Critical infrastructure entities will now be required to maintain a risk management program, which Home Affairs has said, on average, will cost organisations a one-off AU$9.7 million for setting it up and an annual ongoing cost of AU$3.7 million.