SOCI Act IAM obligations are reshaping critical infrastructure controls

At a glance

What this is: RSA Security's article explains how Australia's SOCI Act 2018 and ERP 2024 amendments turn identity governance, access control, and auditability into mandatory controls for critical infrastructure operators.

Why it matters: It matters because critical infrastructure teams now have to prove who has access, who changed it, and what was detected or reported, which makes IAM, IGA, and privileged access governance central to operational resilience.

Context

Australia's critical infrastructure obligations now link cybersecurity compliance to identity governance, not just perimeter defence. The article focuses on how the SOCI Act 2018 and the ERP 2024 amendments require operators to prove access control, monitoring, and reporting across essential services.

The practical problem is that critical infrastructure environments often still treat identity as an administrative layer instead of a resilience control. Once access reviews, audit logs, and lifecycle enforcement become part of a legal obligation, weak IAM becomes a governance gap rather than a local process issue.

That shift is especially relevant for sectors such as energy, finance, health, transport, water, and higher education. The article's starting position is typical for regulated infrastructure, where compliance, incident response, and operational security now converge around identity evidence.

Key questions

Q: What breaks when organisations rely on perimeter controls instead of identity-based security in critical infrastructure?

A: Perimeter-only security fails once attackers gain a foothold through phishing, stolen credentials, vendor access, or exposed services. In critical infrastructure, that weakness lets adversaries move laterally, abuse privileged accounts, and reach operational systems with limited resistance. Identity-based controls help contain those paths by verifying access continuously and constraining what each identity can do.

Q: Why do IAM and IGA matter for SOCI compliance?

A: They provide the access control, lifecycle governance, and audit evidence needed to satisfy risk management, incident reporting, and enhanced cybersecurity obligations. Without them, the organisation cannot reliably show privilege restraint or identity traceability.

Q: How do teams know if identity security controls are actually working?

A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads. A useful sign is reduced time between entitlement change and policy review. Another is fewer unresolved conflicts between approved access and actual production permissions.

Q: Who is accountable when identity evidence is missing during a SOCI incident?

A: Accountability usually sits with the teams that own access governance, logging, and incident response, but the broader obligation is organisational. For critical infrastructure, the business must be able to produce identity evidence fast enough to support reporting and investigation.

Technical breakdown

Risk management programs now depend on identity controls

The SOCI risk management program is not only a policy obligation. It requires operators to identify and mitigate material risks from cybersecurity, supply chain, personnel, and physical security threats, which means access control becomes part of the organisation's formal risk posture. In practice, IAM and IGA supply the evidence trail for who can access critical systems, whether separation of duties exists, and whether access matches job function. That makes identity governance a control plane for resilience, not a downstream admin process.

Practical implication: Map risk management obligations to access control, role design, and lifecycle evidence instead of treating IAM as a standalone IT function.

Incident reporting depends on real-time identity visibility

Mandatory reporting under SOCI creates a hard operational requirement for fast identity visibility. If an incident affects availability, operators have to understand quickly whether access misuse, suspicious login activity, or privilege abuse is involved, and they need logs that tie events back to specific identities. This is where auditability and identity correlation matter more than static entitlement records. Without that linkage, incident reporting becomes slower, less defensible, and harder to substantiate during investigation or review.

Practical implication: Ensure identity logs, authentication events, and privileged access records are available for incident triage before an event forces reporting.

Least privilege and separation of duties move from best practice to obligation

The article ties RBAC, least privilege, and separation of duties directly to critical infrastructure governance. That matters because the control objective is not simply reducing excess access. It is preventing one identity from accumulating enough authority to approve, execute, and conceal risky actions inside regulated environments. Real-time behavioural monitoring adds another layer by surfacing anomalous access patterns that could indicate compromise or insider misuse. Together, these controls make identity state observable and governable under regulatory pressure.

Practical implication: Review privileged workflows, role design, and exception paths to ensure no single identity can concentrate incompatible powers.

Threat narrative

Attacker objective: The objective is to exploit identity weakness inside critical infrastructure so the attacker can operate, persist, or disrupt services with limited resistance and poor visibility.

1. Entry occurs through weak identity controls, including poor authentication, overly broad access, or unmonitored login attempts against critical systems.
2. Escalation follows when an identity with excessive privileges can move from ordinary access to high-risk functions without separation of duties or role constraint.
3. Impact is regulatory, operational, and security-related, because the operator may face disrupted services, delayed incident reporting, and incomplete evidence for investigation.

Breaches seen in the wild

• Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
• Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is becoming a resilience control for critical infrastructure. SOCI and ERP 2024 do more than raise compliance expectations. They turn IAM, IGA, and audit evidence into operational proof that a critical service can detect misuse, constrain privilege, and reconstruct events after an incident. For practitioners, that means identity governance is now part of national resilience design, not only access administration.

Real-time identity evidence is the difference between reporting and guessing. The article makes clear that incident reporting obligations depend on timely visibility into authentication, privileged access, and identity activity. Without that evidence, operators can know that something happened without being able to prove who acted, what changed, or whether the incident met the reporting threshold. The practical conclusion is that logging and correlation must be designed for regulatory use, not only SOC monitoring.

Least privilege is no longer a policy aspiration in critical infrastructure. SOCI-linked obligations make role design, RBAC, and separation of duties measurable governance expectations. That changes the conversation from access cleanup to control enforceability, because regulators and auditors can now ask whether the organisation can show that high-risk functions are limited, reviewed, and attributable. Teams should treat privilege concentration as a resilience defect.

Named concept: identity evidence readiness. The article points to a governance state in which identity data, access logs, and privileged activity records are available fast enough to support incident reporting, audit, and investigation. This is more than logging maturity. It is the ability to turn identity records into defensible operational evidence when critical infrastructure is under stress, and practitioners should manage to that standard.

The regulatory model is broadening identity ownership across the enterprise. The sectors listed in the article show that identity governance is no longer confined to classic IT or financial controls. It now reaches supply chain, personnel, and physical risk management in essential services. That widens accountability for IAM and IGA teams, who now have to support compliance narratives that span business operations, not just system access.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.

What this signals

Identity evidence readiness: critical infrastructure teams need access records, privileged activity logs, and lifecycle evidence that can stand up under incident reporting and audit pressure. If those artefacts are not available quickly, the programme may satisfy policy language while still failing the operational test.

SOCI-style obligations push IAM teams to think like resilience engineers. Access reviews, role design, and offboarding are no longer back-office hygiene because the question is whether identity state can be reconstructed when availability, reporting, or government scrutiny arrives.

For practitioners

• Strengthen access control policies for critical systems Map critical asset access to explicit business roles, enforce least privilege, and review exceptions as part of the SOCI risk management program.
• Instrument identity logging for incident reporting Capture authentication events, privileged access changes, and access decisions in a form that incident responders can use immediately and auditors can reconstruct later.
• Automate identity lifecycle enforcement Link onboarding, role changes, and offboarding to IAM workflows so access removal and updates happen consistently across regulated environments.
• Enforce separation of duties in high-risk workflows Ensure no single user can both approve and execute sensitive transactions, and validate that privileged paths remain separately controlled and reviewable.
• Use behavioural monitoring on privileged access Alert on unusual authentication patterns, impossible access sequences, or abnormal privileged activity that may signal compromise or insider misuse.

Key takeaways

• Australia's critical infrastructure obligations now make identity governance part of resilience, not just access administration.
• The most important evidence is the ability to show who had access, who changed it, and how that activity was logged.
• Operators should treat IAM, IGA, and privileged access controls as audit-ready controls that support reporting, investigation, and service continuity.

Key terms

• Identity Evidence Readiness: The ability to produce access, authentication, privilege, and lifecycle records quickly enough to support incident response, audit, and regulatory reporting. In critical infrastructure, this is not just logging maturity. It is operational proof that identity controls can be reconstructed under pressure.
• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• Role-Based Access Control: A model that grants permissions by assigning identities to predefined roles. It works well when jobs are stable and access patterns are predictable, but it becomes brittle when exceptions pile up. In practice, role design must stay small enough to audit and broad enough to avoid endless custom variants.
• Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.