Fortnightly ALC Government Relations Update No. 13 | 10 July to 23 July 2026 [CORE]

Many ALC members have already made significant changes to meet their obligations under the Security of Critical Infrastructure Act 2018. This has involved considerable investment in systems, governance, specialist capability, reporting, supplier oversight, and board assurance.

The current consultation is not simply about continuing that work. The proposed amendments could broaden the freight assets and businesses covered by the Act, extend obligations further into operational and supplier relationships, and increase expectations around governance, assurance, and evidence.

Over more than 20 years working across national security operations, Home Affairs, aviation, regulatory affairs, and Critical Infrastructure environments, I have seen how important it is to get these boundaries right. Reform should strengthen security where there is a genuine gap. It should not require businesses to repeat work they have already completed or take responsibility for risks they do not control.

What members have already implemented

Members covered by the existing framework may already be required to:

• register ownership, control and operational information;
• report relevant cyber incidents;
• establish and maintain a Critical Infrastructure Risk Management Program;
• identify and manage cyber, personnel, supply-chain, physical and natural-hazard risks;
• review and update their risk arrangements;
• notify relevant external data-storage and processing providers; and
• provide annual compliance reports approved by the governing body.

For many businesses, these requirements have already led to substantial changes across technology, risk management, procurement, contracts, workforce screening, incident response, and board reporting.

What the proposed amendments could change

The proposed amendments would go further.

Broader freight coverage

The current framework applies to defined categories of critical infrastructure. The proposed changes could extend coverage further into nationally significant freight nodes, intermodal interfaces, distribution facilities, cold chains, logistics platforms, operational control systems, and key chokepoints.

This may bring new businesses and facilities into the SOCI framework, including some that have not previously been treated as critical infrastructure.

Wider responsibility for operational control

The proposed amendments could create obligations for third parties that exercise material practical control over an asset or critical function.

This may include outsourced operators, managed-service providers, technology companies, original equipment manufacturers, and specialist contractors.

There is a sound principle behind this: responsibility should sit with the party that can manage the risk. The concern is that poorly defined obligations could create overlap or make one participant accountable for a risk controlled by another.

Stronger governance and independent assurance

Many members already have board-approved risk-management and compliance arrangements.

The proposed changes could increase expectations around governing-body approval, review, and assurance. They may also require more independent testing of whether an organisation’s risk-management program is properly designed, implemented and effective.

This would likely require more evidence, more formal assurance and, in some cases, additional external expertise before boards approve annual reporting.

More detailed supplier assurance

Existing obligations already require members to consider material supply-chain risks.

The proposed changes could require more formal assessment of major suppliers, including secure development practices, patching, vulnerability management, remote access, incident notification and product security.

This may result in changes to procurement, contracts, supplier questionnaires, assurance processes, and subcontractor management.

A broader approach to critical workers

Members may already have controls in place for workers with access to sensitive systems or facilities.

The proposed amendments could clarify these expectations for contractors, managed service providers, original equipment manufacturer personnel, and workers employed by related entities.

This may increase screening and access-control requirements, particularly in specialist or regional workforces where replacement capability is limited.

New requirements to consider specified risk information

Responsible entities may also be required to consider particular risk information, standards, or guidance identified by the government, and to document how they have responded.

While this may not amount to a binding technical standard, organisations may need to show that the information was considered and that their response was reasonable.

What this could mean across freight modes

For road freight, the changes may bring greater focus to fleet-control systems, dispatch platforms, major depots and connected transport systems. A carrier should not, however, be held responsible for a State-owned tunnel, traffic-management centre, or smart motorway system that it cannot control.

For freight rail, responsibility will need to be clearly divided between above-rail operators, below-rail infrastructure managers, terminal operators, maintenance providers, and technology suppliers. Reliance on another party’s system does not mean control of that system.

In ports and maritime, there may be greater scrutiny of crane control systems, automated gates, cargo platforms, and port interfaces. Existing maritime, port, safety, and transport security obligations must be recognised to avoid duplication.

For air freight, criticality should be assessed by the consequences of disruption rather than tonnage alone. Cargo facilities, cold chains, and logistics systems supporting medicines, urgent components, perishables, and remote communities may be nationally significant despite modest freight volumes.

Member input is essential

I strongly encourage members to engage in the consultation process and provide input to ALC’s submission.

We need practical evidence about:

• the changes and investment already made under the existing SOCI framework.
• Which proposed measures would require further systems, personnel, assurance, or expenditure?
• where existing controls should be recognised rather than repeated.
• where responsibility may fall on an entity that does not control the risk.
• the likely impact on contractors, suppliers, and regional workforces.
• realistic implementation timeframes; and
• assets or services that should be included, excluded, or more clearly defined.

ALC supports stronger protection for nationally significant freight infrastructure. The next phase of reform must build on the work the industry has already done.

Member evidence will help ensure the final framework is practical, proportionate, and directed at genuine national risk, rather than creating additional compliance without a corresponding security benefit.

Premier Roger Cook has announced new portfolio arrangements following the retirement of former Minister Paul Papalia, with the WA Government positioning the changes around jobs, housing, health, economic diversification and safe communities. The reshuffle is relevant to ALC members because several key portfolios linked to freight, ports, infrastructure, trade, energy and road safety have been adjusted.

The most significant change is that Premier Cook will take direct responsibility for Defence Industries, alongside a new Tourism, Trade and Investment portfolio and the Economic Diversification portfolio. This signals a stronger focus on WA’s role as a defence, trade and investment hub, including the development of naval maintenance and shipbuilding capability.

Deputy Premier Rita Saffioti retains a central economic role as Treasurer and will also hold the expanded Transport and Major Infrastructure portfolio. This is a key appointment for the freight transport and logistics sector, particularly given WA’s ongoing investment needs across road, rail, ports, industrial land and supply chain infrastructure. John Carey has also been appointed Assistant Minister for Transport and Major Infrastructure.

Stephen Dawson remains important to ALC members through his responsibilities for Ports, Regional Development, Science and Innovation, and the Kimberley. Amber-Jade Sanderson will hold Energy and Decarbonisation, Manufacturing, Skills and TAFE, and will assist the Premier on Defence Industries. David Michael will take on State Development, while Daniel Pastorelli has been appointed Minister for Mines, Petroleum and Exploration and Water.

Other relevant changes include Jessica Stojkovski taking responsibility for Road Safety, Reece Whitby taking on Emergency Services, and Matthew Swinbourn adding Climate Resilience to his responsibilities.

The Queensland Government will invest $4.5 million in new maritime infrastructure at Cairncross Dockyard in Brisbane through the Sovereign Industry Development Fund. The funding will support the installation of a 1,200-tonne crane and a 400-tonne support crane, giving the dockyard the heavy-lift capacity needed for large-scale defence and commercial vessel maintenance, repair and sustainment. The investment is part of the broader $2.5 billion Cairncross Dockyard redevelopment, which has been declared a Prescribed Project to streamline assessment and approvals.

The redevelopment is expected to create more than 1,000 direct jobs and support thousands more across manufacturing, logistics and supply chains. It will also expand Queensland’s maritime sustainment capability and reduce reliance on interstate and overseas shipyards.

The larger crane will operate the dockyard’s new lift-in/lift-out gate and lift vessels weighing up to 600 tonnes. The support crane will assist with construction and quayside operations.