SOCI overlap triage for the Cyber Security Act

Open the triage record with three yes-or-no lanes. Lane one is SOCI: is there a critical infrastructure asset, a responsible entity, and a Part 2, Part 2A, or Part 2B obligation? Lane two is Cyber Security Act Part 3: did a reporting business entity make, or become aware that another entity made on its behalf, a ransomware payment after a cyber security incident? Lane three is smart-device compliance: is the product a consumer grade relevant connectable product that the manufacturer or supplier knows, or could reasonably be expected to know, will be acquired in Australia by a consumer?

Do not merge the evidence packs. SOCI incident reporting, ransomware payment reporting, and smart-device statements of compliance answer different questions and may be handled by different owners even when the same event or product family triggered the review.

The SOCI branch should start with the asset, not a generic organisation name. Section 12L identifies the responsible entity separately for each asset class; it is not a single across-the-board test that can safely be reduced to whoever owns or operates the asset. Record the applicable asset provision and the person or organisation that provision designates.

Once the asset and responsible entity are identified, check which SOCI obligation is in play. Part 2 concerns the Register of Critical Infrastructure Assets. Part 2A concerns the critical infrastructure risk management program. Part 2B concerns mandatory cyber incident reporting. The Application Rules are the source to check whether Part 2 or Part 2B applies to the relevant asset class.

For Part 2A, use the 10 June 2026 compilation of the program rules. Enhanced CIRMP requirements now apply to specified broadcasting, domain-name-system, electricity, energy-market-operator, freight, gas, liquid-fuel, and water assets. Section 4A gives existing covered assets 12 months from commencement for section 6A and specified parts of sections 8A and 9A, and 24 months for the other enhanced provisions; an asset that becomes critical infrastructure later receives the corresponding period from that date.

Treat a SOCI Part 2B cyber incident report and a Cyber Security Act ransomware payment report as separate filings. Part 2B belongs to the SOCI critical-infrastructure stream. The Cyber Security Act Part 3 stream applies when the ransomware-payment conditions are met: a reporting business entity is impacted by a cyber security incident and provides, or becomes aware that another entity provided on its behalf, a payment or benefit to the extorting entity.

Start the SOCI clock from awareness of the qualifying impact on the covered asset: within 12 hours for a critical incident that materially disrupts essential goods or services, or within 72 hours for another incident with a relevant impact. Start the ransomware clock from the payment or awareness of an on-behalf payment. Build the ransomware record around what the reporting business entity knows or can find out by reasonable search or enquiry within that separate 72-hour period.

The smart-device branch is product compliance, not critical-infrastructure asset classification. Cyber Security Act Part 2 commenced on 29 November 2025, while Part 2 and Schedule 1 of the Smart Devices Rules, which contain the consumer-grade standard and statement requirements, commenced on 4 March 2026. Use this branch for consumer grade relevant connectable products that can directly or indirectly connect to the internet when the manufacturer or supplier is aware, or could reasonably be expected to be aware, that a consumer will acquire the product in Australia, subject to the Rules' exclusions. The Rules set the binding scope test; the official explanatory statement gives smart TVs, smart watches, home assistants, baby monitors, and consumer energy resources as examples, but each product still needs its own connectivity, intended-use, acquisition, awareness, date, and exclusion analysis. A smart product used inside a critical-infrastructure environment may create operational risk evidence for SOCI, but the statement-of-compliance and security-standard evidence remain product records.

The Rules require a manufacturer-prepared statement of compliance for covered products and set product-security evidence around passwords, reporting security issues, and defined support periods for security updates. Suppliers have their own supply-side check because the Rules outline when non-compliant products must not be supplied and when products must be supplied with the statement of compliance.

Keep the SOCI overlap triage record after the incident or product release. It should show why a lane was opened or closed, who owned it, which official source supported the decision, what evidence was reviewed, and which record remains authoritative for later audit or regulator questions.

Use a short matrix rather than a narrative memo. Each row should identify the lane, trigger fact, obligation checked, owner, evidence, source, decision, reviewer, and follow-up. Mark unknown facts as unknown and assign a collection owner instead of filling gaps with assumptions.