SOCI Act — Critical Infrastructure Risk Management Program

Chains attack paths to assets whose compromise would cause operational stoppage — concrete evidence of which technical weaknesses constitute the material risk s 6(a) calls out.

Tests the internet-facing remote-access surface to operational control and monitoring systems — surfaces the exact remote-access exposure s 6(e) classifies as material risk.

Auto-classifies the business-critical data an attacker could actually reach, mapped to 12 business-risk categories — concrete evidence of whether the confidentiality of the data storage system can be breached — which business-critical data an attacker could actually reach and take.

For cloud-hosted data storage (AWS, Azure/Entra ID), a credentialed cloud pentest enumerates resources and proves IAM misconfiguration, privilege-escalation and lateral-movement paths to storage — including demonstrated Entra ID Global Admin compromise with no CVE — additional direct evidence of whether a cloud-hosted data storage system can be breached.

Every NodeZero pentest produces a ranked list of validated material risks against the CI asset — direct technical evidence the CIRMP can register against the s 7(1)(b) identification obligation.

Delivers targeted tests for newly disclosed critical CVEs — often within hours of disclosure, and in some cases ahead of the public patch — so the CIRMP can stay current in response to changes in the cyber threat landscape.

Tracks every proven weakness through an Open → Mitigated → Regressed lifecycle, with Quick Verify re-running the exact attack path to confirm a fix actually closed the gap (internal environments) — the open-to-verified-closed remediation record that keeps the CIRMP current on more than identification alone, and supports the s 8(2)(a) duty to minimise material cyber risk.

Behaves like a real attacker — chains exploitable weaknesses into end-to-end attack paths to surface the material cyber risks your CIRMP has to eliminate or mitigate.

Where the critical infrastructure asset includes customer or operational web applications, WebApp Pentesting tests them for exploitable weaknesses that chain into credential compromise and host takeover — one class of material cyber hazard the section 8(2) duty covers. OT and SCADA environments remain outside NodeZero's scope.

Drops decoy AD accounts baited for kerberoasting and AS-REP roasting during a test — any interaction is malicious by definition, so it proves in production whether your SOC can see an attacker moving against AD, direct evidence of mitigating the impact of a cyber hazard through detection.

The s 8(4) table lists five frameworks (Essential Eight, NIST CSF, ISO 27001, C2M2, AESCSF). Whichever framework the entity adopts, NodeZero produces the technical evidence — proof-of-exploit and attack-path summaries — you can put in front of a CISC reviewer to show whether the chosen framework is actually implemented, not just documented.

Takes an insider perspective and proves the real-world impact a malicious or negligent employee or contractor could have on the CI asset — technical validation of the s 9(1)(c)(i) material risk.

Surfaces weak, breached and reused credentials on still-active accounts and computes the blast radius one such credential unlocks — supporting evidence of residual access risk. For access that lingers after off-boarding, pair with Insider Threat Testing, which proves the reach of stale or over-provisioned accounts.

Proves whether a compromise at a supplier interconnect would actually be contained by segmentation, or would cascade into your critical infrastructure asset.

Starts from a supplier-style authenticated position and proves the real blast radius that a provider's access could reach — the risk s 10(1)(a)(ii) calls out.

Chains attack paths originating in third-party systems through to the CI asset — evidence of how a supply-chain issue would actually propagate.