[{"data":1,"prerenderedAt":91},["ShallowReactive",2],{"news-\u002Fnews\u002Faustralia-soci-act-risk-programs-silent-on-quantum":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":43,"date":44,"description":45,"draft":46,"extension":47,"faqs":48,"findingsSource":8,"geo":58,"image":60,"industries":61,"keyFindings":8,"meta":64,"modified":65,"navigation":66,"path":67,"pullquote":8,"recommendations":8,"references":68,"related":72,"seo":79,"seoTitle":80,"signposts":8,"slug":81,"stats":8,"stem":82,"tags":83,"tldr":89,"__hash__":90},"news\u002Fnews\u002Faustralia-soci-act-risk-programs-silent-on-quantum.md","Australia's SOCI Act Requires Risk Programs but Stays Silent on Quantum","ArcQubit Team","",null,{"type":10,"value":11,"toc":39},"minimark",[12,17,24,27,30,33],[13,14,16],"h2",{"id":15},"australias-soci-act-requires-risk-programs-but-stays-silent-on-quantum","Australia's SOCI Act requires risk programs but stays silent on quantum",[18,19,20],"p",{},[21,22,23],"strong",{},"16 FEBRUARY 2023, CANBERRA",[18,25,26],{},"Australia's Security of Critical Infrastructure Act requires responsible entities to maintain risk management programs for critical infrastructure, with the relevant obligations commencing on 16 February 2023. The Act does not mention quantum. It imposes a broad duty to manage risk rather than naming specific threats, so there is no quantum-specific requirement in its text.",[18,28,29],{},"That broad duty is where quantum risk enters. Because the Act requires entities to manage risks to critical infrastructure, cryptographic and quantum risk can fall within those general obligations even without being named. An entity's risk program should account for threats to the cryptography its systems depend on, since a failure of that cryptography would threaten the infrastructure the Act protects.",[18,31,32],{},"The silence on quantum is therefore not an exemption. A risk management obligation is broad by design, so an emerging threat to critical infrastructure cryptography sits within it. Entities that read the Act's silence as permission to ignore quantum would misjudge how a general duty applies to a specific and growing risk.",[18,34,35,38],{},[21,36,37],{},"Why it matters."," The SOCI Act shows how quantum risk can bind critical infrastructure operators even without a dedicated rule: a general risk-management duty already covers it. Australian entities under the Act should fold quantum into their risk programs rather than wait for the Act to name it. Doing so also prepares them for sector supervisors, such as APRA, who are already making quantum expectations explicit.",{"title":7,"searchDepth":40,"depth":40,"links":41},2,[42],{"id":15,"depth":40,"text":16},"Policy","2023-02-16","Australia's SOCI Act requires critical infrastructure risk programs from February 2023 but stays silent on quantum, so cryptographic risk enters via general duties.",false,"md",[49,52,55],{"q":50,"a":51},"What does the SOCI Act require?","The Security of Critical Infrastructure Act requires responsible entities to maintain risk management programs for critical infrastructure, with the relevant obligations commencing on 16 February 2023. The Act does not mention quantum, so it imposes no quantum-specific duty.",{"q":53,"a":54},"How does quantum risk fit under the SOCI Act?","Because the Act requires entities to manage risks to critical infrastructure, cryptographic and quantum risk can fall within those general duties even though the Act never names quantum. An entity's risk program should account for threats to the cryptography its systems depend on.",{"q":56,"a":57},"Does silence on quantum mean entities can ignore it?","No. A risk management obligation is broad by design, so an emerging threat to critical infrastructure cryptography sits within it. Entities should treat quantum as one of the risks their program must consider, rather than reading the Act's silence as an exemption.",[59],"canberra","\u002Fassets\u002Fog-default.png",[62,63],"Government Facilities","Cross-Sector",{},"2026-08-17",true,"\u002Fnews\u002Faustralia-soci-act-risk-programs-silent-on-quantum",[69],{"label":70,"url":71},"Government of Australia, \"Security of Critical Infrastructure Act: risk management program obligations,\" commenced Feb. 16, 2023.","https:\u002F\u002Fwww.cisc.gov.au\u002F",[73,76],{"label":74,"url":75},"Australia's APRA Signals Tougher Quantum Supervision for Finance","\u002Fnews\u002Faustralia-apra-signals-tougher-quantum-supervision",{"label":77,"url":78},"Australia's ISM-1917 Requires New Government Cryptography to Support PQC by 2030","\u002Fnews\u002Faustralia-ism-1917-gov-crypto-pqc-by-2030",{"title":5,"description":45},"Australia's SOCI Act Requires Risk Programs","australia-soci-act-risk-programs-silent-on-quantum","news\u002Faustralia-soci-act-risk-programs-silent-on-quantum",[84,85,86,87,88],"critical infrastructure","federal compliance","quantum readiness","quantum risk","for government","Australia's SOCI Act requires critical infrastructure risk programs from February 2023 but does not mention quantum, so cryptographic risk enters through its general duties.","SH8n7KPSP9XtHE5YZFdu74WbSJ70v7ubCnA1P1l9ySs",1792182887391]