Hosting Certification Framework (HCF): which hosting Australian Government data needs, and what Strategic vs Assured means

What it is. The Hosting Certification Framework turns the 2019 Whole-of-Government Hosting Strategy into something procurement teams can apply. Released in March 2021 and now run by the Department of Home Affairs (policy moved from the DTA on 1 May 2023), it sits alongside the PSPF and the ISM. Those two tell you which security controls a system needs. The HCF covers the questions they leave open: who owns and controls the provider, where the data physically sits, how the supply chain is managed, and what happens if the provider is sold.

Who it binds. The framework applies to Australian Government customers buying hosting for three kinds of workload: sensitive government data, whole-of-government systems, and systems classified PROTECTED. Those must be hosted on certified services. It also reaches the providers serving them, including the data-centre facilities, their systems and their supply chains. Its requirements apply to new contracts and to extensions of existing contracts from 30 June 2022.

The three levels. Strategic is the highest level of assurance. It is only open to providers that let the government set ownership and control conditions, and it adds security controls; high-risk customers, or those wanting extra protection for their data, may need it. Assured protects against a change of ownership or control through financial penalties meant to cover the Commonwealth's cost of moving if the provider's profile changes; it suits lower-risk customers whose sensitive data does not need the extra protections. Uncertified offers minimal protection and is for non-sensitive data, or where the customer's own risk assessment says it is acceptable. Which level you need follows from your risk profile, the classification and sensitivity of the data, and your internal risk assessment under the PSPF.

Layers, not just clouds. The certified-provider register is split by layer and names specific sites and offerings: Certified Strategic facilities (named data-centre buildings), Certified Strategic enclaves (named halls or sites run by a provider), and Certified Strategic services (named cloud or managed-service offerings, often limited to Australian regions). Check the exact site, region and offering you will use against the list, not just the company name.

Where it stands now. Home Affairs has paused HCF registration for prospective providers, and supplementary assessments for already-certified providers, from 3 November 2025 until reforms are finished. Existing certifications are not affected. In practice the certified-provider list is frozen for now, so check it before committing to a provider rather than assuming one will be added soon.

Contract timing. Where a provider's certification is still pending, contract extensions are capped at one year, with the option of one further year. Entities can apply for an exemption by emailing hostingcertifications@homeaffairs.gov.au. Keep the exemption decision and your risk assessment on file, because an auditor will ask for both.

HCF is not IRAP. An IRAP assessment tests a system's controls against the ISM. HCF certification looks at the provider's ownership, control, location and supply chain. A PROTECTED workload usually needs both: an IRAP-assessed service and the HCF level your risk assessment calls for. One does not stand in for the other.

Practitioner checklist. Classify the data first: is it sensitive, whole-of-government, or PROTECTED? Record which HCF level your risk assessment requires and why. Confirm each layer (facility, enclave or region, and service) on the current certified list, and keep a dated copy of the list with the procurement file. Put the HCF level, data-location limits and change-of-control notice into the contract. Line up the IRAP report and the ISM control mapping separately. Diary contract extensions against the cap, and re-check the list at renewal while the reform is under way. Cross-links: pspf, ism, irap, third-party-supply-chain, apra-cps-234, essential-eight-evidence.