DTA unveils hosting certifications for MSPs, data centres

The Digital Transformation Agency has unveiled a regime for certifying data centres and managed services providers that handle federal government data.

The agency will assess providers on two certification levels, Certified Assured Hosting Provider and Certified Strategic Hosting Provider.

Certified Assured Hosting Provider arrangements safeguard against the risks of change of ownership or control through financial penalties or incentives, aimed at minimising transition costs borne by the Commonwealth should a data centre provider alter their profile.

Certified Strategic Hosting Provider, previously named Certified Sovereign Data Centre, represents the highest level of assurance and is only available to providers that allow the government to specify ownership and control conditions.

The certifications are part of the hosting certification framework, which is under the whole-of-government hosting strategy developed in 2019.

“The government is committed to ensuring there are effective controls in place for the critical data holdings and systems that underpin the operation of government. This includes knowing how, where and when data is stored and achieving greater assurance over the operation and supply chains of providers,” the announcement read.

“The Hosting Certification Framework will assist government agencies to mitigate against supply chain and ownership risks and enable them to identify and source appropriate hosting and related services.”

The framework works alongside other government policies and frameworks like the foreign investment policy and the Protective Security Policy Framework to reduce data sovereignty, ownership and supply chain risks; ensure government hosting services are more efficient and cost-effective; provide certainty on the Australian Government hosting operating environment for industry and agencies.

The DTA will start certifying providers in the current Data Centre Facilities Supplies Panel, while other providers like MSPs and cloud service providers can register their interest to join the Phase 2 certification process, set to start at the end of the year.