CIRMP Director Liability Checklist

For directors and officers of responsible entities under the Security of Critical Infrastructure Act 2018 (Cth).

If you are required to sign the annual s.30AG governing body attestation, this checklist was built for you.

WHAT THIS IS

A 14-page structured gap assessment framework covering all four CIRMP hazard vectors — cyber, physical, personnel, and supply chain. Designed to be delegated to your CISO or compliance lead, then reviewed by the board before any attestation is signed.

WHAT'S INSIDE

- 44 checklist items across all four hazard vectors

- Director Liability context — up to $412,000 aggregate personal exposure under s.30BC

- Board Attestation Readiness test — compliant, followed, and effective

- Summary Scorecard for board paper attachment

- Individual Director Sign-Off page

- Evidence Register (traceable references for every Yes/Partial response)

- Glossary of 16 legislative and technical terms

- Sector-specific notes for Energy, Telecoms, Ports, Water, and Defence

WHO IT'S FOR

Directors, Company Secretaries, General Counsel, and compliance leads at entities that own or operate declared critical infrastructure assets in any regulated sector.

IMPORTANT

This checklist does not constitute legal advice. It is a structured assurance and gap-discovery tool. Directors should seek independent legal counsel before signing any s.30AG attestation.