Skip to main content

On 27 July 2020, following the closure of the Cloud Services Certification Program (CSCP) and the associated Certified Cloud Services List (CCSL), the Australian Cyber Security Centre (ACSC) and the Digital Transformation Agency (DTA) released new cloud security guidance co-designed with industry to support the secure adoption of cloud services.

The cloud security guidance aims to guide organisations, cloud service providers (CSPs) and Information Security Registered Assessors Program (IRAP) assessors on how to perform a comprehensive assessment of CSPs and their cloud services so a risk-informed decision can be made about their suitability to handle organisations' data.

To assist with the assessment of CSPs and their cloud services, the Cloud Security Controls Matrix (CSCM) can be used by IRAP assessors to capture the implementation of security controls from the Australian Government Information Security Manual (ISM). The latest CSCM can be found on the webpage for the Australian Government Information Security Manual.

The CSCM provides indicative guidance on the scoping of cloud security assessments, and inheritance for systems under a shared responsibility model, though it should be noted that guidance is not definitive and should be interpreted by the assessor in the context of the assessed system. Further, these comments have generally been developed with reference to OFFICIAL: Sensitive and PROTECTED public clouds. This does not preclude their use for other types of cloud services, though additional scrutiny should be applied to their reference in this case. Importantly, the CSCM also captures the ability for cloud consumers to implement security controls for systems built on top of the CSP's services by identifying where they are responsible for configuring the service in accordance with the ISM.

Related information

The Privacy Act 1988 defines legislative requirements for the handling of private information.

The Archives Act 1983 regulates government record-keeping requirements.

The DTA provides the Whole-of-Government Cloud Services Panel (CSP), a non-mandatory procurement mechanism to enable Australian Government agencies to procure cloud services. The CSP lists cloud service providers who have negotiated a contractual head agreement with the DTA for use by the whole of Australian Government.