Announcement date
16 June 2026
Link to announcement
https://www.cisc.gov.au/news-media/archive/article?itemId=1412
https://www.legislation.gov.au/F2026L00701/asmade/text
Problem being addressed
An Impact Analysis prepared by the Department of Home Affairs exploring options to manage risk for critical infrastructure asset classes was published in February 2023: Critical Infrastructure Risk Management Program I The office of Impact Analysis
Since then, the evolving threat landscape has meant both Government and industry need to be able to anticipate and be ready to respond to unpredictable changes in: the global geopolitical climate; supply chains; foreign ownership, control or influence; espionage; and emerging security threats from novel technologies.
Proposal
The addendum considers three options to address the need for enhanced risk management requirements for in-scope critical infrastructure asset classes, using an approach that reflects the incremental nature of the proposed changes over and above the costs of activities already required under existing Critical Infrastructure Risk Management Program (CIRMP) Rules:
Option 1: Status Quo
Option 2: Improved Awareness
Option 3 (preferred): Enhanced CIRMP Requirements - targeted enhanced requirements for nine already in-scope asset classes.
The Department of Home Affairs used break-even analysis to estimate the benefits of option 3 in terms of reduced expected annual costs of critical infrastructure disruption including: reducing the severity or duration of incidents; improving preparedness and response; reducing cascading impacts across interconnected systems; and improving board and government visibility of material risks. The addendum estimates that Option 3 would have a net benefit if it reduces expected annual disruption costs by at least the average annual regulatory burden, and that avoidance of one whole major incident each year would produce a net benefit.
Regulatory burden
The Department of Home Affairs estimates that option 3 would have a central increase in additional annual regulatory costs to businesses of $57.5 million.
OIA comments
The OIA does not formally assess addenda, but offers the following comments on the quality of the document. The addendum addresses the seven IA questions and follows an appropriate policy development process. The addendum explores implementation feasibility and how staged implementation coupled with industry engagement and flexibility where necessary would improve outcomes and achieve Government objectives. The addendum also reflects best practice consultation principles and indicates how stakeholder views both validated the need for intervention and shaped reforms being considered.