Security of Critical Infrastructure (SOCI) Act

 has shifted from policy to reality, and it’s putting Australian organisations under the spotlight. While updates to the Act landed in 2024, the real 

For those working in essential services, SOCI compliance isn’t a nice-to-have: it’s urgent, complex, and increasingly under regulatory scrutiny. The SOCI Act applies to 11 key sectors, including energy and water, transport, and banking.

If you’re in a leadership or governance role in these key sectors, the pressure is on. But here’s the good news: the Act doesn’t just introduce new risks, it also presents a rare opportunity to future-proof your operations and build trust from the boardroom to the community.

Let’s dive into what you need to know, and how governance, risk, and compliance (GRC) technology can help you stay ahead.

What is the SOCI Act, and who needs to comply?

 is designed to safeguard the infrastructure that underpins Australia’s essential services, including electricity grids, ports, food supply chains, and financial services.

Cyber and Infrastructure Security Centre (CISC)

 under the Department of Home Affairs. And it's more than just ticking boxes. It’s about actively managing and reducing risk in a world where cyber threats, sabotage, and espionage are real concerns.

Register of Critical Infrastructure Assets

. Organisations must declare and maintain an accurate inventory of their critical assets.

Critical Infrastructure Risk Management Program (CIRMP)

. A board-approved framework for managing risks such as cyberattacks, physical breaches, and supply chain vulnerabilities.

Enhanced Cyber Security Obligations (ECSO)

. Entities deemed at a higher risk must report incidents within tight timeframes and participate in cyber exercises.

. In extreme situations, the regulator can directly intervene to protect infrastructure.

If your organisation falls under the SOCI umbrella, compliance isn’t optional, and the stakes are high.

What are the risks of non-compliance with the SOCI Act?

The SOCI Act carries serious consequences for organisations that fail to meet their obligations. Cyberattacks impacting Australia’s critical infrastructure, such as 

, show how quickly things can spiral out of control without adequate oversight.

Beyond regulatory penalties, the risks include:

. Think: delayed port services, power outages, or compromised healthcare systems.

. Loss of public trust, especially when critical services are impacted.

. If you’re not seen to be managing risks, the government can step in.

Many organisations grappling with the SOCI Act face common challenges that can make compliance feel daunting.

For starters, there is often uncertainty about which assets qualify as “critical,” leading to confusion and inconsistent reporting. Teams may also be working in silos, with risk, IT, and compliance functions operating separately, making it difficult to build a unified approach. Add to that a lack of internal expertise or capacity to implement the new requirements, and the task can quickly become overwhelming.

Perhaps most critically, many organisations struggle to present the board with a clear, consolidated view of their compliance efforts, which is essential for securing executive buy-in and meeting governance obligations.

Given these challenges, it’s easy to feel overwhelmed. But that’s where GRC technology can make a real difference.

Learn how to fully align your CISO, GC and board on cyber risk — and take control of SOCI compliance before your next audit or incident hits.


The Cyber Leadership Playbook

Turning compliance into confidence: The GRC tech advantage

So how do you go from reacting to risks to proactively managing them? Enter 

Think of a GRC platform as your command centre for critical infrastructure risk and compliance. It helps you coordinate across teams, automate processes, and gain real-time oversight.

Here’s how GRC tech helps you stay ahead of the SOCI curve:

. Replace spreadsheets with smart workflows. Have your critical asset register and asset ownership records available at a single click of a button by integrating it with ERP asset register. Never miss a compliance obligation and stay ahead of regulatory audits, all with built-in compliance mapping and reporting features.


. Bring IT, asset, risk and compliance into one system. Everyone sees the same data in the same place, in real time. A holistic GRC solution supports an end-to-end compliance program, encompassing risk management across cyber, personnel, physical security, and supply chain risks, as well as cyber incident management. This enables assurance over controls and ensures compliance with reporting and notification requirements, all within a single platform.


. Solution that will go beyond dashboards and visualisations, enabling continuous monitoring and reporting, keeping senior leadership updated on the ongoing health of the SOCI compliance program. This also enables integration with external data sources, allowing for benchmarking of performance against industry peers. All this fosters board and leadership confidence in decision-making and focusing on organisational performance.

Building a proactive SOCI compliance strategy: Some best practices

Ready to strengthen your SOCI compliance program? Start with these five best practices:

Perform a gap analysis with the SOCI program.

 Perform a compliance assessment to understand the gap between as-is processes and the expected compliance requirement to determine areas of improvement. Frame a compliance program with the help of experts covering a compliance library, risk management plan, and cyber reporting framework.


 SOCI compliance needs resources and oversight. Secure executive buy-in from the beginning to avoid delays and rework. Present the gap analysis and obtain necessary approvals, including the appointment of the SOCI Compliance program lead and business cases approval to allocate requisite resources to automate compliance management.


. Bring together IT, operations, and compliance to agree on what counts as “critical assets” under the SOCI Act. Consistent definitions are key and integrate with the risk and compliance program to have


. Cybersecurity, physical security, personnel vetting, and supply chains all connect. Manage them in a unified program.


. Choose a system that’s built for SOCI compliance. Look for tools that support incident reporting, asset registers, and cross-department collaboration.


. Compliance isn’t one-and-done. Run internal reviews and simulations to stay ready for real incidents or your next audit.

Beyond Australia: The SOCI Act is part of a global shift

Australia’s SOCI Act is a part of a broader, global trend. Around the world, and more recently across APAC, governments have recognised that national security is inseparable from infrastructure and cyber resilience, and they’re tightening regulations to protect everything from power grids to payment platforms.

Let’s take a closer look at similar laws in other regions and what they have in common:

A global convergence on critical infrastructure protection

What do these regulations have in common?

Across borders, these regulations share a few key themes which your organisation can’t afford to ignore if you operate internationally:

Mandatory identification of critical assets

. Just like the SOCI Act’s requirement for a critical asset register, most jurisdictions require companies to identify and declare their “crown jewels”, ranging from data centres to pipelines to customer systems.


. Regulations globally are making it clear that cybersecurity and risk management aren’t just IT’s responsibility. Executive leaders and boards are being held accountable, often with specific sign-off obligations or penalties for negligence.


. Whether it’s NIS2 in the EU or the Cybersecurity Act in Singapore, regulators want to see a formal, documented approach to risk management. Ideally, these are also aligned with international standards, such as 

Australian Cyber Security Centre’s Essential Eight.

 under ECSO, other frameworks, such as the EU’s 

, require organisations to alert regulators about cyber breaches quickly, often within 24 to 72 hours.


. Increasingly, regulators want assurance that third-party providers, from software vendors to logistics partners, will avoid introducing unacceptable risks. This includes contractual due diligence, third-party assurance, and IT security protocols being implemented across third-party service providers.


. Much like SOCI’s Government Assistance provisions, several jurisdictions grant regulators the authority to intervene in response to national threats. This might involve taking control of systems, mandating security updates, or even halting operations in emergency situations.

Get the expert-backed guide built for compliance leaders facing global uncertainty — and learn how to lead with clarity, consistency and control.


Cut through compliance chaos

Why this matters for multinational organisations

If your organisation operates across multiple jurisdictions globally, complying with SOCI is just the start. You’re likely subject to multiple, overlapping regulatory regimes, and the cost of duplication, inconsistency, or gaps can be high.

This is where integrated GRC technology can play a crucial role. A well-designed GRC platform can:

Harmonise obligations across jurisdictions by mapping them to shared risks and controls.

Standardise reporting processes for different regulators without reinventing the wheel each time.

Centralise reporting for audits, boards, and enable cross-border coordination.

Streamline supply chain and third-party assurance processes.

A single source of truth for global compliance and resilience

The SOCI Act may be your regulatory starting point in Australia, but it should also serve as your blueprint for broader resilience. By aligning your compliance programs with global standards and leveraging technology to unify your risk data, you not only meet today’s requirements but also position your organisation for whatever comes next.

 lets you simplify compliance, sharpen oversight, and strengthen your organisation’s defences, all while building trust with your board, your regulators, and the communities you serve. Whether you’re preparing for your first SOCI audit or building a future-ready security strategy, GRC tech gives you the clarity, confidence, and control to make it happen.

 to discover how Diligent’s GRC solutions can help you simplify SOCI compliance and build a stronger, safer future.

Why the SOCI Act matters now more than ever

The United Arab Emirates (UAE) continues its ascent as a global business powerhouse, underpinned by a strong and evolving corporate governance framework. For organizations striving for excellence in this environment, particularly Public Joint Stock Companies (PJSCs), proactively embracing the standards set by UAE regulators is fundamental. This isn't just about compliance; it's about building resilient, transparent and high-performing organizations.

At Cherry Hill Advisory, our work across Risk, Compliance, Audit & Assurance, and Technology consistently shows that effective governance thrives on the synergy between human oversight and enabling technology. This article explores the UAE Corporate Governance Code, highlighting how a strategic Internal Audit function, significantly empowered by modern governance technology, is key to navigating compliance and unlocking value.

The UAE Corporate Governance Framework: Driving higher standards

 aims to establish clear standards for corporate direction and control, enhancing transparency, protecting stakeholder interests, and boosting investor confidence. The Securities and Commodities Authority (SCA) leads this for listed companies through its Chairman of SCA Board Decision No. (3/Chairman) of 2020 concerning the Joint Stock Companies Governance Guide.

This framework is actively maintained, with notable recent developments:

February 28, 2022: Amendments refining board composition rules and shareholder meeting processes took effect, showing responsiveness to market needs. (

January 2024: Significant updates came into force, placing a strong emphasis on the demonstrable effectiveness of internal controls, governance structures, and risk management processes. This signals a move towards requiring robust, verifiable systems, not just policies on paper. (

These heightened expectations necessitate efficient and reliable methods for managing governance obligations.

Internal audit: Providing assurance in a complex landscape

How do boards and management gain assurance that they are meeting these evolving requirements? The Internal Audit function provides this crucial, independent perspective. Operating as an objective assurance and advisory body, internal audit evaluates and helps improve the effectiveness of risk management, internal control, and governance processes. Reporting functionally to the board's Audit Committee ensures its independence, allowing for unbiased assessments. In the context of the UAE code, internal audit validates that governance principles are effectively designed and operating as intended.

The critical role of governance technology

Meeting the demands of the UAE Corporate Governance Code in today's complex environment requires more than manual effort. 

 is no longer a luxury but a foundational element for effective governance, risk management, and compliance (GRC).

 Secure digital platforms for board communication and materials streamline information flow, ensure directors have timely access to accurate data, facilitate better meeting preparation, and create auditable records of decisions – all crucial for meeting the code's expectations around board oversight.

 The SCA's focus on robust internal controls and risk management necessitates a structured approach. Integrated risk management software allows organizations to centralize their risk registers, map risks to controls, document testing, track mitigation actions, and provide real-time visibility to management and the board. This moves beyond static spreadsheets to dynamic oversight.

Streamlining compliance and policy management: 

Ensuring compliance with specific articles of the code and internal policies requires organization-wide effort. 

Centralized platforms for policy management

 can automate distribution, track employee attestations, manage updates, and provide a clear audit trail, significantly improving efficiency and demonstrating compliance readiness.

 Internal audit itself benefits immensely from technology. Modern 

, often incorporating data analytics capabilities, enables auditors to automate workflows, perform more comprehensive testing across entire datasets, visualize risks, and report findings more effectively. This allows audit teams to focus their expertise on higher-risk areas and provide deeper insights.

: The code mandates significant disclosures. Robust reporting tools, often integrated within 

, help aggregate data accurately and generate the necessary governance reports for regulators and stakeholders efficiently.

Leveraging these types of technological capabilities allows organizations to embed governance more deeply, manage risks more proactively, and demonstrate compliance more effectively. As Cherry Hill Advisory often advises clients, investing in the right technology yields significant returns in efficiency, assurance, and strategic insight.

Tactical internal audit projects: Enhanced by technology

Here’s how internal audit teams, utilizing modern tools, can tackle UAE Governance Code compliance:

Assess structure, independence, and processes, aided by reviewing usage logs and content within 

 to evaluate information accessibility and engagement.

Utilize compliance management modules within 

 to map policies against code requirements, track exceptions, and manage remediation workflows.

Employ data analytics tools integrated with audit management software to perform 

 or test large populations of transactions. Focus testing on IT General Controls underpinning key business applications identified through GRC control mapping.

 Assess the ERM process, evaluating the configuration and usage of the organization's risk management information system for completeness and accuracy in risk identification, assessment, and reporting.

 Test controls over financial reporting and governance disclosures, potentially using workflow tools that manage the disclosure compilation and approval process to verify steps are followed.

 Leverage data analytics to systematically identify potential related parties and transactions within ERP systems, flagged for review against approvals documented possibly within an 

 Review the security and functionality of any digital platforms used for shareholder communications, proxy voting, or virtual meetings.

, cybersecurity controls (potentially using specialized assessment tools), and data governance practices, ensuring alignment with overall GRC strategy managed within integrated platforms.

Conclusion: Building a future-ready governance framework

The UAE Corporate Governance Code sets a high standard for businesses. Achieving and maintaining compliance, particularly with the increased regulatory focus on controls and risk, requires a strategic approach that combines strong internal audit practices with the power of modern governance technology.

, specialized tools for board communication, audit management, and risk oversight, organizations can move beyond basic compliance. They can build truly effective, transparent, and resilient governance frameworks. As Cherry Hill Advisory (

) knows, this integration of people, process, and the right technology is key to not only meeting regulatory demands but also driving sustainable performance and stakeholder value in the UAE's thriving economy.

Disclaimer: This article reflects the expert perspectives of Cherry Hill Advisory and provides general information. Specific advice should be sought based on individual company circumstances and the latest regulatory updates.

Mastering the UAE Corporate Governance Code: The synergy of internal audit and governance technology

A June poll of general and corporate counsel finds business risk increasing, with concerns primarily surrounding changing regulations and continued uncertainty.

Deregulation has often been deemed a positive for business, removing barriers to growth and facilitating reporting, but current efforts by the Trump administration to eliminate more regulations than it creates may not be having the desired effect on businesses.

’s Q2 Business Risk Index, finds changes in the regulatory environment the top business risk today, according to the 71 general counsel, corporate secretaries, compliance and legal officers polled.

Two-thirds (65 percent) of those participating in the survey selected “Changes in the regulatory environment” as what they perceive to be a top risk for their company today, putting it well ahead of the second—and most talked about—item on the list: tariffs.

The reason, explained Taras Lytovchenko, the chief legal and compliance officer at Trinetix, is the growing complexity of today’s regulatory landscape, citing “new state consumer-privacy statutes, the development of new data-governance, AI, tax and trade rules” as challenges for business.

Others agreed that the current administration’s “whipsawing policies and enforcement priorities,” as one legal chief put it, are impeding corporate strategies.

In contrast, when we asked board members the same question in our Q2 Director Confidence Index, the response was overwhelmingly focused on tariffs. Changes in the regulatory environment ranked much lower on the list, in fifth place, with fewer than a quarter of directors listing it as a top risk for their company.

Still, like GCs, board members also recognize the heightened risk in the current business environment. On a 1-10 scale where 1 is Negligible and 10 is Significant, directors rated it at 6.8 while GCs gave it a 7.4—up from 6.8 in Q1.

Many say it’s not necessarily the factors listed that represent the biggest risk but rather, the uncertainty behind them. “It's hard with the shifting landscape to know when/where the next directive or action might come from. A safe and steady line of business today might be the focus of a government action tomorrow,” said a chief legal officer participating in the poll.

This uncertainty is causing legal teams to exercise renewed caution when advising the C-Suite. The poll shows they are increasingly attending leadership meetings and having more frequent communication with senior management, including the board, particularly as it relates to the changing regulatory and legal environment—and how those changes will affect their company.

The survey found 41 percent of legal and compliance teams are making better use of AI tools for real-time data and risk analysis, though that use remains in early stages at this time. Most common use cases include contract reviews, research and analysis as well as document drafting.

Haily Kolberg, corporate counsel at A&D Mortgage, says that’s because the technology is still far from delivering on the value promised, mainly due to the risk of errors. “How do you build any trust in AI to be accurate? I don't think it saves time when I need to verify any information it provides since its summaries are not totally accurate or detailed enough to use.”

Michael Rodgers, GC at Redstone Federal Credit Union, agrees there needs to be more evidence of how AI technology can be used in a safe and compliant manner. He calls on peers to “expound on AI use cases” for legal and compliance teams to facilitate adoption.

“Despite the fact that 41% of GCs are recommending making better use of AI tools for risk management and oversight, these findings suggest that they are still just starting to tap into the technology,” says Dottie Schindlinger, Executive Director at the Diligent Institute.“Nearly a third are not using it at all, and most are sticking to basics like contract review and legal research to boost efficiency. They’re not really using it yet to drive big innovation—it’s more about making everyday tasks faster, reflecting both the potential of AI and the careful way legal teams are easing in.”

GC Risk Index: Risk is on the rise

How prepared are today’s boards to navigate a crisis? Diligent Institute and Corporate Board Member recently checked in with U.S. public company directors to see how they were feeling about 

 amid continuing economic uncertainty. The results revealed that directors rate the current risk level businesses face at a 6.8 out of 10 – a clear signal that crisis readiness should be a core governance priority, not a reactionary measure.

Enter the NextGen Board Leaders East Coast Summit, which was recently held at the New York Stock Exchange (NYSE). This program, sponsored by Wilson Sonsini and Meridian Compensation Partners, brings together experts and new public company board members under Chatham House Rule to discuss critical topics in corporate governance, including crisis management in uncertain times. Key insights from this session offer practical strategies for board members to prepare for and respond to various crisis scenarios effectively.

Crisis scenarios are broad – and often simultaneous

Boards should be prepared for a wide range of crisis scenarios, each requiring a tailored approach. These scenarios include significant product failures, unexpected changes in management, scandals or executive misconduct, major litigation, regulatory investigations, cybersecurity incidents, whistleblower complaints, CEO or founder stock pledges and liquidity events, delisting notifications, and acute stock price pressures. Each of these scenarios has unique implications and requires specific strategies.

These events are often interlinked. A visible issue can set off a domino effect – inviting regulatory attention, shaking investor confidence, and prompting customer concerns.

Many of these crisis scenarios are notoriously challenging to handle effectively under pressure. It’s not about predicting every crisis, but about being ready to respond with speed, clarity, and alignment when one arrives.

Crisis response starts with planning, not improvisation

What sets effective boards apart is preparation: whether they’ve built the muscle memory to respond decisively – or are left scrambling under pressure. That’s why it’s crucial for boards and management to prepare in advance, rather than reacting in the moment.

Key components of this preparation include

: Establish both internal and external teams that are ready to act when a crisis strikes. These teams should include legal, audit, PR/IR, and bankers to ensure swift decision-making.

: Develop clear reporting lines and control procedures to ensure that everyone knows their role and responsibilities when the stakes are high.

: Create a detailed crisis response plan or playbook that outlines the steps to be taken in various scenarios. Regularly update and review this plan to keep it relevant.

: Conduct simulations to test the crisis response plan and ensure that all team members are familiar with their roles and the overall process. Identify and address any blind spots.

: Develop a robust communications strategy for media and social channels. Digital platforms can rapidly amplify reputational risks and trigger concerns from regulators, investors, or customers.

Preservation of attorney-client privilege

: Establish clear protocols to preserve attorney-client privilege, such as involving in-house or outside counsel in all sensitive matters and establishing in advance which communications will include legal advice and how it will be documented.

When a crisis is identified, the following steps should be taken:

: Gather all relevant information to understand the scope and impact of the crisis. This involves a thorough and immediate investigation to ensure that the board and management have a clear picture of what is happening.

: Address and halt any illegal or unethical behavior immediately to prevent further damage. This step is crucial to mitigate the crisis and protect the company’s integrity.

: Engage lawyers, auditors, and a public relations or investor relations firm to manage the crisis effectively. These experts can provide the necessary legal, financial, and communication support to navigate the situation.

: Ensure that all communications are credible and balanced, while also recognizing the need for complete information. Consider self-reporting and the timing of disclosures to regulators, especially in light of legal obligations under Regulation FD and Form 8-K. Board members who receive direct inquiries from shareholders, the media, or other third parties should avoid providing substantive responses and instead direct all such communications to the General Counsel to maintain consistency and legal compliance.

Risk management requires more than oversight – it demands foresight

Enterprise Risk Management (ERM) plays a central role in crisis management, helping to identify and mitigate risks across the organization. Management is responsible for embedding ERM in strategy-setting and day-to-day operations, ensuring that risks are proactively identified and addressed. The board’s role is to oversee ERM as part of its fiduciary duties, with specific committees receiving regular updates on risk exposure within their remit.

To effectively manage risks, boards should:

: Receive detailed reports on mission-critical risks to maintain a clear, up-to-date understanding of potential threats.

: Capture key discussions, deliberations, and decisions in board minutes to demonstrate due diligence.

: Probe risk mitigation strategies with detailed, forward-looking questions to test assumptions and ensure thorough preparation.

: Ensure committee charters clearly allocate risk oversight responsibilities – avoiding duplication or gaps across the board.

Crisis management is both a governance test and a leadership moment. Proactive and strategic crisis management is essential – not just for protecting a company’s reputation, but to preserve its long-term stability and value. By preparing in advance, knowing the critical moves when crisis strikes, and embedding ERM into governance practices, board members can navigate challenging situations with confidence, agility, and sound judgment when it matters most.

Diligent

Blog

Why the SOCI Act matters now more than ever

Mastering the UAE Corporate Governance Code: The synergy of internal audit and governance technology

Your Data Matters