Australian carriers and larger carriage service providers still carry the security and notification duties known as TSSR, but since 4 April 2025 those duties live in the Security of Critical Infrastructure Act 2018, not Part 14 of the Telecommunications Act 1997. Many compliance documents, contracts and procurement checklists still cite Part 14, which has ceased. This guide explains what the Telecommunications Sector Security Reforms required, how Schedule 5 of the Enhanced Response and Prevention Act 2024 moved and changed them, and what carriers and relevant carriage service providers must do now under the SOCI Act and the Telecommunications Security and Risk Management Program (TSRMP) Rules 2025. It is for security, risk, network engineering and regulatory teams at Australian telcos and their major suppliers. For the general SOCI regime across all sectors see the Australia SOCI Act Guide.
Key takeaways
- Part 14 has ceased. Schedule 5 of the ERP Act commenced on 4 April 2025 and moved the TSSR obligations into the SOCI Act, alongside the new TSRMP Rules 2025.
- Protect and notify still apply. Responsible entities must protect critical telecommunications assets, with competent supervision and effective control; carriers must notify the Secretary of Home Affairs of changes likely to have a material adverse effect on security.
- A written risk management program is now required. Carriers and relevant carriage service providers need a TSRMP-compliant program, with a board-approved annual report to the CISC within 90 days of each financial year end.
- A named cyber framework with deadlines. Entities must comply with one of five listed frameworks (or an equivalent), reaching maturity Level 1 and then Level 2 for carrier assets on a staged timetable.
- Incident reporting is 12 or 72 hours. Critical cyber incidents go to the ACSC within 12 hours of becoming aware, other reportable incidents within 72 hours.
Scope: who and what is covered
The TSSR commenced in 2018 as Part 14 of the Telecommunications Act 1997. Following a review, the ERP Act (Royal Assent 29 November 2024) moved the obligations into the SOCI Act, and the CISC Telecommunications Guidance of April 2025 sets out the new coverage.
| Asset type | Definition (CISC guidance) | Obligations that apply |
|---|---|---|
| Carrier assets | Critical telecommunications assets owned or operated by a holder of a carrier licence under the Telecommunications Act 1997 | Asset register, mandatory cyber incident reporting, protect your asset, notification obligation, risk management program |
| Relevant carriage service provider (CSP) assets | Assets used to supply at least 20,000 active carriage services, or known to be used for carriage services supplied to a Commonwealth entity | Asset register, mandatory cyber incident reporting, protect your asset, risk management program (not the notification obligation) |
| CSPs below the threshold | Other carriage service providers | Data service provider notification and ministerial directions and serious incident powers |
| Excluded | Basic corporate functions such as sales and marketing, household end-point devices such as modems, and assets that interact with the network but are not owned or operated by a carrier or CSP | Not critical telecommunications assets |
One practical change: under Part 14 all CSP assets were caught by registration and incident reporting. Under the SOCI Act only carrier assets and CSP assets meeting the threshold are. Assets already registered do not need re-registration, but changes must be kept up to date.
Key obligations
Protect your asset (SOCI Part 2D, TSRMP Part 2)
A responsible entity must protect the asset, so far as reasonably practicable, for security and against hazards with a material risk of a relevant impact on availability, integrity and confidentiality. This carries forward the TSSR concepts of competent supervision (knowing what is happening across all components) and effective control (the practical ability to act, directly or through a third party). Good-faith acts done to meet the obligation do not create liability for damages.
Notification obligation (SOCI s 30EE, TSRMP Part 4, carrier assets only)
- Trigger: a change or proposed change likely to have a material adverse effect on the capacity to protect the asset for security purposes.
- Timing: in writing, as soon as practicable after becoming aware; the CISC suggests notifying after an RFI but before procurement decisions or contracts.
- Typical notifiable changes: new services; moving notifiable equipment, including offshore; procuring notifiable equipment; certain outsourcing; offshore access to information covered by s 276 of the Telecommunications Act; offshore storage of s 187A retained data.
- Usually not notifiable: like-for-like replacement, day-to-day routing or software updates, and isolated trials with customer data protected.
- How: the CISC change notification form via the online submission form (up to five attachments) or [email protected].
| Step | Timeframe | Outcome |
|---|---|---|
| Secretary's initial response | Within 22 business days of notification | No risk notice, request for information, or notice of risk |
| Entity's reply to an information request | 44 business days (or longer if allowed) | Further requests possible |
| Secretary's response after last information received | No later than 22 business days | Written notice; may suggest measures to reduce risk |
The CISC case study notes that the notification requirement has been live since 4 April 2025 with no grace period.
Risk management program (SOCI Part 2A, TSRMP Part 3)
The program must identify and manage material risks across five hazard vectors defined in TSRMP section 4: cyber and information security, personnel, physical security, natural, and supply chain. Section 9 sets the process (operational context, identify, minimise or eliminate, mitigate, review, keep current) and section 10 the contents (interdependencies, responsible personnel, methodology, review triggers). The CISC recommends review at least every 12 months.
| TSRMP section | Requirement |
|---|---|
| s 11 cyber and information security | Comply with AS/NZS ISO/IEC 27001:2023, the ASD Essential Eight Maturity Model, the NIST Cybersecurity Framework, the US Department of Energy C2M2, or the 2020-21 AESCSF Framework Core (versions 1 or 2, not 2 lite), or an equivalent documented in the program |
| s 11 maturity timetable | Carrier assets: Level 1 within 18 months of the rules applying, Level 2 within 30 months. Relevant CSP assets: Level 1 within 18 months, maintained and updated by 30 months |
| s 12 personnel | Identify critical workers, assess suitability for access, manage malicious or negligent insiders and off-boarding (AusCheck optional) |
| s 14 supply chain | Minimise or eliminate specified supply chain risks, including from major suppliers |
| s 15 physical and natural | Identify critical components, control and test physical access, address natural hazards |
| s 7 grace period | Program obligations start at the later of 6 months after 4 April 2025 or 6 months after the asset becomes a relevant critical infrastructure asset |
The CISC guidance describes the framework milestones in two ways (a table with 18 and 30 months, and an example counting from the end of the six-month grace period), so confirm the current milestone dates for your assets with the CISC.
Incident reporting and the register
Mandatory cyber incident reporting (SOCI Part 2B) applies to carrier and relevant CSP assets. The CISC MCIR guidance sets 12 hours from becoming aware for a critical incident with a significant impact and 72 hours for other reportable incidents with a relevant impact, to the ACSC. An oral report must be followed by a written report within 84 hours (critical) or 48 hours (other). Asset register obligations (SOCI Part 2) also apply. See the Cyber Incident Reporting Requirements Map.
Timeline and current status
| Date | Event |
|---|---|
| 2018 | TSSR commence under Part 14 of the Telecommunications Act 1997 |
| 29 November 2024 | ERP Act receives Royal Assent |
| 4 April 2025 | Schedule 5 of the ERP Act and the TSRMP Rules 2025 commence; Part 14 obligations cease; notification obligation live with no grace period |
| October 2025 | Six-month grace period for risk management program obligations ends for assets in scope at commencement |
| 1 July to 28 September 2026 | First board-approved annual report, covering financial year 2025-26, due to the CISC |
| 18 and 30 months | Cyber framework maturity milestones (confirm dates with the CISC) |
Status checked on 8 November 2026 against the CISC telecommunications page (last updated 22 May 2025) and the April 2025 guidance.
Enforcement and penalties
The SOCI Act gives the government graduated tools. The Secretary of Home Affairs can require information and documents to monitor and investigate compliance. The Minister for Home Affairs can direct an entity to do, or not do, a specified thing reasonably necessary to reduce a security risk, and under s 30EF can, as a last resort and after an adverse security assessment, direct a carrier or CSP to stop using or supplying a carriage service; this replaces the old s 315A power. The regulator can direct an entity to fix a seriously deficient risk management program after first engaging with it (s 30AI). The CISC guidance says penalties for program non-compliance are reserved for consistent, deliberate and egregious breaches. Civil penalty amounts sit in the SOCI Act itself; check the current compilation on the Federal Register of Legislation before quoting a figure.
What it means for AI agents and non-human identities
Competent supervision and effective control are identity questions in practice. You cannot know what is happening across network components, or act on them, if you do not know which accounts and automated processes can change them. Our reading at NHI Mgmt Group:
- Offshore and outsourced access is often machine access: managed service providers, vendor support tools and remote element managers frequently connect through service accounts and API keys. A change that gives an offshore provider such access can be notifiable, so record machine credentials in the change assessment, not only human user accounts.
- Personnel controls extend to who holds the keys: section 12 is about critical workers, but the credentials those workers manage (privileged service accounts, signing keys, automation tokens) need owners, vaulting and off-boarding rotation so that a departing worker's access really ends.
- Framework maturity covers machine identity: whichever framework you pick, its access control and privileged access requirements apply to non-human accounts. Under the Essential Eight, restricting administrative privileges and multi-factor authentication need a documented approach for service accounts. See the Essential Eight Guide.
- AI agents in network operations: an agent that can reconfigure network functions is a new route to the asset. Give it a distinct identity, least-privilege scopes, human approval for high-impact changes and complete action logs, and assess it in the risk program. See the AI Agent Threat Modelling Guide.
- Incident clocks start with credential exposure: a leaked automation token for a core system may be the first sign of a critical incident. Route secret-scanning and anomaly alerts into the incident process so the 12-hour clock is met.
Compliance steps
- Retire Part 14 references. Update policies, procurement templates, supplier contracts and board papers to cite the SOCI Act and TSRMP Rules.
- Confirm asset status. List carrier assets and CSP assets against the 20,000 active services and Commonwealth customer tests; update the register.
- Embed the notification gate. Add a TSSR check to architecture review and procurement so material changes, offshoring and outsourcing are assessed before RFP decisions.
- Write the risk management program. Cover all five hazard vectors, sections 9 and 10 content, and named responsible personnel.
- Choose and baseline the cyber framework. Document why it fits (or why an alternative is equivalent), assess current maturity and plan to Level 1 and Level 2 milestones.
- Prove incident reporting. Drill the 12-hour and 72-hour paths and the follow-up written reports.
- Prepare the annual report. Include the notification summary items required by paragraph 30AG(2)(da), obtain board approval and lodge within 90 days of financial year end.
- Brief major suppliers. Flow down supply chain, personnel and access requirements into contracts.
Measuring progress
- Material changes assessed for notification before contract award, as a share of all qualifying changes.
- Framework controls at target maturity, by hazard vector.
- Privileged human and non-human accounts on critical assets with named owners and vaulted credentials.
- Time from detection to ACSC report in drills against the 12-hour target.
- Program review completed within 12 months and annual report lodged on time.
Framework mapping
| Obligation | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Risk management program | GV.RM-01, ID.RA-01 | RA-3 |
| Competent supervision and effective control | ID.AM-01, DE.CM-01 | SI-4 |
| Personnel hazards | GV.RR-02 | PS-3 |
| Supply chain hazards and notification of outsourcing | GV.SC-07 | SR-3, SR-6 |
| Privileged and machine access | PR.AA-01, PR.AA-05 | AC-2, AC-6, IA-9 |
| Mandatory cyber incident reporting | RS.CO-02 | IR-6 |
Common failure patterns
- Citing a repealed regime: contracts and policies that still reference Part 14 and s 315A.
- Notifying after signing: raising a notification once the contract is executed, leaving no room to act on a risk notice.
- Treating CSP thresholds as fixed: not re-checking the 20,000 active services and Commonwealth customer tests as the customer base changes.
- Framework on paper: naming ISO 27001 or the Essential Eight in the program without a maturity baseline or plan to the milestones.
- Ignoring machine access in offshoring reviews: assessing human support staff locations but not where vendor automation and API credentials are used from.
Practitioner checklist
- All Part 14 references replaced with SOCI Act and TSRMP Rules references.
- Carrier and relevant CSP assets identified and the register current.
- Notification check built into architecture and procurement gates.
- Written risk management program covering five hazard vectors.
- Cyber framework chosen, baselined and planned to Level 1 and Level 2.
- Critical workers identified and credentials they control vaulted and owned.
- 12-hour and 72-hour reporting drilled, with written follow-up templates.
- Board-approved annual report lodged within 90 days of financial year end.
Standards and references
- Cyber and Infrastructure Security Centre: Telecommunications
- Cyber and Infrastructure Security Centre: Guidance for Responsible Entities for Critical Telecommunications Assets
- Cyber and Infrastructure Security Centre: Mandatory Cyber Incident Reporting Guidance
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
Related NHI Mgmt Group resources: Telecoms Security Laws Map · Australia Cyber Security Act 2024 Guide · Critical Infrastructure Identity Security Guide · Telecoms Identity Security Guide. This guide summarises Australia's telecommunications security obligations under the SOCI Act and TSRMP Rules as at 8 November 2026 and is not legal advice.