What cyber security incident response means in Australian critical infrastructure

Incident response in critical infrastructure is not just a security workflow. It is the operating model for protecting essential services when technology trust, safety assumptions, suppliers, executives, and regulators are all in motion.

Incident response is overdefined. The real test is operational.

This article opens xCIRT’s series on consequence-led cyber incident response for Australian critical infrastructure. The premise is simple: cyber security incident response is not only what the security team does after an alert. It is the coordination of technical response, operational decisions, executive authority, regulatory awareness, supplier management, communications, and continuity planning when essential services may be at risk.

That distinction matters because many organisations still describe incident response as if it starts with a compromised account, malicious file, or suspicious connection. That view is too narrow for an operator running energy, water, transport, telecommunications, healthcare, data storage, gas, ports, or aviation services. In those environments, a cyber incident can quickly become a question of safety, service continuity, operational control, evidence preservation, regulatory reporting, and executive accountability.

ASD’s incident response planning guidance states that managing cyber security incidents is the responsibility of affected organisations and that organisations should have a tested and reviewed cyber security incident response plan. That should be read plainly: operators should not plan on ASD stepping in to run their cyber crisis. That should not surprise anyone. Effective crisis response depends on intimate knowledge of the organisation, systems, people, constraints, safety assumptions, suppliers, and operating priorities. No external party can match that inside knowledge.

Across this series, we will show why Australian critical infrastructure teams need to be practised across the continuum from cyber incident response through to cyber crisis response.

Where this hits operationally

Critical infrastructure is different because the consequences are different. The CISC describes critical infrastructure as interconnected, which means disruption in one area can create flow-on effects across essential services, the economy, national security, sovereignty, and public confidence. The question is not only “can we remove the attacker?” The better question is “can we keep services safe, trusted, and recoverable while we investigate, contain, report, communicate, and rebuild?”

This is where cyber resilience becomes a safety enabler. In process-oriented environments, cyber controls are not abstract risk controls. They protect the conditions under which plant, equipment, field assets, control systems, communications, and operators can continue to behave predictably. ASD’s operational technology principles link OT cyber security directly to the continuity of vital services such as water, energy, and transportation.

That also changes the shape of response decisions. Disconnecting a system may stop command and control traffic, but it may also remove visibility from an operator. Resetting credentials may be necessary, but it may block vendor access needed for safe recovery. Rebuilding a server may look clean from a forensic perspective, but it is not enough if the engineering team cannot prove the restored configuration matches the process state.

The SOCI and CI Fortify angle

The regulatory direction is moving toward resilience, not just response. On 25 March 2026, the Minister for Home Affairs opened consultation on reforms to the SOCI Act, including proposed changes to Ministerial Directions powers and enhanced Critical Infrastructure Risk Management Program rules.

The practical signal for operators is clear even while the legal detail is still subject to review. Waiting for formal obligations to settle can reduce your freedom of action. Acting now lets operators shape their own resilience path before direction, crisis pressure, supplier constraint, or public consequence narrows the options. For planning purposes, xCIRT treats CI Fortify as a strong indicator of where Australian critical infrastructure resilience expectations are moving, while the precise legal effect of any SOCI reform should be confirmed with legal counsel.

ASD CI Fortify asks critical infrastructure operators to identify critical services, vital OT and enabling systems, isolation points, inventories, and rebuild requirements. It also asks operators to plan for temporary isolation of vital OT and enabling systems for three months while maintaining critical services, and to prove they can rapidly rebuild those systems. That language forces the conversation away from generic “systems” and toward the dependencies that keep essential services operating.

What readiness has to prove

A mature critical infrastructure incident response capability is built before the first alert. It has playbooks for likely scenarios, role cards for decision-makers, evidence handling procedures, supplier contact paths, legal and regulatory triggers, communications templates, and a tested bridge into crisis management and business continuity.

It should also make the uncomfortable tradeoffs visible before the incident.

1. Which critical services must be protected first if response capacity, supplier access, or system trust is constrained?
2. Who can approve containment actions that may affect safety, uptime, customer service, or regulatory reporting?
3. Which OT, IT, cloud, identity, network, vendor, and data dependencies are required to keep those services operating?
4. What evidence must be preserved for response, reporting, legal decisions, and lessons learned?
5. What must be rebuilt, isolated, or operated manually if the organisation cannot trust parts of its environment?

The warning signs are usually visible before the incident. The plan does not name operational, engineering, crisis, communications, legal, supplier, and executive decision owners. IT assumes it can isolate systems without OT safety or process approval. Supplier contacts and remote access pathways are out of date. Logs are not retained long enough to reconstruct what happened. Business continuity plans assume technology recovery paths that may not be available during a cyber incident.

Those are ordinary planning gaps. During a real incident, they become expensive, visible, and politically charged.

Operator implications

SOCI

Treat incident response as part of governance and operational readiness, not only a technical function. SOCI includes obligations that may apply to critical infrastructure assets, including reporting cyber incidents that impact the delivery of essential services, maintaining risk management programs, and additional enhanced cyber security obligations for Systems of National Significance. Current 2026 consultation on SOCI reforms also points to stronger direction powers and enhanced CIRMP expectations. This article is not legal advice; map obligations with legal counsel.

ASD CI Fortify

Define critical services, identify vital OT and enabling systems, maintain current inventories, and understand which systems must remain functional during disruption. Incident response should support continuity, isolation, and rebuild decisions rather than only attacker eviction. Treat ASD CI Fortify as a practical resilience signal even where legal obligations are still evolving.

CISA CI Fortify

Plan for isolation, recovery, degraded operations, unreliable third-party dependencies, and the possibility that threat actors may already have access to critical environments during a crisis. Use CISA CI Fortify as supporting context for resilience and emergency planning.

The honest version

Cyber security incident response still needs forensics, malware analysis, identity response, cloud evidence, endpoint telemetry, network triage, and disciplined containment. Those capabilities matter. But in critical infrastructure, they have to serve a higher objective: protect essential service delivery while restoring trust in the systems that support it.

That is why xCIRT frames incident response as consequence management. The best plan is not the thickest plan. It is the one that works when the normal operating environment no longer behaves normally, when the right supplier is hard to reach, when the board wants defensible decisions, when government reporting may be triggered, and when operations need the safest path through degraded service.

The simplest test is this: if your incident response plan still reads like an IT security document, it is probably not ready for Australian critical infrastructure consequences.

---

Written by Trent Prasser