Australia's SOCI Act requires risk programs but stays silent on quantum
16 FEBRUARY 2023, CANBERRA
Australia's Security of Critical Infrastructure Act requires responsible entities to maintain risk management programs for critical infrastructure, with the relevant obligations commencing on 16 February 2023. The Act does not mention quantum. It imposes a broad duty to manage risk rather than naming specific threats, so there is no quantum-specific requirement in its text.
That broad duty is where quantum risk enters. Because the Act requires entities to manage risks to critical infrastructure, cryptographic and quantum risk can fall within those general obligations even without being named. An entity's risk program should account for threats to the cryptography its systems depend on, since a failure of that cryptography would threaten the infrastructure the Act protects.
The silence on quantum is therefore not an exemption. A risk management obligation is broad by design, so an emerging threat to critical infrastructure cryptography sits within it. Entities that read the Act's silence as permission to ignore quantum would misjudge how a general duty applies to a specific and growing risk.
Why it matters. The SOCI Act shows how quantum risk can bind critical infrastructure operators even without a dedicated rule: a general risk-management duty already covers it. Australian entities under the Act should fold quantum into their risk programs rather than wait for the Act to name it. Doing so also prepares them for sector supervisors, such as APRA, who are already making quantum expectations explicit.