From Maturity to Readiness: A Practical Framework for Implementing the Enhanced CIRMP Rules 2026

The Enhanced CIRMP Rules 2026 introduce 78 additional legislative obligations for responsible entities, but implementation requires far more than updating an existing Critical Infrastructure Risk Management Program (CIRMP).

In this episode, Tim and Marina introduce a practical framework for implementing the Enhanced CIRMP Rules by distinguishing between CIRMP maturity and organisational readiness. They explain why organisations should build on the governance, risk management processes and security controls already established under their existing CIRMP, rather than treating the Enhanced Rules as a separate compliance exercise.

Using the relationship between sections 9 and 9A as a practical example, they explore how organisations can determine what should be retained, validated, strengthened, expanded or newly implemented, while developing structured implementation roadmaps aligned to the 10 June 2027 and 10 June 2028 legislative milestones.

Whether you are a Board member, executive, security leader or CIRMP practitioner, this episode provides a practical methodology for moving beyond compliance and implementing the Enhanced CIRMP Rules in a structured, evidence-based and defensible way.

This podcast is brought to you by Tim Slattery and Marina Shteinberg from Pentagram Advisory, helping Australia's critical infrastructure organisations strengthen governance, build resilience and achieve practical compliance with the Security of Critical Infrastructure Act.