Rule 10A asks which laws reach your supplier

From 10 June 2028, for existing assets, a responsible entity's critical infrastructure risk management program must identify, for each existing or proposed major supplier, the "legislative or other legal requirements to which the supplier is subject to" in relation to foreign ownership, control or influence.

That is the CIRMP Rules, section 10A(5)(a).

What the rule asks, and what it does not

A supplier questionnaire records what the supplier says about itself. A foreign ownership check records who owns it. Neither answers the question the rule raises: which laws, Australian and foreign, can require the supplier, or any company above it, to hand over data, give access to systems, keep a request secret, or stop a service.

Where the data is stored does not settle it. The law follows the company that controls the data, not the building it sits in.

What AustraliaOS delivers

One named major supplier, assessed for you:

  1. The chain of companies from the supplier to its ultimate parent, from official company registers.
  2. For each company, the laws that can compel it, each quoted from its own official text, with the source and a SHA-256 hash.
  3. A private report, hashed and timestamped, that your board, your auditor or the regulator can check line by line.

A fixed fee, stated in the scope. About three weeks from a signed scope.

Independence

AustraliaOS sells nothing that depends on the answer. It does not sell, resell or recommend suppliers, and it is paid the same whatever the assessment finds.

Read the rule in our published work

AOS-HCE-2026-001 quotes rule 10A and sets out the question it asks.

Start with one supplier

Tell us which supplier matters most, and where your rule 10A work is up to.

brunel@australiaos.com.au

Sources