HomeServicesAPRA & SOCI Regulatory Readiness

Australian regulated and critical infrastructure environments · Melbourne & Australia

APRA & SOCI Regulatory Readiness

Understand the obligations and assurance evidence relevant to your role before starting a costly compliance program.

Request a scoped discussion ↗Explore all services

The problem we solve

Start by checking who the rules apply to.

Australian requirements are not interchangeable. APRA prudential standards bind specified regulated entities. The SOCI Act creates obligations for particular critical infrastructure entities and assets. Suppliers may also face separate requirements through customer contracts.

This is a specialist, case-by-case readiness service. We begin by establishing the organisation’s role, sector, assets and the specific requirement that is driving the enquiry.

The result you are buying

Separate your actual obligations from customer expectations

Identify which requirements relate to your legal role, contracts and systems. Then find out where supporting evidence is missing.

Your takeaway: A scoped applicability/evidence matrix and action plan, with clear legal-advice and assurance boundaries.

See our sample reporting style ↗

Inside the engagement

How we review regulatory and customer expectations

The checks below are representative. We agree the actual systems, evidence and testing methods before work begins.

Initial applicability and role assessment

Identify the legal entity and its role: regulated entity, supplier, asset operator or responsible entity
Check the actual contract, customer request or identified obligation rather than assuming a standard applies
Agree the clauses, hazard categories, reporting and governance elements to be considered with the client’s advisers

APRA-aligned information security and resilience

For CPS 234-related work, review information asset classification, assigned security accountabilities and proportionate controls
Consider evidence of control testing, third-party oversight, incident handling and exceptions relevant to the agreed scope
For CPS 230-related work, review critical-operation dependencies, service-provider governance and business-continuity evidence where relevant

SOCI and CIRMP readiness

For identified in-scope infrastructure, examine existing risk management documentation and asset-level ownership
Discuss cyber, supply-chain, physical, personnel and natural hazard considerations as applicable to the required CIRMP
Review how incidents, material changes and risk escalation are identified internally. Regulatory reporting remains your organisation’s responsibility

Findings and action planning

Map sampled practices and evidence to agreed obligations or contractual controls
Highlight requirements needing legal clarification, missing evidence or operational testing
Produce a risk-prioritised action register with owner, dependency and suggested completion sequence

What an assessment can uncover

An example of a regulatory-readiness question

This is a fictional example to show how we explain a finding. It is not a claim about any customer.

What the supplier receives

A technology supplier receives a customer request referencing CPS 234 and the SOCI Act without any explanation of the obligations it is expected to meet.

Where confusion starts

Uncritical responses can create unsupported legal claims or unnecessary compliance work.

How to clarify it

Confirm the legal entity, buyer contract and relevant operational services; record questions for qualified legal or regulatory advice.

Information we ask for

Information needed to establish the boundary

We collect only what is required for the agreed review. Read-only access, supervised walkthroughs and redacted exports are preferred where practical.

Identified entity, regulated status or relevant asset details confirmed by the customer
Relevant contract clauses, regulatory correspondence and legal applicability advice
Risk registers, material supplier arrangements, asset classifications and control libraries
Incident response, business continuity, testing and governance reports
Selected policy, service-provider assurance and control test records

What you take away

An obligations-to-evidence view

Your report will connect observations to evidence and recommend practical actions, with assumptions and limits clearly stated.

Assumptions and applicability decision log, with unresolved legal questions flagged
Requirements-to-evidence matrix for the precisely agreed framework and boundary
Risk-ranked findings, limitations and remediation/action register
Leadership briefing with options for deeper legal, OT or assurance specialists where needed

The way we work

A scoped review, not a blanket compliance claim

Scope the request
Confirm objectives, systems, contacts, authorisations and delivery boundaries in writing.
Review and validate
Interview the relevant people and check available evidence against the agreed criteria.
Work through the findings
Discuss material observations before finalising the report and management action plan.
Hand over the actions
Walk through priorities, assumptions, owners and evidence that could be used to validate fixes.

Keeping the scope clear

What is not part of this review

A legal opinion, prudential attestation or confirmation of statutory compliance
Submitting reports or notices to APRA, Home Affairs or any regulator on your behalf
Industrial control-system penetration testing, safety engineering or on-site OT assessments
Full multi-asset CIRMP development unless a separate specialist team and scope are agreed
Engagements that do not pass conflicts, competency or insurance screening

Assessment conclusions are limited to the agreed systems, timing and evidence made available. They do not guarantee the absence of cyber risk or certify compliance.

Common questions

Before you enquire

Does CPS 234 apply directly to every supplier of a bank?

No. It applies to APRA-regulated entities. Suppliers may need to demonstrate controls because of the regulated customer’s obligations or contracts.

Does every energy or transport contractor need a CIRMP?

No. SOCI requirements depend on the asset class and the entity’s legal role. We clarify that before proposing assessment work.

Do you provide regulatory or legal certification?

No. Where legal interpretation, specialist OT assurance or formal audit opinion is required, it must be handled by appropriately qualified parties.

Next step

Work through the requirement before the assessment.

To help us scope this properly, tell us: The relevant entity or customer relationship, business services and the precise regulatory or contractual request. Please keep passwords, sensitive records and configuration exports out of the initial enquiry.

Talk to us about this service ↗

Relevant guidance

These references explain the frameworks. Cyber Evident is not affiliated with or endorsed by the publishers.