CIRMP is more than a cyber compliance challenge - its a supply chain one

Critical Infrastructure Risk Management Program (CIRMP) is often framed as a cyber challenge. Monitoring tools, risk scores and alerts tend to dominate the conversation.

They all have a role to play. But they only address part of the problem.

CIRMP requires organisations to understand and manage risk across their supply chain - and, critically, to demonstrate control in a consistent and defensible way.

That means working with reliable data, structured processes, and an approach that holds up under scrutiny. That’s where some organisations start to feel the pressure.

The challenge: CIRMP isn’t just cyber

Cyber risk is one component of CIRMP. CIRMP explicitly requires organisations to also identify and manage broader hazards and risks.

In practice, this includes operational resilience, supplier dependencies, and concentration risk.

The requirement is not just to identify issues. It is to show how those risks are assessed, prioritised and managed over time. Most approaches aren’t built for that level of consistency. 

What’s holding CISOs back?

Many organisations have invested in monitoring tools and internal processes. The intent is right, but the foundation often isn’t strong enough. Supplier data is frequently:

• Inferred from external sources not provided directly

• Or self-declared without validation

• Collected in different formats across teams

This creates inconsistency.

CISOs may have visibility of potential security exposure, but many don’t have a 360 view of supplier risk across the areas CIRMP expects. More importantly, CISOs don’t have a consistent way to evidence how that risk is being managed.

Seeing risk is not the same as managing it. And it’s not enough when regulators or the board ask for evidence.

In addition, this creates hidden cost. Teams spend time chasing, validating and reconciling supplier data - time that could be spent managing risk. That cost doesn’t disappear; it’s ultimately passed on to customers.

What needs to change

CIRMP shifts the focus from detection to demonstration. The question is no longer “what risks exist?,” but “how do we show we are managing them, consistently and at scale?”

That requires a different foundation:

• Complete data direct from suppliers and validated by humans

• Continuous monitoring, not just point-in-time assessments

• A standardised approach that can be used across the supply chain

It also requires an operating model that scales without driving cost.

This is where many organisations reach a limit. Traditional approaches - built around individual assessments and internal ownership - require more time and effort. They don’t scale efficiently across large supplier bases.

How ESSCAR helps 

ESSCAR is an industry-led supplier assurance community designed to strengthen resilience and simplify SOCI compliance.

It uses a model that’s been in place for over 10 years and that’s trusted by nearly 150 buying organisations and over 15,000 suppliers globally across the Defence and Financial Services sectors - including in Australia.

Energy organisations collaborate to define a single ,comprehensive question set aligned to operational resilience, cyber, modern slavery and regulatory requirements.

Suppliers submit their information once, with Hellios validating, maintaining and monitoring that data before sharing it across participating organisations. While a local operations team works directly with suppliers to support completion, improve consistency and ensure long-term data quality.

The result is a structured data set that reduces duplication and supports a more scalable approach across the industry, where control can be evidenced.

Less duplication means less time spent collecting and validating data - reducing internal cost and lowering the burden on suppliers, so everyone benefits.

Three ways to improve CIRMP compliance

1. Start with data you can rely on
CIRMP requires evidence. That starts with primary data that is complete, consistent and validated at source - not inferred or self-declared without review.

2. Move from point-in-time to ongoing maintenance
Risk does not stand still. Maintaining supplier data over time provides a more accurate and defensible view than periodic assessments.

3. Reduce duplication through a shared model
Multiple organisations assessing the same suppliers independently increases costs without improving outcomes. The same effort is repeated across the market - consuming internal resource and supplier time, both of which translate directly into cost for the end user. 

What this looks like in practice

A shared model creates a consistent baseline across the industry. This is not a new approach. It is a model that has already been proven in other regulated sectors, including the Australian Defence and Aerospace sector. And the impact is not just operational; it’s commercial.

The bottom line

CIRMP is not just a cyber problem. It is a supply chain challenge that requires consistency, structure and evidence. Monitoring tools play a role, but they are only part of the solution.

To meet CIRMP requirements efficiently, organisations need a model that delivers trusted data, reduces duplication, and can be maintained over time.

Because reducing duplication doesn’t just improve efficiency - it reduces cost across the supply chain. That shift is already underway - built on approaches that have been tried, tested, and proven to scale.