SOCI in space: what the Tranche 2 reforms mean for Australia's space operators

Australian space operators are potentially facing the most significant development under the Security of Critical Infrastructure (SOCI) framework to date, with a new proposal that would introduce material new obligations.

Since the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act) reforms in 2021-22, the space technology sector is included as one of eleven designated critical infrastructure sectors in Australia. That designation, however, has been largely academic to date, as no specific space technology assets are currently prescribed under the Application Rules. As such, the SOCI Act's positive security obligations are not presently ‘switched on’ for space-only assets.

However, on 3 July 2026, the Department of Home Affairs (the Department) released a new Tranche 2 consultation paper, Streamlining and Modernising the Security of Critical Infrastructure Act 2018. It proposes to change that by creating four space technology asset classes under the SOCI Act. 

The gap between space technology’s designation and prescription

While ‘space technology’ has been formally listed as one of the 11 critical infrastructure sectors under the SOCI Act since the 2021-22 reforms, no specific assets within that sector have been prescribed under the Security of Critical Infrastructure (Application) Rules (LIN 22/026) (the Rules, and together with the SOCI Act, the SOCI Framework). The SOCI Act’s positive security obligations, including registration of assets, cyber incident reporting and maintenance of a risk management program, only apply to operators once specific assets are prescribed under the Rules. 

In practice, this has meant that launch operators, satellite operators, ground station operators and space data companies have not been subject to the SOCI Act's enforceable obligations, unless their assets fall within the scope of another regulated sector. For example, SOCI obligations may already apply to a satellite operator that provides carriage services for the purposes of the Telecommunications Act 1997 (Cth). The consultation paper acknowledges that this incidental capture under the telecommunications or data storage or processing asset classes can leave uncertainty about which function is regulated and which entity is responsible.

In its submission to the independent review of the SOCI Act (discussed below), the Space Industry Association of Australia (SIAA) said that achieving the SOCI Act's objectives requires ‘more deliberate consideration of space as a critical infrastructure enabler’. Separately, the Commonwealth Government’s Critical Infrastructure Security Centre has recognised that critical infrastructure operators across all 11 SOCI sectors, including telecommunications, energy, financial services and transport, can depend on, and are therefore vulnerable to risks affecting space-enabled services such as positioning, navigation and timing (PNT), satellite communications and earth observation. 

The independent review of the SOCI Act

In an independent review of the SOCI Act, conducted by Dr Jill Slay AM and tabled in Parliament on 24 March 2026, the SOCI Framework was found, as summarised in the consultation paper, ‘not sufficiently agile or calibrated for emerging technologies, contemporary operating models, or critical functions that do not fit existing sector and asset definitions’. Critically, the Review identified ‘space and satellite dependencies’ as a specific coverage gap. All of its recommendations were accepted by the Government in principle.

In response, the Department released a consultation paper earlier this year relating to Tranche 2 reforms proposed to the SOCI Act. The Tranche 2 consultation paper proposes 21 measures to streamline and modernise the SOCI Act (submissions closed on 31 July 2026). For space operators, the key proposal is Measure 9, which would introduce four new space technology asset classes to be designated as critical within the meaning of the SOCI Act:

1. Ground segment infrastructure: command, control, telemetry, tracking, uplink, downlink, data reception, mission operations, tasking, scheduling and network management systems for satellite operations.
    
2. PNT support infrastructure: systems supporting the reliability, integrity, correction, augmentation or distribution of space-derived positioning, navigation and timing services.
    
3. Earth observation data infrastructure: systems for reception, processing, storage, tasking or dissemination of satellite-derived earth observation data.
    
4. Space situational awareness infrastructure: systems for monitoring, tracking, characterisation and space weather monitoring.

Importantly, the SOCI Act would set the asset-class categories only. Amendments to the Rules, which are yet to be made, would determine which particular systems are captured, using criteria such as technical characteristics, scale of operation, government service arrangements, service reach and substitutability, and the class of users supported. The consultation paper indicates that ordinary commercial space activity, research, advisory services and incidental data handling would not be captured unless they specifically meet one of the criteria for capture to be set out in the SOCI Framework, and that exclusions for systems with only a remote or ancillary connection to a space-derived service would be considered as part of the Rules consultation. The Department estimates that only a modest number of operators would be captured – primarily major satellite gateways and teleports, telemetry, tracking and command facilities, reference stations and earth observation processing sites.

The proposal is focused on ground-based and associated terrestrial systems in Australia. Satellites and other orbital assets would be captured only through a limited reserve pathway, where capture is legally permissible and the asset is specified in, or meets requirements prescribed by, the Rules. As a result, many of the international space-based services on which Australian critical infrastructure relies, such as foreign-operated low Earth orbit communications constellations and global navigation satellite systems, would remain outside the regime. The SIAA identified this dependence on international services as the more significant gap in its submission to the independent review.

Exposure draft legislation is anticipated for late 2026 or early 2027, with amending legislation to be before Parliament in 2027. There will likely be future consultation on the enactment of amended rules, after the enactment of changes to the Act. That Rules consultation will settle which assets are actually captured, and will be the key opportunity for operators to shape the thresholds and exclusions that apply to them.

What this means for space operators

Once in force, space operators with assets in Australia that fall within the new classes and meet the thresholds in the Rules would be subject to the obligations under the SOCI Act, and would be required to:

• register assets on the Register of Critical Infrastructure Assets;
   
• report cyber security incidents to the Australian Signals Directorate’s Australian Cyber Security Centre, noting that the proposed changes would also clarify that the definition of a cyber security incident covers incidents involving automated systems, software agents and AI; and
   
• adopt, maintain and comply with a Critical Infrastructure Risk Management Program (CIRMP) (where applicable), with proportionate independent assurance (which may be internal for lower-risk entities).

Beyond those core obligations, several other Tranche 2 measures are worth noting:

• Higher civil penalties: Core risk management duties would attract penalties of up to 500 penalty units (currently A$182,000 for an individual), an increase from the current 200 penalty units (currently A$72,800 for an individual). The maximum penalty for a body corporate is generally five times those amounts.
   
• Relevant operators: Entities exercising practical control over a critical asset without being the responsible entity would face direct duties to cooperate, notify and not materially compromise the asset. For the space sector, this could extend to outsourced ground station operators, mission control providers, managed service providers and original equipment manufacturers (OEMs).
   
• Corporate group cooperation: Where security-critical functions sit with a parent or shared services entity, a targeted statutory duty to cooperate would apply.
   
• Supply chain cyber assurance: Responsible entities would need to assess and manage cyber risks from major suppliers, with recognised certifications available as evidence of due diligence.
   
• Exemptions framework: The paper proposes a clearer mechanism for targeted relief from SOCI obligations where another regulatory framework, such as telecommunications regulation, already imposes substantially equivalent requirements.

Data providers that do not operate space assets themselves may also be affected. Providers that operate their own systems for processing or distributing satellite-derived earth observation data, or for correcting or augmenting PNT signals, could be captured directly under the new asset classes, subject to the thresholds to be set in the Rules. Other suppliers, such as data resellers and analytics providers, are unlikely to be captured in their own right, but should expect captured operators to pass on supply chain, relevant operator and cyber assurance requirements through their contracts.

What operators of space technology sector assets in Australia should do now

1. Assess overlapping obligations. Companies already subject to the SOCI Act through another sector (for example, telecommunications carriers operating satellite infrastructure) should consider whether the new space technology asset classes create additional or overlapping obligations.
    
2. Evaluate supply chain exposure. Managed service providers and outsourced operators in the space supply chain should assess whether the ‘relevant operator’ concept could capture their activities.
    
3. Assess the Foreign Investment Review Board (FIRB) implications. Prescribing space technology assets under the SOCI Act may bring affected operators within Australia’s national security foreign investment regime. A business that is a responsible entity for a critical infrastructure asset is generally a ‘national security business’ (as defined in section 8AA of the Foreign Acquisitions and Takeovers Regulation 2015 (Cth)), meaning foreign investment may require FIRB approval regardless of transaction value. Operators and investors should therefore factor potential approval requirements, transaction timing and regulatory conditions into capital raises, acquisitions and other investment structures involving foreign investors.
    
4. Check your data facilities. Data storage and processing facilities operated by space companies may independently qualify as critical infrastructure assets under the ‘data storage or processing’ sector, regardless of whether space technology assets are defined under the SOCI Act.
    
5. Prepare for compliance. Operators likely to be captured should review their incident reporting processes and begin scoping a CIRMP, including considering how existing security controls and accreditations would map to its requirements.

For more detail on the full suite of Tranche 2 proposals, see our earlier article Security of critical infrastructure — Tranche 2 reforms.