Standards
The frameworks we're building to, before we build.
Retro-fitting compliance onto infrastructure is how early providers end up unable to sell to government. So we started from the control set rather than the hardware, and we'd rather state our position plainly than display badges we haven't yet earned.
The government workloads we’re building to support require hosting in facilities certified under the Hosting Certification Framework, in line with applicable Australian Government hosting requirements
Why provider selection comes first
- Hosting Certification Framework
- Our production platform will be sited in a facility holding a Certification ID at the Certified Strategic level under the Hosting Certification Framework. The certification and its scope will form part of the assurance evidence for government workloads hosted on the platform.
- ISM and PSPF
- The platform is being designed against Information Security Manual controls and Protective Security Policy Framework requirements, with mappings written as the system is built rather than after it.
- Essential Eight
- The platform is being designed to meet Essential Eight Maturity Level Two, with our self-assessment shared with prospective customers on request.
- IRAP
- An independent IRAP assessment is planned once the platform is sited. IRAP is an assessment, not a certification — the Authority to Operate will always remain your agency's decision, and our job is to supply the evidence for it.
- ISO/IEC 27001 and SOC 2
- Both are recognised requirements for the workloads we intend to support, and part of the control set the platform is being built to meet. We are pursuing each as the platform moves toward production.
- Sovereignty and supply chain
- Australian owned and controlled from incorporation with no offshore administration of customer environments at any point.