TSRMP Risk Management Program Assessment Tool

Overview

The TSRMP Risk Management Program Assessment Tool gives telecommunications security and risk teams a structured, evidence-backed way to build, evaluate and maintain their all-hazards risk management program — at the individual asset level and across the entire asset portfolio. Whether you are preparing your board-approved annual report, an annual attestation to the Cyber and Infrastructure Security Centre, a CISC information request, or your own internal gap analysis, the tool does the heavy lifting: material risk identification, hazard-vector scoring, gap analysis, evidence management, and report generation — entirely within your browser, with no data leaving your environment unless you explicitly enable an AI feature.

The assessment is structured around the four TSRMP hazard vectors — cyber and information security, personnel, supply chain, and physical security and natural hazards — with the "protect your asset" obligation and the telecommunications-specific risks (compromise, theft or manipulation of communications) woven through. A dedicated cyber maturity module lets you target the maturity level of a recognised framework per asset, with ML1 and ML2 milestones surfaced against the regulatory clock. Multi-asset portfolio mode aggregates assessments across every critical telecommunications asset you operate, and period tracking turns point-in-time scoring into the defensible trajectory regulators look for after an incident.

What the TSRMP Asks You to Do — and How the Tool Handles It

The Security of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules 2025 switch on the Part 2A risk management program obligations of the SOCI Act for critical telecommunications assets. They consolidate the national security obligations that previously sat under the Telecommunications Sector Security Reforms (TSSR) into the SOCI Act's all-hazards setting — and add telecommunications-specific risks, including the compromise, theft or manipulation of communications. For each critical telecommunications asset, a responsible entity must identify its operational context, identify every hazard that poses a material risk of relevant impact, minimise or eliminate that material risk so far as is reasonably practicable, and mitigate the relevant impact of the hazard.

The tool integrates every element of the program — the four hazard vectors, the "protect your asset" obligation, the telecommunications-specific risk additions, the cyber maturity uplift milestones, and the board-approved annual report structure — so the question is never "have we covered the obligation?" but rather "what does the evidence support?".

The Four Hazard Vectors

A TSRMP must address each hazard vector for every critical telecommunications asset. The tool structures the assessment around all four, mirroring the CIRMP Rules with the telecommunications-specific additions built in:

Telecommunications-Specific Material Risks — Beyond a Generic CIRMP

The TSRMP Rules largely mirror the existing Critical Infrastructure Risk Management Program (CIRMP) Rules, but add the material risks that are distinctive to telecommunications: the compromise, theft or manipulation of communications, and the obligation to protect both the network assets used to provide a carriage service and the non-network assets that support them — billing and charging systems, provisioning and operational support systems, and the like. The tool flags these telecommunications-specific risks explicitly so they are never lost inside a generic all-hazards template.

The "protect your asset" obligation sits over the top: protect each critical telecommunications asset, so far as it is reasonably practicable to do so, where there is a material risk of harms that would have a relevant impact. Each material risk is recorded with its operational context, its assessed likelihood and impact, the mitigation in place, and the residual position — the structured record that turns a risk register into a defensible program rather than a tick-box exercise.

Cyber Maturity Uplift — ML1 by October 2026, ML2 by October 2027

The cyber and information security vector carries the most demanding milestones in the TSRMP regime. Responsible entities must reach the maturity equivalent of a recognised framework — commonly ISO/IEC 27001:2023, the ACSC Essential Eight, or the NIST Cyber Security Framework — with maturity level one due by 4 October 2026 and maturity level two by 4 October 2027. Critically, the obligation is to comply with the relevant maturity, not to become certified. The tool's cyber maturity module lets you:

• Select your framework per asset — choose ISO 27001:2023, Essential Eight or NIST CSF for each asset and the tool filters to the right controls and maturity criteria.
• Target ML1 and ML2 — set the target maturity level per asset, with live achievement scoring as you progress and the regulatory due dates surfaced against current posture.
• Track the gap to target — every control below its target maturity is captured as a gap, prioritised and routed into the remediation plan with a date-aware view of how far you are from the next milestone.
• Evidence the "comply, not certify" position — capture the evidence that demonstrates compliance with the framework's maturity without requiring a certification body, exactly as the Rules contemplate.

Multi-Asset Portfolio Mode

Most carriers and relevant CSPs operate many critical telecommunications assets — core network, access network, data centres, operational support systems, billing and charging platforms — each with its own scope and risk profile. The Asset Registry holds every asset in your portfolio, each with its own classification, framework selection, cyber maturity target, and assessment status, all visible on a single dashboard. The portfolio-level views go well beyond simple aggregation:

• Asset × Hazard Heatmap — A colour-coded cross-portfolio matrix showing every asset against the four hazard vectors, with average posture by vector across assets, sortable to surface the weakest vectors across the portfolio.
• Posture by Asset Type — Compare across asset types (network, non-network, data centre, OSS/BSS) to see whether systemic weaknesses cluster by operational context.
• Common Gaps Across the Portfolio — Material risks and controls where multiple assets fall short, with the explicit list of affected assets. Fix one root cause at the policy or platform level, clear many asset-level gaps at once.
• Common Evidence Weaknesses — Patterns where evidence quality is consistently weak across assets, pointing at systemic documentation deficiencies worth addressing centrally — plus reference examples of assets with strong evidence for the same control.
• Common Low-Maturity Controls — The cyber controls that consistently score below their ML target across assets — the structural patterns worth a portfolio-wide programme rather than per-asset remediation.
• Portfolio Overview Dashboard — Tile metrics across the top show total assets, average posture, cyber maturity achievement, and outstanding actions. Programme managers see exactly where to push next.

Evidence Workflow & Reviewer Overrides

Each material risk and control presents the assessor with a structured answer scale (None, Partial, Strong, plus N/A with justification), an inline guide to what good evidence looks like, and a drag-and-drop area for attaching supporting documents — PDFs, Word, Excel, images, CSV — directly to the item.

An independent reviewer workflow captures observations against the evidence in structured fields. The reviewer can override the self-assessed position where the evidence clearly contradicts it, with both the original answer and the reviewer override preserved in the audit trail. When AI is enabled, AI-suggested ratings (with confidence rating low/medium/high) sit alongside the self-assessment and the reviewer override — three independent signals, all visible side-by-side, all auditable.

Period Tracking, Baselines & the Annual Report Cycle

The TSRMP is not a point-in-time obligation. A board-approved annual report is required from FY2026, supported by an annual attestation — and the Secretary of the Department of Home Affairs can request information and documents, and direct variation of a program assessed to have a serious deficiency. The tool treats assessment as a continuous activity, with first-class support for the time dimension:

• Maturity Snapshot & Baseline — Save a point-in-time baseline; capture manual overrides where appropriate; replace, clear or revert baselines as the programme evolves.
• Annual Period Closure — Formally close a reporting period and archive it, freezing the state behind the board-approved annual report for audit and historical comparison.
• Year-over-Year Comparison — Improvements, regressions, evidence added or removed, reviewer-decision changes, cyber maturity movement — all surfaced as a structured change report between any two reporting periods.
• Multi-Period Trend Comparison — Load three or more historical periods to visualise trajectory by hazard vector and asset across time.
• Per-Asset Maturity Trends — Each asset's trajectory over multiple closed periods, plus a portfolio-average trend line — the trajectory regulators will examine post-incident.

For carriers and relevant CSPs working toward the cyber maturity milestones of October 2026 and October 2027, this is the evidence trail that demonstrates credible intent — quarter by quarter, not just at year end.

Audit Log, Collaboration & Resilient Storage

Every answer, note, evidence change and reviewer override is captured in a chronological audit log — the complete record of who did what and when, with full version history accessible from the in-app log viewer.

Optional Shared Folder Mode turns the assessment into a team workspace. Multiple assessors work in parallel on a multi-asset portfolio via OneDrive, SharePoint, Microsoft Teams, Google Drive, or Dropbox. Per-asset file locking prevents conflicting edits; identity stamping records who changed what; live change polling surfaces edits in seconds; and the sync provider conflict detector flags "conflicted-copy" files so you can resolve them manually rather than discovering them at audit time. A 30-day soft delete with one-click restore prevents accidental data loss.

Evidence storage is resilient by design — content-derived filenames (so evidence titles never leak through the folder browser), per-file and per-question caps, browser-storage quota monitoring, optional encryption-at-rest, a crash-recovery mirror, and a read-only Evidence Health Check audit available from Settings.

Who It's For

• Carriers holding a carrier licence with critical telecommunications assets
• Relevant carriage service providers — those supplying 20,000+ active carriage services or supplying to the Commonwealth Government or defence
• Telecommunications security and risk teams building or maintaining an all-hazards risk management program
• Operators needing portfolio-wide visibility across network and non-network assets
• Boards, risk committees and assurance teams preparing the annual report and attestation to the CISC