The federal government has certified the top three data center vendors under its new hosting certification framework, with all protected-level data now required to be stored in these facilities.

Employment Minister Stuart Robert, head of the government’s digital agenda, revealed Friday evening that the first providers had received the green tick, without revealing their names.

A spokesperson for the Digital Transformation Agency said iTnews this week that three vendors on the government’s data center panel were awarded the coveted “Certified Strategic” label.

“Certified Strategic Hosting Provider” is the highest level of assurance and requires data centers and managed service providers to allow government to specify terms of ownership and control.

The lowest certification is “Certified Insured Hosting Provider” – the minimum purchase for data center and managed service providers wishing to host protected tier data or government-wide systems.

“Three vendors have been certified as strategic against the requirements set out in the hosting certification framework,” said DTA.

“These providers are Australian Data Centers (ADC), Canberra Data Centers (CDC) and Macquarie Telecom (Canberra Campus).

“The DTA is working with other suppliers who have applied for certification and will make further announcements in due course.”

The “direct” providers of the government data center panel were the first to become eligible to apply for certification under the framework in April, with the certification process scheduled to take place between April and December.

Data center vendors not yet certified are: NextDC, Fujitsu, Equinix, Datacom, Vocus, NTT, Datapod, iiNet, Hewlett Packard, iseek, Digital Sense and Frontier.

Other “indirect” vendors that host government systems and data, such as cloud service providers, may apply for certification in a second phase, which is expected to take place in September 2021.

New data storage requirements come into effect

With the first vendors now certified, Robert said “all relevant government data” for in-flight and future projects “should only be stored in certified or certified mission-critical data centers.”

As part of hosting certification, relevant data is defined as protected level data and data from whole-of-government systems.

Robert said the hosting certification framework positions the government as an example in data protection, strengthening controls to improve the resiliency of the data infrastructure.

“The… government is committed to putting in place effective controls for the critical systems and data holdings that underpin the functioning of government,” he said.

“This includes knowing how, where and when data is stored and transmitted while gaining greater assurance over supplier operations and supply chains. “

But the rules will not extend to the Department of Defense, which continues to host protected-level data in the Sydney-based Global Switch data center.

The Global Switch facility, which most federal government agencies will leave by July 2022, is no longer approved by the government panel.

Defense has deleted all of its top secret and secret data by May 2020.

Its chief information officer, Stephen Pearson, told Senate estimates last week that the timing of the migration of its remaining data was a “risk-based decision.”

“We are the largest data holder in Global Switch, and the intention was to … phase out Global Switch … to minimize risk to operations,” he said.

He said Defense was confident that DTA’s Tier 1 data center vendors would be able to host its data after the global switch.

“We’re looking at where we’ll put it, but… on the DTA’s Tier 1 data center vendor list, all of them would have the capacity among themselves to be able to take care of Defense,” he said.

“Due to the nature of the Global Switch location, we won’t have to just take it out of one data center, potentially, and put it in another.

“Global Switch was also a disaster recovery site for other regions, so we can’t have all of our data centers in one city, so we’re going to split the capacity there and put it in different data centers. . “