In Australia’s National Interest - Security of Critical Infrastructure

Welcome to Pentagram Advisory’s article and podcast titled In the National Interest: Australian Citizenship in Disarray.
Pentagram’s ‘In the National Interest’ series explores issues that are strategic in nature.  The issues are relevant to Australia’s critical infrastructure entities because they operate within Australia’s society and economy.  Further, this series is relevant to any entity or person in Australia because the issues explored are national security matters and risks that are relevant to any individual person, to workforces, to private and public sector entities, to Australia’s society, its national security and resilience. 
In this article we will explore some of the issues facing the ‘idea’ of Australia citizenship in 2026.  We find, as we explore the situation today, that Australian citizenship is undervalued and under attack.

Four diverse and significant insider threat events reported in one day: Origin Energy, Royal Australian Navy, U.S. Secret Service, and OpenAI.

The Enhanced CIRMP Rules 2026 introduce 78 additional legislative obligations for responsible entities, but implementation requires far more than updating an existing Critical Infrastructure Risk Management Program (CIRMP).
In this episode, Tim and Marina introduce a practical framework for implementing the Enhanced CIRMP Rules by distinguishing between CIRMP maturity and organisational readiness. They explain why organisations should build on the governance, risk management processes and security controls already established under their existing CIRMP, rather than treating the Enhanced Rules as a separate compliance exercise.
Using the relationship between sections 9 and 9A as a practical example, they explore how organisations can determine what should be retained, validated, strengthened, expanded or newly implemented, while developing structured implementation roadmaps aligned to the 10 June 2027 and 10 June 2028 legislative milestones.
Whether you are a Board member, executive, security leader or CIRMP practitioner, this episode provides a practical methodology for moving beyond compliance and implementing the Enhanced CIRMP Rules in a structured, evidence-based and defensible way.
This podcast is brought to you by Tim Slattery and Marina Shteinberg from Pentagram Advisory, helping Australia's critical infrastructure organisations strengthen governance, build resilience and achieve practical compliance with the Security of Critical Infrastructure Act.

The criminal charges against former Australian Defence Force (ADF) soldier Kira Korolev have been upgraded from “preparing for an espionage offence” to “conspiracy to commit espionage”.

Pentagram's podcast set outs the public advice on the upgraded espionage charge Korolev and her husband now face, then explores the significance of Korolev, as an ADF member who would have been subject to significant background checks and security vetting to gain entry into the ADF, being charged with espionage.
Further, the ADF and Defence have longstanding and mature personnel security programs, yet failed prevent Korolev's insider threat behaviour. The Australian private sector, including critical infrastructure entities, does not have personnel security systems in place that approach the maturity of the ADF's approach.
That is the core of the issue the Korolev case presents: how can critical infrastructure mitigate the insider threat with underdeveloped and generally immature systems.

The Enhanced CIRMP Rules 2026 introduce the most significant expansion of Australia's Critical Infrastructure Risk Management Program (CIRMP) framework since its inception.
But beyond the additional legislative obligations lies a more important question: what do these changes reveal about the future direction of Australia's critical infrastructure regulation?
In this episode, Tim Slattery and Marina Shteinberg from Pentagram Advisory examine how the Enhanced CIRMP Rules 2026 signal a shift from demonstrating compliance to demonstrating organisational security capability.
They discuss why Boards and senior executives should view the implementation period as a strategic opportunity to strengthen governance, build integrated security capability and prepare for future assurance obligations—not simply another compliance exercise.
Drawing on Pentagram Advisory's detailed analysis of the Baseline and Enhanced CIRMP frameworks, this episode explores the key implementation timeframes, the evolving regulatory expectations, and why organisational readiness has become just as important as organisational maturity.
This is the first episode in a new series examining the Enhanced CIRMP Rules 2026.
Future episodes will explore the enhanced personnel security, supply chain security, cyber and information security, and physical security requirements, together with practical approaches to implementation.
For more information, visit https://pentagramadvisory.com.au/