Skip to main content

The Cloud Services Certification Program (CSCP) ceased on 2 March 2020. The Australian Cyber Security Centre (ACSC) ceased the Certified Cloud Services List (CCSL) on 27 July 2020 and concurrently released the Cloud Security Guidance package.

In July 2019, the Australian Cyber Security Centre (ACSC) commissioned an independent review of its Cloud Services Certification Program (CSCP) and Information Security Registered Assessors Program (IRAP).

From 2 March 2020, ASD ceased the CSCP and the Australian Signals Directorate (ASD) is no longer the Certification Authority for cloud services for Commonwealth entities, and will no longer be progressing certification activities. This includes re-certification activities. The associated Certified Cloud Services List (CCSL) ceased on 27 July 2020. All ASD cloud service certifications and re-certification letters are now void.

On 27 July 2020, following the closure of the CSCP and CCSL, ACSC and the Digital Transformation Agency (DTA) released new cloud security guidance co-designed with industry to support the secure adoption of cloud services across government and industry. This new guidance includes:

The cloud security guidance aims to guide organisations including government, cloud service providers (CSP's), and IRAP assessors on how to perform a comprehensive assessment of a CSP and its cloud services so a risk-informed decision can be made about its suitability to handle an organisation’s data. The ACSC has also developed FAQs to assist organisations to transition from the CSCP to this new assessment framework.

The cloud security guidance is supported by forthcoming updates to the Australian Government Information Security Manual (ISM), the Attorney-General’s Protective Security Policy Framework (PSPF), and the DTA’s Secure Cloud Strategy. Current ACSC products are also available and support the new guidance:

The ACSC will continue to engage with both government and industry to ensure the new guidance is implemented effectively and remains fit for purpose.

The cessation of the CSCP and CCSL—and the adoption of the new cloud security guidance—will allow Commonwealth entities to choose from a wider range of CSPs and cloud services.

Commonwealth entities continue to be responsible for their own assurance and risk management of cloud services.

The DTA’s existing ICT Marketplaces are not affected by these changes and will continue to operate as usual. This includes the Cloud Marketplace panel and its new Approach to Market on 21 May 2020.

The DTA continues to encourage Commonwealth entities to use the Australian Government Secure Cloud Strategy to support their adoption of cloud services, and will continue to work closely with the ACSC, vendors and broader industry to articulate best-practice cyber security measures.

Related information