Microsoft's Australian cloud gets approved to host protected government data

Microsoft has become the first hyperscale public cloud provider to achieve the Australian Signals Directorate’s ‘protected’ level certification, which allows agencies to host highly sensitive government data in Azure and Office 365.

The announcement, made today by cybersecurity minister Angus Taylor, coincides with the launch of Microsoft’s two new Azure regions hosted in Canberra Data Centres’ Fyshwick and Hume facilities, bringing the total number of global Azure regions to 50.

The minister said awarding the certification to Microsoft would accelerate the adoption of cloud technology by Commonwealth, state and territory governments. 

“It has never been more important for government and Australian enterprises to strategically manage cybersecurity risks,” Taylor said. “Australia is under increasing cybersecurity threat and as government and critical infrastructure innovate and transform, it is imperative that we remove risk in our existing systems and use modern, secure cloud technology.

“Awarding Microsoft the protected certification reflects the Turnbull government’s commitment to prioritise and deliver secure cloud services, ensuring a very high level of security for Australians.

“The Australian government welcomes Microsoft’s investment in the Australian public sector, including an initiative to deliver cloud computing skills to an additional 5000 employees by 2020.”

Microsoft joins four local cloud providers certified to handle protected-level data: Vault Systems, Sliced Tech, Macquarie Telecom and Dimension Data. There are four levels of government data classification: unclassified, protected, secret and top secret. 

The cloud and software giant has been eyeing greater contracts with Australian government departments for some time. It's major investment in the two new Azure regions, announced in August last year, were geared at luring more Australian government agencies into its cloud while helping partners bid for more public sector work.

The company had been bullish about achieving protected status, previously only golding the ASD's unclassified certification for certain Azure and Office 365 services.  

“Less than three years ago, we launched our first cloud services from an Australian data centre," James Kavanagh, Microsoft Azure engineering lead for Australia said at the time. 

"Since then, we’ve worked to lead the way in delivering trusted innovation to our customers and partners, which has at times meant the hard work of undertaking very onerous compliance processes.

"We’ve taken on that effort to reduce the work our partners and customers must do themselves thus accelerating their ability to adopt innovation. This has led the Australian Signals Directorate to certify a total of 52 services across Microsoft Azure, Microsoft Office 365 and Microsoft Dynamics 365 – far more than all other cloud services combined." 

Microsoft's biggest public cloud competitor, Amazon Web Services, is also gunning for protected-level certification, recently revealing it had completed an independent assessment from the Information Security Registered Assessors Program (IRAP), which would allow government agencies to self-accredit their own protected workloads on AWS.