Topic starter
06/09/2026 6:21 pm
TL;DR: Australia’s updated SOCI rules now require phishing-resistant authentication, least privilege, and access review capability that continues to work for up to 90 days in isolated critical infrastructure environments, according to RSA Security’s analysis. The governance shift is bigger than MFA selection: cloud-only identity assumptions no longer satisfy resilience, recovery, or audit expectations.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Addressing SOCI 8B and 8C Obligations for Critical Infrastructure”.
Key questions
Q: What breaks when cloud-only MFA is used for isolated critical infrastructure?
A: Cloud-only MFA breaks the continuity of identity assurance when the environment is disconnected.
Q: Why do SOCI 8B and 8C make authentication a resilience issue?
A: Because the rules require critical systems to keep operating while the environment is isolated or being restored.
Q: What is the difference between least privilege and access review?
A: Least privilege is the design principle that limits access to what is required, while access review is the governance activity that checks whether current access still matches that principle.
Practitioner guidance
- Validate authentication during isolation Test whether phishing-resistant MFA still works when cloud connectivity is removed, including for privileged and unprivileged access paths to critical systems.
- Map recovery access before rebuild starts Document which roles can restore critical systems, which accounts are temporary, and how least privilege is preserved while other computers are in restoration.
- Prove access review inside the isolated model Run attestation and access review workflows in the same on-premises or air-gapped conditions that SOCI 8C expects during continuity operations.
Bottom line: SOCI 8B and 8C shift MFA from a login control to a resilience control for critical infrastructure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 6:21 pm
Cloud-dependent MFA creates an isolation gap: SOCI 8B does not merely ask whether authentication is phishing-resistant. It exposes the assumption that identity services will always be reachable when operators need them. That assumption fails in isolated critical infrastructure because the control boundary now includes the recovery state, not just the steady-state environment. Practitioners should treat authentication continuity as part of resilience architecture, not a separate IAM concern.
A question worth separating out:
Q: How should critical infrastructure teams test IAM against isolation requirements?
A: They should exercise authentication, privileged access, and review workflows inside the same isolated operating model they expect in production. The test is whether governance still works when cloud dependencies are removed, not whether the controls function in a normal connected environment. If they fail in isolation, they are not meeting the SOCI intent.
👉 Read our full editorial: SOCI 8B and 8C turn MFA into an isolation requirement