The Enhanced CIRMP Rules, Mapped Clause by Clause
The Enhanced CIRMP Rules commenced on 10 June 2026 and they end the principles-based era for nine asset classes: broadcasting, domain name systems, electricity, energy market operators, freight infrastructure, freight services, gas, liquid fuel and water. The cyber obligations are now specific. Phishing-resistant multi-factor authentication with central logging. Network segregation of critical systems. Critical systems that keep running for at least three months while everything around them is rebuilt.
Grace periods put the first hard dates in June 2027 and June 2028, which sounds distant until you price the architecture change.
Download the RSA solution overview to see how each requirement maps to a named RSA capability, so you can see where your program already holds and where it does not.
Section 8B, credential compromise hazards
RSA can help Australian critical infrastructure organisations meet requirements for phishing-resistant FIDO2 authentication running locally on-premises in OT and cloud-hosted for IT, covering Windows jump boxes, Linux and Unix machines, and SAML or OIDC use cases. Plus the 200-plus authentication and administrative log messages that answer the central logging, monitoring and review obligation.
Section 8C, lateral movement hazards
See how RSA Authentication Manager allows organizations to authenticate independently while critical systems are segregated, how authentication survives more than 90 days of isolation from the rest of the network, and how agents mapped to endpoints, groups and roles deliver least privilege across systems that touch critical assets.
Section 9A, personnel hazards
Access controls for unauthorised or unsupervised access to critical components, and privileged access mapped to specific endpoints, groups and roles.
Most identity deployments assume connectivity. Phishing-resistant MFA delivered from a cloud identity provider is a third-party dependency, and Section 8C requires critical systems to stay operational for at least three months while other computers are in a state of restoration or recovery.
Cut an isolated OT environment off from its cloud authentication service and the operators are locked out at the exact moment access control matters most. The rule offers no relief for that. It legislates the ability to run the asset and deliver essential services while isolated.
RSA authenticates on-premises, in air-gapped and semi-air-gapped environments, through the isolation event and through the rebuild. That is the difference between a control that satisfies 8B on paper and one that survives 8C in practice.
The Enhanced CIRMP Rules were registered on 9 June 2026 and commenced the following day. Grace periods run from commencement.
The twelve-month clock runs out in June 2027. It covers additional material risks including foreign ownership, control and influence, core cyber risks covering unpatched systems, legacy technology and emerging technology, and access management risks.
The twenty-four-month clock runs out in June 2028. It covers the remaining cyber and information security hazards, including phishing-resistant MFA and network segregation, alongside supply chain, physical security and personnel background checks.
The rules also require a higher maturity level for responsible entities, including Essential Eight, the AESCSF, ISO 27001, NIST CSF 2.0 or C2M2.
Who do the Enhanced CIRMP Rules apply to?
Responsible entities for nine critical infrastructure asset classes: broadcasting, domain name systems, electricity, energy market operators, freight infrastructure, freight services, gas, liquid fuel and water. Entities outside those classes keep their existing baseline CIRMP obligations.
When do the Enhanced CIRMP Rules take effect?
They commenced on 10 June 2026. Twelve-month grace periods expire in June 2027 and twenty-four-month grace periods expire in June 2028, depending on the hazard category.
What does Section 8B require for multi-factor authentication?
Phishing-resistant multi-factor authentication across the specified systems and networks, plus central logging, monitoring and routine review of both successful and unsuccessful authentication attempts.
Does phishing-resistant MFA have to work without a cloud connection?
Section 8B does not say so directly. Section 8C does the work: critical systems must stay operational for at least three months while other computers are being restored. If authentication depends on an external cloud service, it fails that test the moment the environment is isolated.
What does the three-month operational requirement mean in practice?
Critical systems must be built to function independently during incident response and recovery, and that includes authentication. RSA Authentication Manager runs active/active and fault tolerant, and keeps authenticating on-premises while systems are isolated, rebuilt or recovered.
What does Section 9A require for privileged access?
A process or system in the CIRMP that minimises or eliminates the material risk of unauthorised or unsupervised access to critical components, and of the compromise or misuse of credentials and privileged access used to reach the asset.
Can RSA support air-gapped OT environments?
Yes. RSA provides FIDO2 phishing-resistant authentication that runs locally on-premises, and supports air-gapped and semi-air-gapped environments alongside conventional IT.
