The Enhanced CIRMP Rules 2026: Looking Beyond the Legislative Amendments

The Enhanced CIRMP Rules 2026 introduce the most significant expansion of Australia's Critical Infrastructure Risk Management Program (CIRMP) framework since its inception. But beyond the additional legislative obligations lies a more important question: what do these changes reveal about the future direction of Australia's critical infrastructure regulation?In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory examine how the Enhanced CIRMP Rules 2026 signal a shift from demonstrating compliance to demonstrating organisational security capability. They discuss why Boards and senior executives should view the implementation period as a strategic opportunity to strengthen governance, build integrated security capability and prepare for future assurance obligations—not simply another compliance exercise.Drawing on Pentagram Advisory's detailed analysis of the Baseline and Enhanced CIRMP frameworks, this episode explores the key implementation timeframes, the evolving regulatory expectations, and why organisational readiness has become just as important as organisational maturity.This is the first episode in a new series examining the Enhanced CIRMP Rules 2026. Future episodes will explore the enhanced personnel security, supply chain security, cyber and information security, and physical security requirements, together with practical approaches to implementation.For more information, visit https://pentagramadvisory.com.au/