Information Security Registered Assessors Program

Data center systems must be assessed by ACSC-approved Registered Assessors who have completed specialized training in ISM requirements, government security context, and IRAP methodology.

The data center must engage an independent assessor (not internal or vendor-aligned) to conduct the formal security assessment and produce the Commonwealth Approved System Security Assessment Report (CASSAR).

This requirement ensures objective evaluation against government baseline security controls and prevents conflicts of interest in compliance determination.

Data centers must implement and evidence compliance with the 14 fundamental security principles from the Information Security Manual: security governance, information and data handling, ICT security, physical security, personnel security, third-party management, cryptography, system acquisition/development, security incident management, continuity of operations, audit and accountability, plus protective security.

Each principle requires specific technical controls (e.g., encryption algorithms, access control models, monitoring capabilities) and operational procedures tailored to the data center's specific system architecture and information classification levels handled.

Systems must implement technical and logical segregation proportional to the highest classification of data processed, with specific requirements for OFFICIAL-SENSITIVE, SECRET, and TOP SECRET information.

This includes network segmentation, cryptographic isolation, separate security domains, dedicated infrastructure for classified workloads, and controls preventing classified data spillage to lower-classification networks or systems.

Data centers must demonstrate ability to handle multiple classification levels with appropriate segregation and cannot mix classification levels without explicit security assessment and approval.

Data centers must employ ACSC-approved cryptographic algorithms and implement sophisticated key management frameworks including Hardware Security Modules (HSMs), key escrow procedures, cryptographic key generation in secure environments, and key lifecycle management with documented procedures.

Encryption must be applied to data in transit (TLS 1.2 minimum), data at rest (AES-256 or equivalent), and authentication mechanisms.

The assessment specifically examines cryptographic material handling, storage separation from encrypted data, key rotation schedules, and compromise procedures.

All personnel with access to government systems or facilities must hold appropriate security clearances (minimum Baseline, Secret, or Top Secret depending on data classification), undergo background investigation through the Australian Security Vetting Authority (ASVA), and complete security awareness training.

Data centers must maintain clearance verification records, establish need-to-know principles restricting access, implement segregation of duties preventing single individuals from compromising sensitive functions, and document all personnel access with audit trails.

Contractors and third-party personnel face equivalent vetting requirements.

Data center facilities must implement multi-layered physical security including perimeter controls, access card systems with audit logging, closed-circuit video surveillance with retention periods (minimum 30 days), security guards for classified workload areas, visitor management procedures, and environmental monitoring for temperature/humidity control of classified zones.

Facilities processing SECRET or TOP SECRET information require Sensitive Compartmented Information Facility (SCIF) standards with Faraday cage construction, electromagnetic shielding, and acoustic security.

The IRAP assessment specifically evaluates physical security adequacy for the classification of information processed.

Data centers must maintain documented incident response plans specifically addressing government data compromise scenarios, with defined escalation procedures to government agencies, ACSC notification requirements (within 30 days for confirmed breaches), containment procedures, forensic investigation capabilities, and evidence preservation.

Assessment requires evidence of incident response testing, tabletop exercises simulating government data breaches, documented procedures for handling classified information in incident contexts, and demonstration of capability for emergency system shutdown or isolation if compromise is suspected.

Systems must implement continuous security monitoring (CSEM) capabilities including intrusion detection/prevention systems (IDS/IPS), Security Information and Event Management (SIEM) platforms with 90-day minimum log retention, regular vulnerability scanning (monthly minimum), automated patch management with documented testing and deployment procedures, and annual penetration testing by independent security firms.

Assessment requires evidence that vulnerability remediation follows defined service level agreements aligned to vulnerability criticality, with compensating controls documented for any unpatched systems with business justification.

Data centers must implement comprehensive audit logging for all access to systems, data, and facilities, with logs stored on separate, protected infrastructure resistant to tampering or deletion.

Logging must capture user identity, timestamps, actions performed, data accessed, and outcomes, with specific enhanced logging for privileged account activities and sensitive data access.

Assessment verifies audit log integrity through cryptographic protection, regular review procedures with documented evidence of log analysis, and log retention periods matching data sensitivity (minimum 7 years for government data).

Data centers must establish formal vendor management frameworks assessing security capabilities of suppliers (hosting providers, software vendors, managed service providers) and ensuring supply chain security through contractual requirements, regular audits, and compliance verification.

Assessment requires evidence that third parties undergo security assessment proportional to their access and influence, with documented security agreements, service level agreements including security metrics, and contingency plans for vendor failure scenarios.

Particularly critical for data centers utilizing cloud services or managed security services requiring explicit government approval.