This policy describes the requirements for entities planning digital investments involving cloud computing.
Applicability
Digital investment proposals are assessed against this policy by the DTA through the Digital and ICT Investment Oversight Framework (IOF).
Commonwealth entities are encouraged to apply this policy to all digital investments.
Policy requirements
-
Comply with legislation
An entity must comply with any legislation relevant to its circumstances.
-
Align to guidelines and standards
All Commonwealth entities must comply with the Hosting Certification Framework to ensure cloud computing facilities are hosted in certified tenancies/data centres, as well as any other mandatory frameworks, policies, and standards.
-
Develop strategic documentation for the cloud
An appropriate set of guiding documents must be developed within entities undertaking cloud-based investments, and should include a cloud strategy, cloud policy, and implementation plan(s).
-
Incrementally adopt cloud computing services
A step-by-step approach to refining and enhancing cloud computing services, starting with low-complexity services and progressively maturing, will allow entities to optimise practices when requirements evolve.
-
Avoid customisation by using cloud services ‘as they come’
Changing of business processes to align to cloud offerings, rather than developing or customising technology suit existing processes, is critical to realise the benefits of cloud services.
-
Automate where suitable
Automation enables support teams to focus on the more complex requirements that are unique to their business by minimising the effort and need to provision, configure, backup, restore, patch, update, and deploy services.
-
Take a risk-based approach to cloud security
Entities continue to be responsible for their own assurance and risk management of cloud services and must manage this risk as appropriate.
-
Recognise emerging cloud computing trends
Understanding cloud trends will assist entities to adapt and innovate. Considerations include hybrid and multi-cloud approaches, edge computing, real-time infrastructure, cloud security, FinOps, sustainability initiatives, and GenAI infrastructure.
-
Procure via the Cloud Marketplace
The Cloud Marketplace on BuyICT has been designed to meet the complex needs of government agencies who are looking to easily source value-for-money cloud solutions.
-
Adhere to reuse principles
Entities must give priority to the adoption of reuseable digital and ICT solutions, patterns, or knowledge, and, where necessary, design new solutions with a focus on future reuse.