In Australia’s National Interest - Security of Critical Infrastructure

Pentagram Advisory

What comprises Australia’s national interest, and how does the rise of insider threat activity in Australia’s critical infrastructure connect to Australia’s national interest? I expect this topic was not the first thing on your mind when you woke this morning ready for breakfast and a hot shower, however the topic is relevant because it is fundamental to you having breakfast, a wash, and getting on with you day. Let me explain.

  1. 4d ago

    The Enhanced CIRMP Rules 2026: Getting Ready For The 10 June 2027 Deadline

    The first major implementation milestone under the Enhanced CIRMP Rules is approaching. By 10 June 2027, affected responsible entities will need to have the first tranche of Enhanced CIRMP requirements implemented, operating and supported by evidence. In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory examine what readiness means in practice. We look at the six foundations organisations should validate now, the three core capabilities that need to be in place by June 2027, the implications for annual CIRMP reporting, and why the pathway to the 2028 requirements should already form part of the implementation program. We also explore how organisations can assess their current position, identify what needs to be retained, validated, strengthened, expanded or established, and translate those findings into a governed implementation roadmap. The focus is practical: building the capability, evidence and assurance needed for 10 June 2027 while establishing the foundations for the broader Enhanced CIRMP requirements that follow.

  2. Oct 26

    SOCI Act Insight: Enhanced CIRMP Readiness

    By 30 June 2027, a CIRMP subject to the CIRMP Enhanced Rules 2026 needs to be current against the 2027 Enhanced obligations. Therefore, the 2027 annual CIRMP report should address 2027 changes. The Enhanced Rules 2026 Explanatory Statement expressly says that during the 24-month grace period (ending 10 June 2028), annual CIRMP reporting and regulatory engagement will be used by the Department of Home Affairs to assess whether SOCI entities are progressing towards the Enhanced requirements deadlines of 10 June 2027 and 10 June 2028. So, CISC may ask a SOCI entity about its readiness/progress toward the 2028 requirements in the 2027 annual reporting process, although those requirements are not yet mandatory at 30 June 2027. Pentagram Advisory's Enhanced CIRMP Readiness Assessment Module provides a structured and efficient way to assess and explain your Enhanced Rules readiness. Contact pentagramadvisory.com.au

  3. Oct 20

    Oztopia: superannuation

    This video explores the Albanese Labor Government's agenda, from 2023 to 2026, to change the discussion about superannuation funds holdings from compulsory investments that must deliver maximum financial benefit to the fund holders to be used as a source of capital to use, in the 'national interest', to fund the Labor Government's policies and ideological programs. This is tantamount to nationalising those superannuation funds.

  4. Oct 19

    The Enhanced CIRMP Rules 2026: Section 9A — What Does “Suitable” Mean for a Critical Worker?

    What does “suitable” really mean for a critical worker under section 9A of the Enhanced CIRMP Rules 2026? In this episode, Marina Shteinberg and Tim Slattery explore who makes the suitability decision, who owns the risk, and how ongoing assurance should work in practice. We examine the three pathways to critical component access — AusCheck plus the responsible entity’s suitability assessment, a relevant NV1+ security clearance, and the CIRMP risk-managed pathway — and explain what each pathway establishes, who makes the key decisions, and what responsibility remains with the organisation.  We also look at ongoing suitability, the relationship with insider threat capability, and practical implementation outcomes for organisations preparing for the enhanced personnel security requirements under section 9A.

  5. Oct 2

    Oztopia: Academia

    Oztopia: Academia explores the behaviour of some Australian academics and higher learning institutions who choose to collaborate with academia hostile states including China, Russia and Iran. The behave this way in the face of threat and risk advice from the Australian Government and its key agencies ASIO, DFAT, Defence and Home Affairs. Such academic collaboration can present risk to Australia's national security. I believe this academics are collaborating with the enemy.

  6. Sep 28

    The Enhanced CIRMP Rules 2026: Section 9A — Building a Defensible Personnel Security Architecture

    In this episode, Tim Slattery and Marina Shteinberg, Co-Founders and Directors of Pentagram Advisory, unpack the personnel security implications of section 9A of the Enhanced CIRMP Rules 2026 and what responsible entities should prioritise ahead of the 10 June 2027 and 10 June 2028 implementation milestones. They explore how section 9A strengthens expectations around access management, critical worker identification and suitability, ongoing personnel assurance and workforce lifecycle security. The discussion also looks at why implementation should begin with risk, how to think about the two layers of access — to the critical infrastructure asset and to critical components — and why organisations need to connect people, roles, access, suitability and assurance within a coherent enterprise personnel security architecture. The episode concludes with a broader question of trust: how organisations can build appropriate assurance around the trust they grant to employees, contractors and third parties with access to their most critical assets, systems and information — their organisational “crown jewels”.

  7. Sep 14

    The Risks We Remember: How Availability Bias Creates Blind Spots in Critical Infrastructure Security Decisions

    How much of what we judge to be a material security risk is driven by evidence — and how much by what we can most easily remember? In this episode, Tim Slattery and Marina Shteinberg of Pentagram Advisory explore the availability heuristic and what behavioural science can teach us about security risk management and decision making under uncertainty. In an era of heightened uncertainty, Boards, executives and security leaders are required to make consequential decisions with information that may be incomplete, uneven or constantly changing. Recent incidents, personal experience and highly visible threats can quickly dominate attention — while less familiar but potentially material risks remain outside the spotlight. Tim and Marina examine how availability bias can influence security risk assessment, risk prioritisation and investment decisions, and why a formal risk management framework does not remove human judgement — it structures where that judgement is exercised. They also consider practical ways to strengthen decision-making through broader evidence, structured challenge and greater transparency around the reasoning behind risk ratings. Because what is memorable is not necessarily what is material. And unfamiliarity is not evidence of safety.

  8. Sep 7

    Australia’s Workforce Under Pressure: What Employee Engagement Tells Us About Trust, Culture and Security

    What does employee engagement tell us about the strength and resilience of an organisation? Drawing on findings from Gallup’s State of the Global Workplace 2026, Tim Slattery and Marina Shteinberg, Co-Founders of Pentagram Advisory, examine the latest Australian employee engagement data and explore what it may tell us about the relationship between employees and their workplaces. The discussion moves beyond traditional questions of productivity and retention to consider the connections between engagement, trust, the psychological contract and organisational culture — and what these may mean for security. Organisations can mandate policies, implement controls and monitor compliance. But security also depends on people exercising judgement, speaking up, taking ownership and acting when circumstances demand more than compliance. We can mandate compliance. We cannot mandate care. This episode explores why that distinction matters for Boards, executives, security leaders and people leaders — and why employee engagement should also be considered through the lens of organisational resilience and security. Source: Gallup, State of the Global Workplace 2026

See All (90)

About

What comprises Australia’s national interest, and how does the rise of insider threat activity in Australia’s critical infrastructure connect to Australia’s national interest? I expect this topic was not the first thing on your mind when you woke this morning ready for breakfast and a hot shower, however the topic is relevant because it is fundamental to you having breakfast, a wash, and getting on with you day. Let me explain.

Information