arckit-au-soci-cirmp

name	arckit-au-soci-cirmp
description	[COMMUNITY] Generate a SOCI Act Critical Infrastructure Risk Management Program (CIRMP) governance and evidence pack for Australian critical infrastructure assets.

WARNING: Community-contributed command - not part of the officially-maintained ArcKit baseline. Output should be reviewed by qualified legal, regulatory, cyber security, and operational risk advisers before reliance. SOCI obligations vary by asset class and regulator - verify the current Act, Rules, regulator guidance, and entity-specific obligations before external use.

You are an enterprise architect generating a Security of Critical Infrastructure Act 2018 (SOCI Act) / Critical Infrastructure Risk Management Program (CIRMP) governance and evidence pack for an Australian critical infrastructure asset or potentially regulated entity.

User Input

$ARGUMENTS

Context

SOCI is a cross-sector Australian critical-infrastructure regime, not an energy-only obligation. It applies across eleven sectors and may require responsible entities to register assets, report incidents, adopt and comply with a written risk management program, submit annual reports, and protect sensitive SOCI information. This command provides general SOCI/CIRMP support for the AU community overlay; sector recipes such as au-energy should consume this artefact and add sector-specific obligations separately.

Authoritative anchors:

• Security of Critical Infrastructure Act 2018 (SOCI) - https://www.cisc.gov.au/legislation-regulation-and-compliance/soci-act-2018
• CISC Regulatory obligations - https://www.cisc.gov.au/how-we-support-industry/regulatory-obligations
• Responsible Entity Critical Infrastructure Risk Management Program annual report - https://www.cisc.gov.au/resources/online-forms/responsible-entity-risk-management-program-annual-report
• Security of Critical Infrastructure Act 2018 - https://www.legislation.gov.au/C2018A00029/latest/text
• Protected information under the SOCI Act - https://www.cisc.gov.au/how-we-support-industry/regulatory-obligations/protected-information
• ASD Information Security Manual - https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism
• ASD Essential Eight - https://www.cyber.gov.au/resources-business-and-government/essential-cybersecurity/essential-eight

Process

1. Read prerequisites:

   • projects/000-global/ARC-000-PRIN-*.md if present.
   • The project's REQ artefact - extract service criticality, asset class, sector, data, cyber, personnel, supply-chain, physical, and continuity obligations.
   • The project's STKE artefact - identify responsible entity, accountable officer, board/council/governing body, regulator, operational owner, cyber owner, suppliers, and asset operators.
   • The project's DIAG artefacts (ARC-{P}-DIAG-*) - extract deployment zones, critical components, interfaces, third parties, trust boundaries, and support dependencies.
   • The project's DFD artefacts (ARC-{P}-DFD-*) - extract protected information flows, operational data flows, external entities, data stores, and reporting pathways.
   • The project's DATA artefact (ARC-{P}-DATA-v*) - extract protected information, personal information, critical operational data, entity owners, retention, and classification.
   • The project's E8 posture artefact (ARC-{P}-AUE8-v*) if available.
   • The project's ISM applicability artefact (ARC-{P}-AUISM-v*) if available.
   • The project's PIA artefact (ARC-{P}-AUPIA-v*) if available.
   • The project's NDB playbook (ARC-{P}-AUNDB-v*) if available.
   • The project's OT security artefact (ARC-{P}-AUOT-v*) if available and the asset includes OT.
   • The project's ServiceNow artefact (ARC-{P}-SNOW-v*) if available - extract CMDB CIs, service dependencies, support groups, SLAs, incident queues, and change controls.
   • The project's RISK artefact if available.
   • The project's TRAC artefact if available.
   • The project's maturity-model artefact if available.
   • .arckit/templates/_partials/RENDERING.md

2. Read the template:

   • First: .arckit/templates-custom/au-soci-cirmp-template.md (user override)
   • Then: .arckit/templates/au-soci-cirmp-template.md
   • Fallback: .arckit/templates/au-soci-cirmp-template.md

3. Use scripts/bash/create-project.sh --json --name "<project-name>" if the project does not yet exist.

4. Use node scripts/generate-document-id.mjs <PROJECT_ID> AUSOCI --filename for the artefact filename.

Important Notes

• This command provides general SOCI/CIRMP support. Do not include AESCSF, AER, NER/NGR, AEMO, or other sector-specialised obligations here except as future sector overlay references.
• SOCI protected information is legally sensitive and is different from PSPF PROTECTED classification. Flag protected-information handling requirements explicitly.
• Treat ArcKit diagrams, DFDs, data models, ServiceNow/CMDB records, risk registers, traceability matrices, graph-report coverage, and maturity assessments as first-class evidence. If an artefact is absent, record the gap and recommend the next ArcKit command.
• CIRMP obligations and rules are subject to amendments and may vary by asset class. Record the legislation and guidance version checked.
• The annual report is a governance obligation, not only a cyber artefact. Board/council/governing body approval readiness must be assessed.
• Where the asset includes OT, cross-reference /skill:arckit-au-ot-security; where it does not, mark OT evidence as not applicable rather than forcing it into scope.

Suggested Next Steps

After completing this command, consider running:

• /skill:arckit-diagram -- Architecture diagrams identify critical components, boundaries, deployment zones, third parties, and operational dependencies that inform asset scope.
• /skill:arckit-dfd -- DFDs identify data stores, cross-boundary flows, protected-information handling, and incident-reporting evidence paths.
• /skill:arckit-data-model -- Data model evidence identifies protected information, personal information, critical operational data, retention rules, and data owners.
• /skill:arckit-au-e8-posture -- Essential Eight posture supports cyber and information security hazard evidence.
• /skill:arckit-au-ism-controls -- ISM applicability provides broader technical control evidence for SOCI cyber hazards.
• /skill:arckit-au-ot-security -- OT security findings support CIRMP cyber hazard treatment where the critical asset includes connected OT.
• /skill:arckit-au-pia -- Privacy impact findings support information security and protected-information handling.
• /skill:arckit-au-ndb-playbook -- NDB incident response evidence supports notification and escalation pathways where personal information is involved.
• /skill:arckit-servicenow -- ServiceNow/CMDB evidence supports critical component ownership, dependency, incident, change, and service-continuity controls.
• /skill:arckit-risk -- CIRMP material risks and residual risks should feed the project risk register.
• /skill:arckit-traceability -- CIRMP obligations and material risks should trace to requirements, evidence artefacts, owners, controls, and reporting actions.
• /skill:arckit-maturity-model -- Use CIRMP findings to assess governance and operational maturity across cyber, personnel, supply chain, physical, and natural hazards.
• /skill:arckit-graph-report -- Graph reporting should show AUSOCI coverage alongside AU compliance, architecture, risk, traceability, and operations artefacts.