Key points

• Grid-scale BESS projects over 30 MW are classified as critical electricity assets under the SOCI Act.
• Responsible entities must register assets and update control or ownership changes in the CIAR.
• Service providers may be deemed operators if they have dispatch authority or Supervisory Control and Data Acquisition (SCADA) access.
• CIRMP obligations extend beyond cybersecurity to include physical, supply chain, and personnel risks.
• Cybersecurity incidents must be reported to the ACSC within 12 or 72 hours depending on severity.
• Ransomware payments are subject to mandatory reporting under the Cyber Security Act 2024 (Cth).
• Contracts should include flow-down obligations, access controls, and protected information protocols.
• Board oversight and annual CIRMP certification are required for governance compliance.

Introduction

Australia’s Battery Energy Storage System (BESS) sector is entering a new phase. As utility-scale projects transition from construction to operation, stakeholders must navigate the complex and evolving obligations under the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act). While often associated with cybersecurity, the SOCI regime reaches far deeper, touching on asset classification, operational control, data governance, contractual risk allocation and regulatory enforcement.

This guide provides a detailed, stakeholder-wide analysis of SOCI Act compliance for operational BESS projects to support developers, operators, contractors and suppliers.

1. Asset Classification: When a BESS is a critical electricity asset

Under section 10 of the SOCI Act and the Security of Critical Infrastructure (Definitions) Rules 2021, a BESS is deemed a critical electricity asset if it:

• provides System Restart Ancillary Services (SRAS); or
• has installed capacity of at least 30 MW and is connected to a wholesale electricity market.

Most grid-scale BESS projects meet these thresholds. Although technically a storage asset, a BESS functions as a generator when discharging to the grid.

The 30 MW threshold applies uniformly across NEM jurisdictions, including NSW, VIC, QLD, SA, TAS and the ACT. For non-NEM systems such as Western Australia's South West Interconnected System (SWIS), similar considerations apply where battery energy storage systems are connected to the Wholesale Electricity Market (WEM) and function as generators. In these cases, the key factors include whether the asset participates in market operations governed by the Electricity System and Market Rules, whether it is registered as a market participant or facility, and whether it contributes materially to system reliability or reserve capacity. These attributes may trigger classification as critical infrastructure under the SOCI Act, particularly where the BESS supports grid stability or is integrated into dispatchable generation portfolios.

Statutory references: SOCI Act s 10; Definitions Rules Part 2, Div 2.1, s 5.

Key Takeaway: Principals must register the asset and identify the responsible entity and direct interest holders. This is not a one-off exercise. Ownership or control changes must be updated.

2. Who bears the SOCI compliance burden?

The SOCI Act imposes obligations on:

• responsible entities (s 12L): typically the market participant or licence holder.
• direct interest holders (s 8): entities with at least 10 percent interest or influence.
• operators: entities with effective operational control, even if not formally registered.

For BESS projects, this creates a grey zone for O&M contractors and service providers. If a contractor has dispatch authority, SCADA access, or discretion over operational decisions, it may be deemed an operator under ss 12L(10)(b) or 8(1)(b).

The Security Legislation Amendment (Critical Infrastructure Protection) Act 2022 (Cth) clarifies that service providers are not captured unless they hold influence or control.

Key Takeaway: Contracts should clearly delineate roles and ensure the principal retains SOCI compliance responsibility.

3. Managing the grey area: Effective operational control

Outsourced service providers may attract scrutiny if they undertake integral operational roles. Risk factors include:

• independent dispatch discretion;
• unfettered SCADA access;
• governance rights that translate to de facto control; and
• market-facing roles that resemble licensable functions.

To manage this risk, contracts and operational arrangements should follow established governance practices that are widely accepted across the industry. These practices are not specific to any one project, rather they are general approaches that help ensure SOCI compliance by clearly allocating roles and responsibilities. The aim is to make sure the principal retains full control over the asset, and that service providers do not unintentionally take on functions that could expose them or the project to regulatory obligations. This includes defining service provider roles with precision, limiting their authority over operational decisions, and ensuring all market registrations and regulatory interfaces remain with the principal.

SOCI compliance must be embedded throughout the supply chain. Regulated entities should consider flowing down relevant obligations to service providers and subcontractors through contractual provisions. This can include ‘back-to-back’ drafting that mirrors compliance duties, or obligations to provide information and assistance to support the responsible entity’s statutory obligations. Contracts should also implement access controls to protect SOCI-sensitive materials, such as SCADA data, risk assessments, and encryption keys, and bind service providers to confidentiality and data handling protocols aligned with section 45 of the SOCI Act. The scope and appropriateness of these flow-downs should be assessed on a case-by-case basis, balancing regulatory risk with operational feasibility.

Key takeaway: Confirm the responsible entity and document ultimate control. Define “operate” narrowly for service providers. Retain all market registrations with the principal. Calibrate delegations to avoid discretionary control. Include savings provisions for lawful direct reporting. Treat SOCI-related data as protected information under s 45.

4. Registering on the CIAR

The Register of Critical Infrastructure Assets (CIAR) requires:

• responsible entities to provide operational information (s 23); and
• direct interest holders to provide interest and control information.

Contractors and service providers do not register unless they meet the statutory tests. Generally, their role is to cooperate contractually, maintaining accurate information and supplying it to the responsible entity.

Statutory references: Part 2, Divs 2–3; s 7 defines operational information.

Key takeaway: Ensure contractual obligations require timely and accurate information sharing to support CIAR compliance. Updates must be made promptly when ownership or control changes occur.

5. CIRMP obligations: More than cybersecurity

The Critical Infrastructure Risk Management Program (CIRMP) under Part 2A requires responsible entities to:

• identify and mitigate risks from cyber, physical, supply chain, personnel, and natural hazards;
• implement proportionate measures and controls; and
• maintain governance, assurance, and periodic review.

For BESS, this includes:

• remote access vulnerabilities;
• firmware risks in inverters and BMS;
• outsourced monitoring functions; and
• offshore data storage.

Responsible entities must certify the CIRMP annually and integrate incident learnings into the program.

Statutory reference: Part 2A of the SOCI Act.

Key takeaway: Embed CIRMP obligations into SCADA protocols, maintenance procedures, and subcontractor agreements. Ensure service providers support implementation through audits and reporting.

6. Cybersecurity incident preparation and notification

Under sections 30BC–30BD of the SOCI Act, responsible entities must report cybersecurity incidents to the Australian Cyber Security Centre (ACSC) within strict timeframes:

• critical incidents (i.e. those with a significant impact): within 12 hours; and
• other reportable incidents (i.e. those with a relevant impact): within 72 hours.

Preparation measures should include:

• continuous 24/7 monitoring across IT and OT environments;
• incident response playbooks that map internal severity classifications to SOCI thresholds;
• evidence capture protocols (e.g. logs, timelines, system configurations);
• coordination frameworks with Australian Energy Market Operator (AEMO) and relevant Network Service Providers (NSPs); and
• training programs and post-incident reviews to ensure readiness and continuous improvement.

Statutory references: s 30BC(1)(d), s 30BEA, s 30BD(1)(d), s 8G, s 12M

Contractual definitions of “security breach” may be broader than the SOCI Act’s statutory definitions. Organisations should ensure that their internal incident classification systems - including severity levels and escalation triggers - are aligned with SOCI’s “significant” and “relevant impact” thresholds. This helps reduce false positives while maintaining appropriate urgency and compliance.

Key takeaway: Ensure your organisation’s internal incident definitions and escalation protocols are clearly mapped to SOCI’s statutory impact thresholds. Test and embed these protocols across technical, legal, and operational teams to support timely and accurate reporting.

7. Ransomware and disclosure controls

Obligations include:

• immediate notification of ransomware demands;
• restrictions on disclosure without principal consent; and
• cooperation with forensic investigations.

Ensure internal policies and training reflect protected information handling under s 45.

It should also be noted that the Cyber Security Act 2024 (Cth) now imposes mandatory ransom payment reporting obligations. If a responsible entity (including those subject to the SOCI Act's security incident notification regime) pays a ransom in response to a ransomware attack, it must report the payment to the relevant authorities. For further detail, see Dentons' client alerts on the Cyber Security Legislative Package and Privacy Act reforms:

• Cyber Security Legislative Package: Strengthening Australia’s cyber security framework
• Australian Privacy Act reforms and Cyber Security Legislative Package passed: What you need to know

Key takeaway: Include ransomware protocols in incident response plans and ensure legal review of disclosure decisions.

8. Statutory notices and government directions

Regulators may issue:

• statutory Notices and Directions (ss 37-38); and
• information-gathering notices (s 35).

Contracts should require:

• immediate notification;
• full cooperation; and
• clear cost responsibility allocation.

Key takeaway: Establish internal protocols and ensure contractual alignment on cost and cooperation in response to government directions.

9. Data storage systems: hidden compliance risks

Data systems used in connection with a critical infrastructure asset may themselves be deemed part of the asset. This includes:

• network blueprints;
• encryption keys; and
• firmware and control logic.

If outsourced, the principal must issue a section 12F notice. If internally operated, CIRMP and reporting obligations apply.

Key takeaway: Audit all data systems linked to the BESS and assess their scope under s 9(7). Ensure appropriate notices and controls are in place.

10. Contractual risk allocation: Indemnities, caps, and carve-outs

Contracts should include:

• broad indemnities for breach of law;
• liability caps excluding fines and penalties; and
• carve-outs for wilful misconduct and statutory breaches.

Key takeaway: Review indemnity and liability clauses to reflect SOCI risk. Clarify the scope of protected information and ensure remedies preserve the owner’s ability to restore compliance swiftly.

11. Foreign ownership and national security interface

Foreign investment may trigger scrutiny under the Foreign Investment Review Board (FIRB) regime. The overlap with SOCI affects:

• transaction structuring and timing;
• disclosure obligations; and
• conditions on foreign investors (e.g., data localisation, board composition).

Key takeaway: Where foreign ownership is involved, ensure early alignment between SOCI compliance and FIRB strategy.

12. Enforcement and regulatory powers

The Minister and Secretary may:

• issue directions to mitigate risks (ss 37-38);
• compel information or documents (s 35); and
• intervene operationally (Part 3A).

Non-compliance can result in penalties, reputational damage, and government step-in powers.

Key takeaway: Ensure governance frameworks are SOCI-ready, with clear escalation pathways and legal review of any government notices or directions.

13. Interface with AEMO and network service providers

SOCI compliance must align with:

• AEMO’s operational and market procedures;
• NSP technical standards and connection agreements; and
• grid security and contingency planning protocols.

Key takeaway: Map SOCI obligations against AEMO and NSP requirements. Establish joint protocols for incident response, data sharing, and coordination.

14. Internal governance and board oversight

CIRMP must be subject to:

• board-level oversight;
• annual certification; and
• integration into enterprise risk management frameworks.

Statutory reference: Part 2A governance requirements.

Key takeaway: Ensure the board is briefed on SOCI obligations and that CIRMP implementation is subject to regular audit and executive reporting.

Conclusion: Excellence through clarity and control

Grid-connected BESS projects will generally qualify as “critical electricity assets” under the SOCI Act where they have an installed capacity of at least 30 MW and are connected to a wholesale electricity market, or where they provide system restart ancillary (black-start) services. The responsible entity, typically the licensed principal, bears the statutory burdens: CIAR reporting, CIRMP implementation, and cyber incident notification.

Contractors and service providers, while often outside direct statutory scope, must be carefully managed to avoid unintended regulatory exposure. The solution lies in clear design and robust governance.

Checklist summary:

• Retain ultimate control with the responsible entity.
• Define provider roles narrowly and contractually.
• Embed CIRMP and cyber readiness across operations.
• Respect protected information rules (s 45).
• Calibrate liability and cooperation mechanisms.
• Align contractual breach definitions with SOCI thresholds.
• Include flow-down obligations and access controls for subcontractors.
• Ensure board oversight and annual CIRMP certification.

This article is intended for general informational purposes only and does not constitute legal advice. Specific SOCI Act obligations should be assessed in the context of each project’s structure and operational arrangements.