Services
Turning an obligation into an architecture programme.
CIRMP and the 2026 enhanced requirements read as an engineering brief: what the sections ask of the drawings, and the evidence an annual report is written from.
Why people call
- The program document exists and describes intent, but the drawings behind it do not exist.
- A framework was adopted because it suited the corporate IT estate, and it stops at the plant boundary.
- The enhanced requirements landed in June 2026 and nobody has worked out which of the two grace periods applies to which section.
- The board has asked what the obligation actually is, and the answers so far have come from vendor commentary.
What we design
- Read the obligation from the instrument
- What the sections require, for your asset class, from operative text rather than from a summary. A surprising amount of what circulates is drawn from an exposure draft that did not survive into the rules as made.
- Choose the framework deliberately
- Section 8A names five frameworks and attaches a condition to each, with an equivalence route besides. The right choice for an OT-heavy asset is rarely the one that already fits the corporate ISMS.
- Map obligations to artefacts
- Each hazard category answered by a specific document, so the program cites evidence rather than intent.
- Sequence the work against the clock
- The grace periods split by provision, not by theme, and they run from the date an asset became a critical infrastructure asset. Two organisations in one sector can be on different clocks.
How it maps to your obligations
Stated from the instruments. Position as at August 2026; each row links to the detail.
The artefact set the report is written from — and clarity that board approval attaches to the report, not the program.
A framework selection with the reasoning recorded, and the architecture evidence to support it.
Access and dependency mapping showing who reaches the asset and through what.
What you are left holding
The work survives the consultant leaving, or it was not architecture.
- Obligation-to-artefact map for your asset class
- Framework selection with the reasoning recorded
- Gap position against the chosen framework
- Risk register mapped to the hazard categories rather than a generic control list
- Programme plan sequenced against the applicable grace periods
- A board-readable summary that does not overstate the obligation
Start with the drawings you already have.
Even an out-of-date drawing tells us more in thirty minutes than a questionnaire does in a week.
Or email info@radconsulting.au.