Government Data Centre Requirements in Australia: Certification and IRAP Explained

What government data centre requirements actually cover

When an Australian Government agency hosts data with an outside provider, two separate questions usually come up. The first is whether the provider is trusted to host government data at all, which is what the Hosting Certification Framework deals with. The second is whether the specific system or service has been independently assessed against the government's security controls, which is where IRAP comes in.

The two are often mentioned in the same breath, but they are different things run by different parts of government. Understanding the difference saves agencies time in procurement and saves suppliers from making claims that do not hold up.

This guide explains both in plain English. It is general information, not legal or security advice. Policy in this area changes, so always confirm the current position with the official sources before you rely on it.

The Hosting Certification Framework in brief

The Hosting Certification Framework (HCF) was released in March 2021 to put the Whole-of-Government Hosting Strategy into practice. It is designed to help Australian Government customers find hosting services that meet enhanced privacy, sovereignty and security requirements, with a strong focus on who owns and controls the provider and its supply chain.

According to the official HCF website, the framework applies to government customers buying hosting for sensitive government data, whole-of-government systems and systems classified PROTECTED. On the supplier side it currently covers two types of provider: data centre providers and cloud service providers.

From 30 June 2022, new contracts and extensions of existing contracts for hosting services are expected to be with certified providers. Extensions with providers still awaiting certification are limited, and agencies can seek an exemption while a certification is pending. The framework was first developed by the Digital Transformation Agency, and enquiries now go to a Department of Home Affairs address.

One current detail matters for suppliers. The HCF site states that the framework is being reformed, and that new provider registrations and supplementary assessments were paused from 3 November 2025 until the reforms are complete. Existing certified providers are not affected. If you are a supplier planning to become certified, check the site for the latest status before building a bid around it.

Strategic, Assured and Uncertified explained

The HCF has three levels. Strategic is the highest level of assurance. It is only available to providers that allow the government to specify ownership and control conditions, and it brings increased security controls and more reporting to the Certifying Authority. The HCF site notes that many agencies are expected to seek services at the Strategic level.

Assured provides safeguards against changes in ownership or control through financial penalties, aimed at reducing the transition costs the Commonwealth would bear if a provider changed its profile. Compared with Strategic, it has lower penalties and fewer reporting requirements. It suits government customers with a low risk profile whose data has been judged not to need additional protections.

Uncertified offers minimal protections. Agencies may use uncertified providers for non-sensitive data, or where their own risk assessment finds it appropriate.

Certification is granted to a provider and its nominated services, each with a Certification ID. That means a certified company is not automatically certified for every site or product it sells. Agencies should ask for the Certification ID of the exact service being offered and can confirm it with the Certifying Authority.

What IRAP is, and what it is not

IRAP is the Infosec Registered Assessors Program, run by the Australian Signals Directorate (ASD). ASD endorses individual security professionals from industry and government to carry out independent security assessments of systems handling information up to SECRET.

An IRAP assessor learns how a system is built, identifies the applicable controls from the Information Security Manual (ISM), tests whether those controls are implemented and working, checks that required physical certifications are in place, and recommends fixes for weaknesses. The main outputs are a security assessment report and a controls matrix.

The most common misunderstanding is that IRAP is a certification. It is not. ASD states that IRAP assessors do not accredit, endorse or register systems on its behalf, and that completing an assessment does not mean a system is compliant. The agency's authorising officer reads the report and decides whether the remaining risk is acceptable. Suppliers should avoid phrases such as IRAP certified or IRAP approved for this reason.

PROTECTED, OFFICIAL: Sensitive and the role of the ISM

Australian Government information is classified by the agency that owns it, not by the provider. OFFICIAL: Sensitive and PROTECTED are the classifications most relevant to commercial hosting, with SECRET and above usually handled in more specialised environments.

ASD guidance says outsourced cloud service providers and their cloud services must be assessed by an IRAP assessor rather than an agency's own assessor. The ISM also expects cloud and managed services to be reassessed at least every 24 months against a recent version of the ISM. For a data centre that only provides colocation space, power and cooling, the focus tends to be the physical environment, personnel and the facility's place in the agency's overall system boundary.

For PROTECTED workloads, the HCF expects certified hosting, and IRAP assessment evidence is commonly requested by agencies. Exactly which HCF level and which physical security zone are required depends on the agency's risk assessment, so treat those as questions to confirm rather than assumptions.

Canberra or another city?

Canberra is the obvious starting point for many federal agencies. It is where much of the Commonwealth workforce sits, which makes site visits, escorted access and staff with security clearances easier to arrange. That does not mean government hosting must be in Canberra. Agencies and their suppliers also use Sydney, Melbourne and other capitals, often for a second site, for proximity to cloud on-ramps and carriers, or because the service is delivered from a state office. A common pattern is a primary site in one city with disaster recovery in another, so a single regional event cannot take both offline.

What matters more than the postcode is the evidence attached to the specific facility: its HCF certification for the service, the physical security zone of the data hall, and how access by cleared staff is managed. Our coverage page (/coverage) shows where mapped facilities sit, and the provider directory (/providers) is a starting point for a shortlist that you then verify against the official HCF register.

Buyer checklist for agencies and suppliers

For agencies, start with your own risk assessment and data classification, then specify the HCF level you need in the approach to market. Ask each respondent for the Certification ID of the exact service and site, and confirm it with the Certifying Authority. Request the most recent IRAP report and controls matrix, check its date and scope, and note which controls were excluded. Confirm the physical security zone of the data hall and how visitors and contractors are cleared and escorted.

For suppliers, be precise. State your HCF level and Certification ID for each service, describe IRAP as an assessment rather than a certification, and be clear about what sits inside and outside the assessed boundary. If you rely on a third-party data centre, know its certification status, because your customer will ask.

Our physical security and compliance guide and the first-time buyer's checklist in the learning centre (/learn) cover the general due diligence that applies on top of these government-specific steps.