PSO
What is PSO?
Positive Security Obligation
The requirement under Part 2A of the SOCI Act for responsible entities to adopt and maintain a critical infrastructure risk management program. Distinct from the enhanced cyber security framework obligations.
What it obliges you to do
Adopt and maintain a critical infrastructure risk management program, comply with it, review it regularly, and submit an annual report. The program must cover all hazards.
It is a standing obligation that follows from operating a critical infrastructure asset. No notice is issued and no declaration is required.
How it relates to the other tiers
The positive security obligation is the baseline. The Enhanced CIRMP Rules raise the standard of that same program for nine named asset classes. The enhanced cyber security obligations are a separate regime for Systems of National Significance, and doing the baseline well does not produce them as a by-product.
Read more
- Three Things Called "Enhanced" in Your SOCI Obligations
The regime now has three obligation layers and two of them are called enhanced. They apply to different populations, are triggered differently, and demand different things. Which ones you can look up today, and which one arrives privately.
See also
- CIRMP Critical Infrastructure Risk Management Program The risk management program that responsible entities must establish and maintain under the SOCI Act.
- SOCI Security of Critical Infrastructure Act 2018 Australian federal legislation, often searched for as the Security of Critical Infrastructure Act, that imposes positive security obligations on entities responsible for critical infrastructure assets across 11 sectors.
- SoNS Systems of National Significance A subset of critical infrastructure assets privately declared by the Minister under Part 6A of the SOCI Act, on the basis that a disruption would have cascading consequences for other critical infrastructure.
O/IT Cyber advises Australian critical infrastructure operators on risk management programs, framework nomination and OT security. Talk to us.