This is the next instalment in our Cybersecurity, the Australian way series. This time we’re looking at the part of SOCI that lands first, and that generates the most questions: foreign ownership, control or influence, or FOCI.
What is FOCI?
FOCI is a regulatory test to assess the risk that a supplier could be directed by a foreign government to act against your interests. The procedure looks at company ownership, the governing laws of the parent company, and any pressure that can be applied from outside, focused around compulsion, not intent. A supplier with an excellent track record and a genuine commitment to its customers can still be subject to laws that require it to hand over data, provide access or act on the instruction of a foreign government.
For renewable generation facilities, this is significant for two reasons. Firstly, many of the global OEMs - or one of their suppliers - are from countries of interest and are immediately flagged as a potential FOCI risk. Secondly, many of these OEMs have an ongoing operational role in supporting the hardware and software throughout the asset life, where the risk must be somehow managed and mitigated.
A hazard under SOCI Enhanced CIRMP
The most common misunderstanding about FOCI is that it is a signal from government to stop buying from certain countries and that certain brands may be soon blacklisted, creating a long term residual risk for operators. For the most part, it doesn’t - well, at least that’s not how it has been integrated into the regulations.
The enhanced risk management rules under SOCI that took effect in June 2026 make FOCI a named material risk that you must identify and manage. They don’t name countries, and they don’t publish a list of approved or banned vendors. The government’s explanatory statement is explicit: the framework “does not propose simple vendor whitelisting or blacklisting”, and operators should “not assume supplier replacement as the central case”.
In other words, the rules ask you to interrogate the risk and plan to mitigate it to a level that is reasonably practicable. For the larger items of equipment in a renewables project there are often no practical alternatives. For networking, security, backup and support equipment, there is a stronger argument to use an alternative vendor. Either way, both are viable pathways, provided that mitigations can be put in place to address the risks.
What sort of mitigations are we talking about?
The question is not whether foreign influence exists in your supply chain, because it almost certainly does. It’s whether you understand where it is, the size and speed of a potential impact on your operations, and how you might recover from such a situation.
Typical ways that vendors and operators are mitigating these FOCI risks today include:
- Strong governance around personnel, access controls and remote access, including certain supervised activities.
- High-quality record keeping, logging and auditing, with change control on all documentation, configuration and software systems.
- Strong technology enforcement around software, such as code signing and binary scanning.
- Independent assurance of your cyber program, including oversight and audit.
- The capability to roll back to previous software quickly and effectively.
- Built-in capability to readily separate from IT and run without communications.
The FOCI assessment
The good news is that the process for making a FOCI assessment is clearly laid out. The Department of Home Affairs has published FOCI risk assessment guidance, a step-by-step method for assessing a vendor’s exposure, along with model contract clauses. The guidance itself is voluntary, but section 10A of the Enhanced CIRMP Rules sets out what the assessment must cover. For each existing or proposed major supplier, the vendor assessment asks five questions:
- Which foreign laws apply to the supplier? Its ownership, where it’s based, and which governments can legally direct it.
- Are there sanctions, restrictions or other impediments? Including ones that could stop you getting parts, support or updates.
- How much access, influence and control does the supplier keep over your asset through its product or service? Remote access, software updates, cloud platforms and data flows all count.
- Do those things add up to a material risk? Including whether losing the supplier could take the asset offline for longer than you can tolerate (the rules call this the maximum acceptable outage).
- What are you doing to minimise or mitigate it? So far as is reasonably practicable.
The interesting clause here is “so far as is reasonably practicable”. It’s fairly open to interpretation, but the more common interpretation is that you do what can reasonably be done, weighing the likelihood and severity of the harm against the availability and cost of the controls. Cost is only a reason not to act when it’s grossly disproportionate to the risk. The phrase comes from workplace health and safety law, so most energy businesses already know how to apply it.
Mitigations: process vs technology
Once an asset and the associated supplier have been identified as a FOCI risk, there are broadly two ways to mitigate the ongoing risks.
Manual controls rely on tried and tested procedures. One example is where vendor remote sessions are logged and verified manually by security team members; another is where an engineer supervises the whole session and validates chain of custody on any firmware changes.
These two controls can be quick to start and need little upfront investment, but have the downside of being labour intensive. Across a fleet of sites and over 25-year service agreements, these become significant costs for both OEMs and operators.
Technology controls build the same protection into the system. For example, a remote access broker that only opens a session against an approved request, records it and fires alerts on any discrepancies. This takes longer to implement upfront, but is a lower cost to operate over the life of the asset.
A sensible path is to start with manual controls where the risk is highest, then automate the activities you repeat most often. If you’re still in procurement or design, build the technology and processes in from the start; project financiers understand the capex vs opex tradeoff.
Start with good governance practices
For most operators, the most cost-effective thing you can do about FOCI isn’t a technical control at all. It’s strong governance: a documented assessment, a clear decision, and an audit trail that shows your reasoning.
The rules don’t expect you to eliminate foreign influence. Instead they expect you to take reasonable, proportionate steps and to be able to show your board and the regulator what you did and why. Well-kept records will typically state that a supplier was assessed, the risk identified, mitigated with manual processes, and the residual risk is deemed acceptable.
Roughly, the options line up like this:
| Approach | Upfront cost | Ongoing cost | What it buys you |
|---|---|---|---|
| Governance: assessments, decision records, audit trail | Low | Low | Shows reasonable steps; the foundation for everything else |
| Manual controls: supervised access, manual checks | Low | High, and grows with your fleet | Quick risk reduction where it matters most |
| Technology controls: access brokers, firmware checks, monitoring | Medium to high | Lower over time | Consistent protection and automatic evidence |
| Replacing a supplier | Very high | Varies | Removes one exposure, often introduces others |
Swapping suppliers sits at the bottom of the list for good reason. It can mean stranded equipment, lost warranties, re-commissioning, downtime and new contracts, and the replacement may bring its own foreign ownership questions. Occasionally it will be the right answer. It should be a decision you reach through the process, not the place you start.
What about timing?
Implementing FOCI obligations was a core motivation behind Home Affairs driving the recent Enhanced CIRMP changes to SOCI. The threat behind them was set out publicly in November 2025, when ASIO’s Director-General, Mike Burgess, told a business audience that on the threshold for high-impact sabotage, “we’re there now”, describing a nation state probing Australian water, transport, telecommunications and energy networks. As a result, it applies within 12 months of the rules commencing, a year ahead of most of the other changes. The timing looks like this:
| Date | Requirement |
|---|---|
| June 2027 | FOCI (along with others) become named material risks your program must address. |
| By end of September 2027 | Your 2026–27 CIRMP report, approved by your board, where FOCI assessments are denoted. |
| June 2028 | Full supply chain mapping and vendor assessment (the five questions above) is formally required. |
The formal vendor assessment arrives in 2028, but in practice it’s probably sensible to show you have commenced the processes around FOCI from 2027.
So, what are some immediate priorities to consider?
- The more complete approach is to undertake a supply chain mapping to identify all FOCI risks throughout your supply chain. But in reality, it’s usually quite obvious - your major wind or solar OEM, or a DC block supplier for your BESS project. Flagging these major assets as requiring treatment within your risk plan is the obvious first step.
- The next level of detail is requesting detail from your suppliers, including the components inside their equipment. Our white paper Looking deeper into renewables supply chains covers how far down to go with this type of analysis.
- Map all paths a supplier has into your asset: remote access, physical access, update channels, cloud platforms and data flows. Our Insight on remote access explains why the remote access path deserves the most attention.
- Run an initial risk treatment for each major supplier, starting with the ones that have the most access, and identify your mitigation options.
FOCI is a new obligation, and given the extent of our reliance on international supply chains, there is no doubt that nearly all operators will be obliged to work through these steps to ensure compliance under the new rules. But remember, a more secure and resilient energy asset will be a more profitable asset over the long term.
Coming up in the series
Next we’ll be taking a closer look at personnel checks and access control. All of it free, on this site. If you’d like to talk about where your project stands on FOCI, get in touch.
This guide is general information, not legal advice. Check how SOCI and the enhanced rules apply to your asset and corporate structure with your legal advisers.