Mining is not one of the eleven critical infrastructure sectors. Most large miners are regulated anyway because they own or operate assets that are named, including critical ports, critical freight infrastructure such as private heavy haul rail, critical freight services, critical electricity, gas and liquid fuel assets, and critical water assets. Red Piranha helps you scope which assets are in and what obligations follow.

The Enhanced CIRMP Rules commenced on 10 June 2026 and apply a stricter tier to nine asset classes, six of which miners commonly hold. They require a cyber framework uplift to a higher maturity level, phishing resistant multi factor authentication with central logging, network segregation so critical systems keep running for at least three months, background checked critical workers, and supply chain mapping including foreign ownership, control and influence. The deadlines are 10 June 2027 and 10 June 2028.

IEC 62443 partitions industrial systems into zones connected by controlled conduits, each carrying a target security level. On a mine that means separate zones for the autonomous fleet and wireless network, processing plant control, mine services such as ventilation and dewatering, tailings and water instrumentation, hoisting, rail signalling, port loading, safety instrumented systems and the remote operations centre. Red Piranha designs that model and enforces it at the boundary with Crystal Eye.

Passive Encryption Control Application, known as PECA, manages and protects OT and IoT devices without agents, without active scanning and without decryption. It passively baselines how each device normally communicates inside its zone and then enforces that baseline. Deviations can be alerted, pinholed or blocked. This extends control across the full operating life of unpatchable legacy equipment.

Under Part 2B of the SOCI Act, a responsible entity must report an incident with a significant impact within 12 hours and one with a relevant impact within 72 hours. Under the Cyber Security Act 2024 a ransomware or extortion payment must be reported to the Australian Signals Directorate within 72 hours, and critical infrastructure entities are in scope regardless of turnover. Red Piranha provides the detection, forensic evidence and reporting support to meet those clocks.

Yes. The same program maps to NIS2 and the Cyber Resilience Act in Europe, NIST CSF 2.0 and NIST SP 800 82 in the United States, the Critical Cyber Systems Protection Act in Canada, Ley 21.663 and ANCI obligations in Chile, NCA OTCC in Saudi Arabia, Perpres 82 of 2022 in Indonesia and the Critical Infrastructure Protection Act in South Africa. IEC 62443 is the common engineering layer underneath all of them.

No. Red Piranha deploys an observe, simulate then enforce sequence. Sensors can run out of band on a SPAN or TAP first; policies are simulated against captured traffic, and enforcement is introduced in stages with operations sign off. PECA is passive by design, so devices are never scanned or interrogated.

That is the most common starting point, and it is stage one of the program. Red Piranha builds the inventory and taxonomy across the fleet network, plant control, rail, port, tailings and safety systems, records dependencies and identifies vital systems and isolation points. Every later obligation, from segregation to rebuild to supplier mapping, depends on it.

Mining companies owning critical ports, rail, or power assets fall under CIP obligations. Red Piranha aligns OT cybersecurity with CIP standards to ensure compliance and resilience.