Enhanced obligations are additional requirements under Australia’s Critical Infrastructure Risk Management Program (CIRMP) that may apply to assets in higher regulatory categories. They go beyond the baseline duties and depend on how an asset is designated under the relevant rules.
For operators, the distinction matters because a general corporate security policy may not meet the requirements for a particular asset. In practice, enhanced obligations can mean more rigorous risk assessment, controls, documentation, and assurance around cyber threats and supplier dependencies, including privileged access or reliance on external services. Operators should confirm each asset’s category, map its dependencies, and retain evidence explaining why selected controls are appropriate and reasonably practicable.