Important. General information only, not legal advice. Current as at 10 June 2026 against the in-force compilations on legislation.gov.au. The Enhanced CIRMP Rules 2026 were registered on 9 June 2026 and commenced on 10 June 2026. They keep the four hazard categories and make the obligations inside them more prescriptive, including phishing-resistant multi-factor authentication, network segregation and a lift towards a higher cyber maturity level. Grace periods of 12 and 24 months from commencement apply to different obligations. Always read the latest compilation before relying on any figure.