Hosting policy

This policy describes the requirements for entities planning digital investments involving hosting. It refers to the facilities that will host government data and systems internally, on premises, or externally, on cloud.

Applicability

Digital investment proposals are assessed against this policy by the DTA through the Digital and ICT Investment Oversight Framework (IOF).

Commonwealth entities are encouraged to apply this policy to all digital investments.

Policy

Ensure the secure hosting of security-classified government information and data using certified services and associated infrastructure by applying the Hosting Certification Framework (HCF).

Assess data and hosting sensitivities to ensure the suitability of hosting providers.

Capabilities

This policy includes requirements that relate to the following capability.

CAP28

Hosting

Strategies

This policy supports the following strategies.

STR11

Secure Cloud Strategy

Standards

The following standards show what to do to satisfy this policy.

Hosting certification framework

STA26

Direct link: hostingcertification.gov.auResponsible agency: Department of Home Affairs Last updated: March 2021 The Hosting certification framework provides guidance to Australian Government customers enabling them to identify and source hosting services that meet enhanced privacy, sovereignty…

gov.au Domain name standard

STA50

Direct link: www.domainname.gov.au/policies/policy-and-governance-frameworkResponsible agency: Department of FinanceThis standard applies to all uses of the gov.au domain for web resources, including third level domains at the Australian Government level (e.g. example.gov.au) and fourth level…

Designs

The following designs can be relevant to meeting the requirements of this policy.

gov.au domain administration system

DES162

Direct link: www.domainname.gov.auResponsible agency: Department of Finance The gov.au domain administration system provides a framework, policies, and guidance on: eligibility and allocation of gov.au domain names how applications for domain names are assessed the use of non-gov.au domain…