SOCI Act 2018 for transport

​​​​​​The legal obligations you have if you own, operate, or have direct interests in critical infrastructure assets are outlined by the Security of Critical Infrastructure Act 2018 (SOCI Act). The SOCI Act also outlines how the government can support you if an incident occurs that impacts your critical infrastructure asset.

In the transport sector, the following obligations apply to most asset classes:

  • Notify third-party data storage or processing providers that the provider is storing or processing business critical data for a critical infrastructure asset.
  • Provide operational and ownership information to the Register of Critical Infrastructure Assets.
  • Report cyber security incidents.

Responsible entities for critical freight infrastructure and critical freight services assets must also comply with the Critical Infrastructure Risk Management Program obligation. The Register of Critical Infrastructure Assets obligation is not extended to critical aviation assets.

The kind of asset you are responsible for will determine which obligations you must comply with. To find specific information for your asset, read the current version of the SOCI Act.

If your asset is a System of National Significance, you may also need to meet Enhanced Cyber Security Obligations. These are decided individually for each asset. We will discuss these with you directly.

You can read more about these obligations on our regulatory obligations page.

The SOCI Act also includes Government Assistance measures. These measures outline how the government can help industry respond to cyber security incidents. These measures apply only to incidents that will cause serious harm to Australia’s prosperity, national security, or defence.

Critical transport infrastructu​re assets

The transport sector includes owners or operators who transport goods or passengers on a commercial basis, including critical port, freight infrastructure, freight services, public transport or aviation assets.


Critical ports

You may have obligations under the SOCI Act if you own, operate, or have a direct interest in one of the following ports:

  • Broome Port
  • Port Adelaide
  • Port of Brisbane
  • Port of Cairns
  • Port of Christmas Island
  • Port of Dampier
  • Port of Darwin
  • Port of Eden
  • Port of Fremantle
  • Port of Geelong
  • Port of Gladstone
  • Port of Hay Point
  • Port of Hobart
  • Port of Melbourne
  • Port of Newcastle
  • Port of Port Botany
  • Port of Port Hedland
  • Port of Rockhampton
  • Port of Sydney Harbour
  • Port of Townsville, or
  • A security regulated port prescribed by the rules for the purposes of section 11 of the SOCI Act.

Critical freight infrastructure assets

A critical corridor for the transportation of goods between two states, territories or regional centres, including:

  • road networks
  • rail networks
  • intermodal transfer facilities.

This includes the intermodal terminals at the following locations:

  • Chullora, NSW
  • Parkes, NSW
  • Altona, VIC
  • Barnawartha, VIC
  • Dynon North, VIC
  • Dynon South, VIC
  • Acacia Ridge, QLD
  • Bromelton, QLD
  • Townsville, QLD
  • Forrestfield, WA
  • Kewdale-Welshpool, WA
  • Islington, SA
  • Penfield, SA
  • Brighton Transport Hub, TAS

Critical freight services assets

Critical freight services assets are critical to the transportation of goods by road, rail, inland waters and/or sea.

The following applies in accordance with the Security of Critical Infrastructure (Definitions) Rules (LIN 21/039) 2021:

  • the business has an annual revenue of at least $150 million; and the business provides a service that is a road freight transport service, or a freight forwarding service, or a rail freight transport service, or a water freight service; and the freight service provided by the business involves the transport or storage of any of the following:
    • food and groceries, where transported to or from a critical supermarket retailer or a critical grocery wholesaler
    • therapeutic goods registered on the Australian Register of Therapeutic Goods moved to or from premises storing such goods
    • the supply of medicines listed under Schedules 2, 3, 4 or 8 of Part 4 of the current Poisons Standard, where transported to or from a premises at which the manufacture of the medicine is permitted under a law of a State or Territory
    • liquid fuel, where transported to or from a critical liquid fuel asset
    • essential goods and supplies required for water treatment facilities
    • any other good that is critical for the operation, maintenance or management of a critical infrastructure asset.

Critical public transport assets

A public transport network or system that:

  • is managed by a single entity
  • is capable of handling at least 5 million passenger journeys per month.

This does not include critical aviation assets.


Critical aviation assets

A critical aviation asset is:

  • used in connection with the provision of an air service
  • owned or operated by an aircraft operator

or

  • is used in connection with the provision of an air service
  • is owned or operated by a regulated air cargo agent

or

  • an asset that is used by an airport operator in connection with the operation of an airport.