About the program
Under the Protective Security Policy Framework (PSPF), products being developed for Australian Government agencies that handle and protect SECRET and TOP SECRET data must undergo a high assurance security evaluation.
Our High Assurance Evaluation Program involves rigorous analysis and testing to search for security vulnerabilities in products. We expect products developed for these classifications to maintain whole of lifecycle security postures, from conception to end-of-life activities. This provides a higher level of assurance in their security enforcing functions for Australian Government use.
We recommend vendors to understand these additional expectations before commencing any development. Additional guidance can be found in the High Assurance Guide that is available on request via asd.ta.services@defence.gov.au.
Participation in a high assurance evaluation does not guarantee that a product will reach high assurance evaluation outcome. This outcome is dependent on the underlying concept, technology and security application, vendor security and engineering maturity, and the ability to consistently demonstrate ongoing compliance with the required standards.
Learn more about our guidelines for evaluated products.
Program requirements
A high assurance evaluation requires sponsorship from an Australian Government agency. If you are seeking a high assurance evaluation, complete our sponsorship letter [PDF 940KB]. Once completed, submit the letter to asd.ta.services@defence.gov.au.
We will review your request and sponsorship letter and reach out to relevant parties to understand the evaluation aims, requirements to undertake the evaluation and discuss proposed timeframes.
The sponsoring agency should provide overall project management for the evaluation through an Integrated Project Team, ensuring effective coordination between the vendor, the ASD evaluation team, and the sponsoring stakeholder(s). They will also be required to provide initial detail on funding and a Concept of Operations artefact.
Evaluation commencement
The evaluation cannot commence until we have:
- agreed on the scope of the evaluation activity and desired project timelines
- received the vendor product and artefacts to support the evaluation.
We will review artefacts for their completeness and correctness, and if it meets High Assurance Program requirements, we will inform the Integrated Project Team regarding the expected evaluation timeframe. If the scope of evaluation activity is unclear, or the artefacts do not meet High Assurance Program requirements, vendors will be advised of additional information or development required, and directed to resubmit the request.
Vendor support
Vendors should provide technical, security and engineering contacts within the company (preferably in Australia). We’ll need them to:
- answer our questions
- provide detailed technical documentation and attestation mapped to the ASD High Assurance standards
- arrange offline access to the full source code and other technical artefacts, and
- facilitate site visit and test witnessing (as appropriate).
We need to independently review the source code and build systems to be confident in the implementation and architecture of the product's security. This usually makes the evaluation faster and more efficient.
The High Assurance evaluation is a recursive process, and ASD will communicate with you on any additional artefacts and requirements at different stages of evaluation process.
Evaluation timeframes
The evaluation process may be lengthy. Completion timeframes vary depending on factors such as:
- maturity of the vendor or product
- vendor responsiveness
- high evaluation program capacity
- the identification of any security vulnerabilities during the evaluation.
If we find vulnerabilities, the evaluation progress depends on the vendor’s ability to implement recommended fixes.
Evaluation costs
We don’t charge fees for the evaluation. However, the vendor is responsible for arranging the delivery of information, software or hardware. If secure electronic delivery isn’t possible, the vendor must arrange delivery to us. They must also provide any licences we need to conduct the evaluation.
There may be additional costs that the vendor will be responsible for, however these may not be known until scoping of the evaluation is complete.
Non-disclosure agreements & Clearances
Vendors don’t need a non-disclosure agreement (NDA). However, if requested, we can negotiate an NDA with the vendor. This can be a lengthy process that may delay the start of the evaluation. To help reduce delays, we have a standard NDA template available on request.
Australian clearances will be required throughout a High Assurance process.
Contact us
To learn more, contact us