On 27 July 2020, following the closure of the Cloud Services Certification Program (CSCP) and the associated Certified Cloud Services List (CCSL), the Australian Cyber Security Centre (ACSC) and the Digital Transformation Agency (DTA) released new cloud security guidance co-designed with industry to support the secure adoption of cloud services.
The cloud security guidance aims to guide organisations, cloud service providers (CSPs) and Information Security Registered Assessors Program (IRAP) assessors on how to perform a comprehensive assessment of CSPs and their cloud services so a risk-informed decision can be made about their suitability to handle organisations' data.
Cloud computing offers potential benefits including cost savings and improved business outcomes for organisations. However, there are a variety of information security risks that need to be carefully considered. Risks will vary depending on the sensitivity of the data to be stored or processed, and how the chosen cloud vendor (also referred to as a cloud service provider) has implemented their specific cloud services.
To assist with the assessment of CSPs and their cloud services, the Cloud Security Controls Matrix (CSCM) can be used by IRAP assessors to capture the implementation of security controls from the Australian Government Information Security Manual (ISM). The latest CSCM can be found on the webpage for the Australian Government Information Security Manual.
The CSCM provides indicative guidance on the scoping of cloud security assessments, and inheritance for systems under a shared responsibility model, though it should be noted that guidance is not definitive and should be interpreted by the assessor in the context of the assessed system. Further, these comments have generally been developed with reference to OFFICIAL: Sensitive and PROTECTED public clouds. This does not preclude their use for other types of cloud services, though additional scrutiny should be applied to their reference in this case. Importantly, the CSCM also captures the ability for cloud consumers to implement security controls for systems built on top of the CSP's services by identifying where they are responsible for configuring the service in accordance with the ISM.
Finally, the DTA provides the Whole-of-Government Cloud Services Panel (CSP), a non-mandatory procurement mechanism to enable Commonwealth entities to procure cloud services. The CSP lists cloud service providers who have negotiated a contractual head agreement with the DTA for use by the whole of Australian Government.