SOCI Act / AESCSF Compliance Assessment
Identifies SOCI Act, critical infrastructure resilience and AESCSF compliance or maturity assessments that record an entity's own results. Assessment titles alone are discovery-only; enforcement requires AESCSF practice IDs, maturity indicator levels or security profiles, or populated compliance status rows. CIRMP records and reports are handled by au-soci-risk-management-program-record.
- Type
- regex
- Engine
- boost_regex
- Confidence
- medium
- Confidence justification
- Medium confidence: assessment titles are discovery-only; enforcement needs AESCSF practice, maturity/profile or populated status structure, and 85 adds a second structure and asset/entity context.
- Jurisdictions
- au
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- AESCSF, QGISCF
- Data categories
- security, government, infrastructure
- Scope
- narrow
- Risk rating
- 8
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported
Pattern
(?i)\b(?:SOCI\s+Act\s+compliance\s+(?:assessment|audit|report|review)|SOCI\s+Act\s+(?:self[\s-]assessment|gap\s+analysis|assessment|audit)|Security\s+of\s+Critical\s+Infrastructure\s+(?:Act\s+)?(?:compliance|resilience)\s+(?:assessment|audit|review)|AESCSF\s+(?:self[\s-]assessment|assessment|maturity\s+assessment|compliance\s+report|results)|critical\s+infrastructure\s+resilience\s+assessment)\bShould match
AESCSF self-assessment 2026 - NorthGrid Distribution (responsible entity), critical asset: Eastvale transmission substation Practice ACCESS-2b Status: Partially implemented Target profile: SP-2 Practice THREAT-1c Status: Not implemented (MIL1 gap) Remediation owner: OT Security Lead Kelvin Marr, due 30/11/2026— High tier (85) - AESCSF practice IDs, security profile and populated status rows with responsible-entity and critical-asset contextSOCI Act compliance assessment - Riverbend Water Corporation Item 4.2 personnel hazards - Status: Not met; contractor background checks incomplete for the control room.— Medium tier (75) - populated compliance status row without asset contextAESCSF maturity assessment summary for the gas business: current state MIL1 across the RESPONSE domain.— Medium tier (75) - maturity indicator level without a second structureThe board asked for the SOCI Act compliance assessment to be tabled at the next meeting.— Discovery tier (65) - assessment title in a routine sentence without results
Should not match
Social media compliance report— Unrelated compliance wordingThe society meeting was productive— Unrelated social usageThe public website summarises the SOCI Act and its obligations.— Public legislative overview without an assessment recordThis guidance explains how entities should prepare an AESCSF self-assessment, rating each practice such as ACCESS-2b as fully, largely or not implemented against SP-1 to SP-3.— Regulator guidance naming practices and profiles must stay below 75AESCSF self-assessment template Responsible entity: ________ Practice ID: ________ Status: ________ Target profile: ________— Blank templateMedia release: more energy businesses completed an AESCSF assessment this year, with most reaching SP-1.— News framing with a profile level must not enforceTraining example: SOCI Act compliance assessment for critical asset CA-104 with Status: Not met and overdue remediation— Explicit training content must not enforce
Known false positives
- Public legislation, CISC guidance, AESCSF framework documentation and conference material name SOCI/AESCSF assessments, practices and maturity levels without an entity's results. Mitigation: Titles are discovery-only; enforcement needs populated practice/maturity/status structure, and guidance, policy, training and media framing are excluded.
- CIRMP annual reports and risk management program records. Mitigation: CIRMP wording was removed from this detector; those records are covered by au-soci-risk-management-program-record.