CIRMP annual report

Part 2A and Part 2AA of the Security of Critical Infrastructure Act 2018 require covered responsible entities to adopt, maintain and comply with a written Critical Infrastructure Risk Management Program (CIRMP). It is an all-hazards program: cyber and information security, personnel, physical security, supply chains, and natural hazards sit in the same risk register.

The governing body must approve an annual report and submit it to the relevant Commonwealth regulator within 90 days after the end of the Australian financial year. CISC's Responsible Entity CIRMP Annual Report form (last updated 17 August 2026; desk-fetched 4 October 2026) restates that duty in plain terms: complete this form within 90 days after each financial year ends, with board, council or other governing-body approval, submit using the online form, and keep a copy. For most assets the CISC is the regulator; payment systems report to the Reserve Bank of Australia. Email cisc@homeaffairs.gov.au for process questions — it is not a substitute for lodging.

Desk clock for FY 2025–26: the Australian financial year ended 30 June 2026, so the 90-day window ran to 28 September 2026. That window is now closed (desk pass 4 October 2026). If the board-approved form is lodged and you have the receipt, file the pack and move on. If it is not lodged, treat that as an open compliance failure: do not wait for the next ordinary board cycle without an out-of-session approval, lodge via the CISC online form (RBA channel for payment systems) as soon as the governing body has approved, and record why the statutory window was missed.

The report is an attestation, not a copy of the program. The approved form asks whether the CIRMP was up to date at year end, what significant or relevant-impact incidents occurred, what variations were made, and whether the program was effective in mitigating relevant hazard impacts. Board or governing-body approval must be recorded. A tick that says effective without artefacts is an assertion, not assurance.

Evidence desk after the close: keep the current program, hazard register, owner and review dates; minutes showing board approval of the annual report; incident and exercise records for the year; supplier and personnel-control evidence; changes made during FY 2025–26; the submitted form plus receipt or regulator correspondence; and — if late — a dated note on when awareness of the miss occurred and what was done. That pack is what an audit or CISC follow-up will ask for, not a slide saying you have a CIRMP.

Next clock: FY 2026–27 ends 30 June 2027; the next 90-day annual-report window therefore runs to 28 September 2027. Put the board approval slot in the calendar now so the next close is not another scramble. Pair the annual attestation with day-to-day CIRMP upkeep (see cirmp) — the annual form does not replace keeping the program current when hazards or assets change mid-year.

Do not confuse this annual report with Part 2B cyber incident reporting. A 12-hour or 72-hour cyber incident clock can run during the year; the annual CIRMP report follows later and does not replace that immediate notification. Pair with soci-act, soci-clock, and cirmp.