecosystem: operational definitions, industry concepts and possibly regulatory overlaps (e.g. obligations on carriers under the Telecommunications Act) will influence identification and treatment of assets.

Data privacy and cross-border data flows: The Rules identify as a material risk the storage, transmission or processing of operationally relevant information outside Australia, and enumerates types of operational data (layout diagrams, schematics, geospatial information, configuration, operational tolerances, and data a reasonable person would consider confidential or sensitive) (s 8(e)). This draws on privacy and data-location concerns, and compliance may require coordination with privacy and security law obligations, though the Rules do not themselves specify privacy regulatory consequences.

Contract and procurement law effects: The Rules require responsible entities to describe major suppliers, contracts and outsourcing arrangements for any hardware, software or third-party service relevant to a proposed change (s 17(2)(d)). That creates a direct touchpoint with procurement contracts and non-disclosure or confidentiality arrangements. Responsible entities therefore may need contractual cooperation from vendors to produce required schematics and documentation without breaching existing contractual confidentiality obligations.

Interagency interface: The Rules make the Secretary the recipient of multiple notifications and of advice from the AusCheck Secretary in specified circumstances (s 13(4)). This implies interagency information flows and reliance on administrative processes established under the Act and the AusCheck framework.

In short, the Rules integrate the Act’s risk-management and notification architecture with telecommunications sector definitions, AusCheck background-check processes, and specified cybersecurity frameworks, creating cross‑disciplinary compliance obligations that will interact with telecommunications regulation, procurement, data security and privacy laws, and AusCheck procedural law.

The instrument itself records its making and date, but contains no subsequent amendment entries within the text provided. What is in the instrument is:

• The Rules were made by Tony Burke, Minister for Home Affairs and Minister for Cyber Security, and dated 1 March 2025 (opening pages). The instrument is made under section 61 of the Security of Critical Infrastructure Act 2018 (s 3).

• The commencement clause (s 2) sets the commencement as the later of registration and the commencement of Parts 1 and 2 of Schedule 5 to the Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024. This ties commencement to an earlier amendment Act and indicates staged commencement may be relevant.

No amendments are recorded inside the text provided. There are several provisions that allow external documents to be treated “as in force from time to time” (s 11 note referencing sections 30AN and 30ANA of the Act). That mechanism is an indirect amendment pathway for technical frameworks: updates to the external frameworks incorporated under the Act will alter the content a CIRMP must meet without formally amending these Rules. The Rules also permit responsible entities to comply by adopting equivalent frameworks (s 11(5)), which provides an internal flexibility mechanism rather than a formal amendment.

If a practitioner needs a formal amendment chronology, the instrument as provided shows only the initial making and commencement linkage. Any further amendments or legislative history would need to be checked against the Federal Register of Legislation or the legislative instrument register. The Rules themselves contain no revision history, schedules, or amendment notes beyond the single signing and date.

The Rules, as supplied, contain no reference to litigation, legal challenges, determinations, or case law. There are no judicial decisions cited within the instrument, and the text contains no notice of legal proceedings or adjudications involving these Rules.

Because the Rules function by prescribing how provisions of the Security of Critical Infrastructure Act 2018 apply to specified telecommunications assets, litigation concerning their application would of necessity arise under or alongside the Act. Any legal challenges about interpretation, reasonable practicability, the scope of “relevant critical infrastructure asset,” the content required in CIRMPs, the Secretary’s assessment of notifications, or whether a background check meets the required standard would be brought by reference to the Act and these Rules as subordinate legislation.

Practical implication for practitioners: absence of an internal litigation history means there is no domestic jurisprudence provided with the instrument to interpret ambiguous concepts such as “as far as it is reasonably practicable to do so,” the scope of “major supplier,” or the threshold for the 20,000 active total carriage services. Courts or tribunals will likely interpret those terms against the Act, administrative law principles, and the factual context of particular disputes. Until such decisions emerge, guidance will come from the Act, the AusCheck Regulations where invoked, agency guidance (if issued), and technical frameworks referenced in s 11 which may themselves contain interpretive material.

If litigation appears to be a near‑term risk for an affected entity, the Rules suggest lines of contest: the correct identification of a relevant critical infrastructure asset (s 5 and s 4 definitions), whether a CIRMP meets the prescriptive elements in s 9-15, and whether frameworks have been or can be applied within the specified timelines in s 11(3)-(4).

The Rules contain multiple drafting and operational features that can produce practical pitfalls if not anticipated. Below are concrete issues and traps that responsible entities and advisers should treat as immediate attention items.

1. Narrow but decisive asset definition: The definition of “relevant carriage service provider asset” hinges on a threshold of 20,000 active total carriage services (s 4). Entities near that threshold must monitor active service counts carefully. The requirement also applies where the asset is used in connection with carriage services supplied to a Commonwealth entity (other than a Commonwealth body corporate). Miscounting or incorrectly assessing whether services are “used in connection” with Commonwealth carriage services can change whether Part 2A applies (s 5).

2. Transitional timing is layered: Part 3(2) disapplies Part 2A for an asset during a transitional period that ends on the later of 6 months after the instrument’s commencement and 6 months after the asset becomes relevant (s 7(2)). The compliance deadlines for framework adoption are expressed as months after the end of that applicable period (s 11(3)-(4)). That layering means different assets may face different effective timelines depending on when they become relevant and on instrument commencement. Responsible entities must map these timelines precisely.

3. “As far as it is reasonably practicable to do so”: Several obligations (minimise/eliminate material risks; mitigate impacts; supply chain and physical security duties) are qualified by “as far as it is reasonably practicable to do so” (s 9(c), s 11(2), s 14(1)(a), s 15(1)(b)). The standard is open-ended and will be applied against the Act and administrative practice. Entities cannot assume a one-size-fits-all test; documentation of risk assessments and reasoned judgments will be essential to defend “reasonably practicable” positions.

4. AusCheck usage is optional but if used, strict procedural elements apply: The Rules do not require entities to use AusCheck (s 13(1) note), but if an entity opts in, the background check must include AusCheck Act matters and must perform both electronic and in-person identity verification, and criminal history criteria are applied (s 13(2)). There is also an obligation to notify the Secretary if a background check is no longer required for a critical worker (s 13(3)). An entity switching away from AusCheck must manage notification and record-keeping timings.

5. Identity verification requirement: If AusCheck is used, the background check must include both an electronic identity verification check and an in-person identity verification check (s 13(2)(b)). That has immediate operational cost and logistical implications for onboarding and contractor management.

6. Documentation and disclosure burden for changes: The notification regime for changes requires, as far as reasonably practicable, detailed schematics, system documentation, and network-to-network interface descriptions (s 17(2)(e),(e)(iv)), plus details of software and hardware including version numbers (s 17(2)(c)), and contracts for major suppliers (s 17(2)(d)). Responsible entities must therefore maintain up-to-date system diagrams and supplier contract information that may contain commercially sensitive material and may require vendors to cooperate (potential contractual conflicts to manage).

7. Major supplier identification and indirect effects: The Rules emphasise “major suppliers” and require listing them in a CIRMP and describing supply-chain hazards (s 14(2)). The instrument does not define “major supplier” beyond noting “any vendor that, by nature of the product or service they offer, has a significant influence over the security” (s 4). This is a factual, potentially wide-ranging test: suppliers of widely distributed hardware or firmware, managed service providers, and cloud vendors may fall within it. Responsible entities must perform supplier mapping.

8. Cross-border data risk: The instrument specifically treats storage, transmission or processing of operationally relevant information outside Australia as a material risk, and lists types of sensitive operational data (s 8(e)). Systems that use third-party offshore storage or are multi-jurisdictional need to document flows and consider whether migration or contractual restrictions are required.

9. Carrier-operated assets face higher maturity requirements: Carrier-owned assets must meet higher maturity levels (Essential Eight maturity level two, DOE C2M2 level two, AESCSF profile two) within 24 months after the end of the transitional period (s 11(4)). Entities operating carrier assets may need substantial uplift compared to other relevant assets.

10. Equivalence of frameworks requires defensible mapping: The Rules allow compliance via an “equivalent” framework (s 11(5)), but equivalence is a facts-and-evidence test. Responsible entities must document how their chosen framework maps to the specified framework requirements and be ready to demonstrate equivalence to the Secretary.

11. Secretary reliance and AusCheck advice: The Rules require consideration of advice from the Secretary under specified AusCheck Regulations provisions (s 13(4)(a)(i)-(iv)). Entities may face administrative decisions based on such advice and should document both the basis for and outcomes of AusCheck-related communications.

12. No explicit limitation on disclosure of sensitive material to the Secretary: The Rules ask for detailed material for proposed changes; they do not themselves set out privileged channels or protections for commercially sensitive information beyond the general administrative law context. Responsible entities should anticipate handling and possible disclosure risks and should prepare confidentiality arguments when supplying vendor contracts and schematics.

In practice, these “gotchas” combine to make timely inventorying, supplier mapping, asset diagramming, personnel risk assessment, and policy drafting urgent first steps for any entity close to or over the thresholds in s 4.

Below is a practical compliance roadmap mapped to the instrument’s sections. It is procedural and targeted to responsible entities for relevant critical telecommunications assets (carrier-owned and relevant carriage service provider assets).

Step 0 , Confirm coverage and timelines (s 5; s 7(2); s 2)

• Determine whether the asset is a “critical telecommunications asset” under the Act and whether it is owned or operated by a carrier or meets the “relevant carriage service provider asset” thresholds (20,000 active total carriage services or use in connection with Commonwealth carriage services) (s 4, s 5). This determines which obligations in Part 3 and Part 4 apply.
• Map the end date of the transitional period specified in s 7(2): the later of 6 months after instrument commencement and 6 months after the asset became relevant. Calculate compliance deadlines for framework attainment (12 months after that end for most assets; 24 months after that end for carrier-owned assets under s 11(3)-(4)).

Step 1 , Inventory and operational context documentation (s 9(a), s 10(a)-(b))

• Create a documented operational context for the asset: its process outcomes, services provided, interdependencies with other assets (internal and external), and network-to-network interfaces (s 9(a); s 10(a)-(b)). This includes mapping physical critical components (s 15(1)(a)) and identifying business-critical data and where it is stored/processed (s 8(e); s 9).

Step 2 , Risk identification and assessment (s 8; s 9(b); s 17(2)(a))

• Perform a risk assessment that explicitly considers each material risk category listed in s 8 (stoppage/slowdown, impairment to social/economic stability or national security, loss/manipulation of critical components, interference with ICT, data outside Australia, remote access to control/monitoring systems, compromise/theft/manipulation of communications, unauthorised use by suppliers/workers/MSPs, and business-critical data storage impacts).
• Document how supply-chain hazards, personnel hazards, physical and natural hazards, and cyber hazards bear on those material risks (s 14; s 12; s 15; s 11).
• Retain evidence of the risk methodology used and the rationale for prioritisation (s 10(e)).

Step 3 , Draft and adopt a CIRMP meeting s 9-15 content requirements

• Ensure the CIRMP identifies operational context, enumerates material risks including s 8 items, and sets out mitigation and minimisation steps “as far as reasonably practicable” (s 9(a)-(c)).
• Include mechanisms for periodic review (s 9(d)) and processes to keep the CIRMP current (s 9(e)). Define triggers for review per s 10(f).
• Assign responsibility for developing/implementing and for review/updating the CIRMP; include named positions and contact details (s 10(c)-(d)).
• For cyber/information security, select a framework listed in s 11(3)-(4) and plan to meet the indicated maturity level within the stated timeframe, or document an equivalent framework with mapping evidence (s 11(3)-(5)). For carrier-owned assets, plan for the higher maturity level obligations (s 11(4)).
• For personnel hazards, list critical workers, document access control policies, off-boarding procedures, and suitability assessment processes (s 12).
• For physical and natural hazards, document critical physical components, access control measures, incident response procedures for unauthorised access, and testing regimes for security arrangements (s 15).

Step 4 , Implement background check processes (s 13)

• Decide whether to use the AusCheck scheme. If using it, ensure background checks include the AusCheck Act matters and criminal history criteria, plus both electronic and in-person identity verification (s 13(1)-(2)). Record procedures for these checks and for considering AusCheck advice under the listed AusCheck Regulations provisions (s 13(4)).
• If not using AusCheck, document the alternative suitability assessment process and include it in the CIRMP as required by s 13(1) note.
• Put in place procedures to notify the Secretary if a background check is no longer required for a critical worker (s 13(3)).

Step 5 , Supplier and supply-chain measures (s 14)

• Identify and list major suppliers and maintain up-to-date contracts and outsourcing arrangements related to hardware, software and third-party services (s 14(2); s 17(2)(d)).
• Adopt supplier assurance controls that address unauthorised access, misuse of privileged access, supply-chain disruption, threats across supply-chain components and potential failures or capacity issues (s 14(1)(a)(i)-(vi)). Document mitigation measures and contingency plans.

Step 6 , Technical and documentation readiness for notifications (s 17)

• Maintain detailed schematics and system documentation that describe interfaces with existing elements, security controls, how business-critical data is used/stored, and network-to-network interfaces with third-party systems (s 17(2)(e)(i)-(iv)).
• For any proposed change, prepare a risk assessment that considers material risks, supply-chain hazards, physical/natural hazards, personnel hazards, and cyber hazards (s 17(2)(a)).
• Prepare written evidence evaluating controls and alternative changes (s 17(2)(b)).
• Record software and hardware details including version numbers and major components (s 17(2)(c)).
• Collect contracts and outsourcing arrangements for major suppliers implicated in the change (s 17(2)(d)).
• Prepare a project timeline and compile any other relevant information (s 17(2)(f)-(g)).

Step 7 , Testing, review and recordkeeping (s 9(d)-(e); s 15(1)(e))

• Test security arrangements to detect, delay, deter, respond and recover from breaches (s 15(1)(e)). Maintain logs and test records to show the effectiveness of measures.
• Schedule and document regular reviews of the CIRMP and record modifications, rationale and approvals (s 9(d)-(e)). Ensure contact details and responsible positions are current (s 10(c)-(d)).

Step 8 , Governance, sign-off and board/responsible officer oversight

• Ensure the CIRMP adoption, major changes, and framework compliance plans are reported to the board or responsible senior management and that responsibilities are assigned and contact details included (s 10(c)-(d)).
• Document the entity’s risk management methodology and its application to decisions required by the CIRMP (s 10(e)).

Step 9 , Engagement with vendors and contractual remediation

• Review vendor contracts for confidentiality provisions that may impede production of schematics or contract copies required under s 17(2). Where necessary, renegotiate clauses to allow disclosure to the Secretary or include arrangements for secure transfer of sensitive material.
• Obtain vendor assurances about software/hardware version control and patching; require notification of changes to major suppliers and managed service providers.

Step 10 , Administrative interactions with the Secretary and AusCheck

• Establish points of contact for notifications to the Secretary and procedures to respond to requests for further information under the Act as applied by these Rules (s 17(1)).
• Where AusCheck is used, record interactions with the AusCheck Secretary and consider AusCheck advice when making suitability decisions (s 13(4)).

Ongoing compliance essentials

• Keep a compliance calendar keyed to the transitional period end and to the 12/24 month framework attainment deadlines (s 7(2); s 11(3)-(4)).
• Maintain audit trails and contemporaneous documentary evidence demonstrating that decisions were made “as far as reasonably practicable to do so,” including cost/benefit considerations, alternative options considered and formal sign-offs (s 9(c), s 11(2), s 14(1)(a), s 15(1)(b)).
• Prepare secure, access-controlled repositories for schematics and supplier contracts so they can be produced to the Secretary (s 17(2)(d)-(e)).

These steps are a practical mapping of the Rules’ text. Responsible entities should pair this roadmap with contemporaneous advice about how the Act’s enforcement provisions will be applied in practice and with any guidance the Department of Home Affairs or the Secretary may publish.