Critical infrastructure is now a primary ransomware target.
ASD responded to more than 200 denial-of-service incidents in 2024–25, up more than 280% on the year before, and denial of service featured in almost a third of the incidents it handled for critical infrastructure. Supply chain and legacy edge services remain the recurring entry points — from default-password PLCs on US water utilities to the Jaguar Land Rover cascade that the UK Cyber Monitoring Centre estimates at £1.9 billion in economic loss.
Why critical infrastructure is in the crosshairs
Five shifts shaping the CI threat environment — what attackers are doing, and what regulators now expect operators to prove.
Critical infrastructure has become a primary ransomware target
KELA's 2025 data shows 50% of all tracked ransomware attacks hit critical sectors, with the absolute number of CI attacks rising 34% year-on-year. CI operators face the greatest downtime pressure and the highest public and regulatory scrutiny — and attackers are targeting that pressure deliberately.
State-sponsored actors are pre-positioning
ASD's 2024–25 report is explicit that state actors target Australian CI for "state goals". The CyberAv3ngers (IRGC) campaign against US water utilities, Volt Typhoon's activity against US CI, and the Viasat KA-SAT attack at the outset of the Ukraine invasion illustrate the same pattern: establishing footholds now, preserving disruption options for later.
OT is the front line, and it is behind IT
Many OT systems — water treatment PLCs, solar inverters, building management, pipeline SCADA — predate modern security. Default passwords, unencrypted protocols, and direct internet exposure persist. CyberAv3ngers compromised at least 75 internet-connected Unitronics PLCs, including at least 34 in the US water and wastewater sector, many with default or no passwords. Forescout's SUN:DOWN research found 80% of vulnerabilities disclosed in solar power systems over the past three years were high or critical severity.
Most entry comes through IT and suppliers, not OT
Colonial Pipeline shut down its pipeline after ransomware reached its IT network through a legacy VPN account without MFA. Synnovis, a pathology supplier, disrupted London hospitals. The JLR shutdown cascaded to more than 5,000 organisations. None of these began in OT. Verizon's 2026 DBIR found a third party involved in 48% of breaches, up 60% on the previous year.
Regulation is moving from "controls in place" to "evidence of effectiveness"
Australia's SOCI amendments, the UK's proposed ransomware payment ban for public sector and CI operators, the EU's NIS2 directive, and US EPA moves on water utility cybersecurity all point the same way — regulators want evidence that controls are working, not just that they exist on paper.
What regulators and experts are saying
Cybersecurity threats are a serious concern for our nation's water infrastructure, including the communities, businesses, hospitals, and other critical infrastructure sectors that rely on these critical lifeline services.
At £1.9 billion of financial loss, this incident appears to be the most economically damaging cyber event to hit the UK, with the vast majority of the financial impact being due to the loss of manufacturing output at JLR and its suppliers.
Cyber Security Act 2024 is now in force
Since 30 May 2025, businesses with turnover above $3M, and SOCI Part 2B responsible entities regardless of turnover, must report a ransomware or cyber extortion payment to ASD within 72 hours. The Cyber Incident Review Board can now conduct no-fault reviews of significant cyber security incidents.
The Security of Critical Infrastructure Act 2018 (SOCI Act) requires responsible entities for critical infrastructure assets to maintain a Critical Infrastructure Risk Management Program (CIRMP). The CIRMP must address four hazard vectors: cyber and information security, personnel, supply chain, and physical security. For the cyber hazard vector, entities must adopt and comply with one of five approved frameworks — ASD Essential Eight, NIST Cybersecurity Framework, ISO/IEC 27001, C2M2, or AESCSF, or an equivalent framework. The choice of framework should reflect the entity's risk profile and operational context. The annual report on the CIRMP must be approved by the board and given to CISC within 90 days of the end of the financial year.
LegislationFederal legislation covering 11 sectors including energy, water, transport, communications, and data storage. Responsible entities must maintain a CIRMP addressing four hazard vectors: cyber, personnel, supply chain, and physical security. NodeZero directly validates controls under the cyber hazard vector and tests supplier network segmentation under the supply chain vector. For the cyber vector specifically, entities must also adopt one of five approved frameworks which define the detailed technical controls.
Prescriptive and technically focused. Eight specific mitigation strategies with clear pass/fail controls. Common for government-adjacent entities, defence industry, and smaller organisations adopting ASD guidance.
Where NodeZero appliesBroad lifecycle coverage from governance through recovery without mandating specific technologies. Suited to entities operating across jurisdictions or mapping existing controls into a flexible structure.
Where NodeZero appliesInternational management system standard with formal certification. Chosen by larger entities with mature security programs, international operations, or existing ISO certification investment.
Where NodeZero appliesMaturity model assessing organisational capability across 10 domains. Originally built for the US electricity sector. Process and governance oriented — less about specific controls, more about repeatable capability.
Where NodeZero appliesSector-specific to energy. Derived from C2M2 and NIST CSF with Australian privacy additions. Managed by AEMO. Widely used by electricity and gas market participants with OT/ICS environments.
Where NodeZero applies
Critical infrastructure operators often hold personal information of customers, employees, and stakeholders subject to the Australian Privacy Principles.
Where NodeZero applies
Relevant for infrastructure operators providing managed or shared services, particularly in water, energy, and transport sectors.
Where NodeZero applies
Applies to infrastructure operators that process customer payments — utilities, transport, and port authorities handling card transactions.
Where NodeZero applies
Mandatory 72-hour ransomware payment reporting applies to SOCI Part 2B responsible entities regardless of turnover, as well as to businesses over $3M turnover.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
Cyber Security Act 2024 — ransomware reporting
30 May 2025Mandatory reporting to ASD within 72 hours of making a ransomware payment (or becoming aware of it), for businesses over $3M turnover and SOCI Part 2B responsible entities. The reporting obligation carries a civil penalty of 60 penalty units (a 5x multiplier applies to bodies corporate).
Cyber Incident Review Board
30 May 2025Independent board that conducts no-fault, post-incident reviews of significant cyber security incidents and publishes lessons for the wider economy. NodeZero's timestamped test records show which attack paths were tested and closed before an incident.
TSRMP Rules 2025
4 Apr 2025Telecommunications security obligations moved into the SOCI Act. Carriers, and carriage service providers above the rules' thresholds, must have and comply with a CIRMP for their critical telecommunications assets, tailored by the TSRMP Rules.
Enhanced CIRMP Rules 2026
In force June 2026LIN 26/075 applies enhanced requirements to nine asset classes, including critical electricity, gas, liquid fuel, water, freight and broadcasting assets: an uplifted cyber framework (Essential Eight ML2, C2M2 MIL-2, AESCSF SP-2, ISO/IEC 27001:2023, NIST CSF 2.0 or an equivalent), plus new credential-compromise (s 8B) and lateral-movement (s 8C) requirements, with network segregation of critical systems as the benchmark, phasing in over 24 months (to June 2028).
Source: Federal Register of Legislation — LIN 26/075Enhanced Response and Prevention Act 2024
20 Dec 2024Gives the Secretary of Home Affairs power to direct a responsible entity to address a "seriously deficient" CIRMP: one posing a material risk to national security, defence, or social or economic stability. Non-compliance attracts civil penalties.
Find your organisation
See how the changes affect you specifically
Energy utilities
Transmission, distribution, and generation operators with converged IT/OT environments, CIRMP obligations and, for many, the AESCSF as their chosen cyber framework.
View details →Water authorities
State water authorities and regional utilities. Critical water assets are among the nine classes under the Enhanced CIRMP Rules 2026. Ageing OT alongside modern IT creates segmentation complexity.
View details →Transport operators
Roads, rail, aviation, and port authorities. Increasingly software-defined systems with high ransomware risk and operational resilience requirements.
View details →Why security teams trust NodeZero
Prove your controls work before regulators ask
See how NodeZero maps to your SOCI Act CIRMP obligations and Essential Eight requirements across your critical infrastructure environment