The Critical Infrastructure Risk Management Program (CIRMP) is Australia’s framework requiring responsible entities to identify and manage material risks to covered critical infrastructure assets. It calls for documented assessments and controls that are reasonably practicable. Obligations vary according to an asset’s category, so operators need to align their program with the requirements that apply to each asset.
Cybersecurity is one part of CIRMP alongside operational and supply-chain resilience. A supplier may create risk through privileged access, software updates, maintenance services, or dependence on an upstream system. In practice, operators map these connections, assess how failures could affect essential services, and document why selected controls address the risks. CIRMP is a risk-management framework, not an incident report or a specific security product.