Protecting Australian government data from access, abuse and disclosure remains a prime consideration when procuring and leveraging cloud services. AWS recognises that customers rely upon the secure delivery of the AWS infrastructure and the importance of having features that enable the customer to create more secure environments. AWS enables customers to meet these objectives by prioritising security in the delivery of its services through the establishment of a robust control environment and making available for use a wide range of security services and features. These services provide comprehensive controls over the customer IT control environment, simplify the management of security services and provide improved security outcomes for the Australian Government.
The Information Security Registered Assessors Program (IRAP) enables Australian government customers to validate that appropriate controls are in place and determine the appropriate responsibility model for addressing the needs of the Australian Signals Directorate (ASD) Information Security Manual (ISM).
An independent IRAP assessor examined the controls of AWS’s people, process, and technology to ensure they address the needs of the ISM. This assessment and Letter of Compliance is the basis on which a Certification Authority gains assurance to certify AWS infrastructure and provide a recommendation to the Accreditation Authority for appropriate use of the platform.
An agency accreditation is the culmination of an IRAP assessment and formal certification by the ASD operating as the Certification Authority for the Australian Government. This certification provides assurance that AWS has in place the applicable controls of the ASD’s ISM and is the immediate precursor in accrediting AWS for Australian government workloads.
This certification will remove significant burden from individual agencies or their commercial partners having to perform assessments and certifications of the cloud platform for their workloads and instead allows them to focus on their system’s accreditation processes.
AWS provides customers a wide range of security functionality to protect their data in accordance with ASD’s ISM controls, agency guidelines and policies. We are continually iterating on the security tools we provide our customers, and regularly release enhancements to existing security functionality. Additionally, we provide a wide variety of whitepapers, online documentation and security videos for our customers. Our global whitepapers have recommendations for securing your data that are just as applicable to Australian government AWS workloads.
How do I consume AWS ‘s IRAP security documentation and guidance? Australian government customers can leverage our ASD certification and our independent IRAP Assessors Letter of Compliance in order to accelerate their certification and accreditation objectives. In support of our Australian government customers, we provide a package of security guidance and documentation to enhance their understanding of security and compliance while using AWS as a certified cloud services supplier. In particular, specific to assessing AWS infrastructure by an IRAP against ISM we provide under NDA (as required) to government organisations or their partners: - IRAP Report on AWS compliance to the ISM - ASD Certification Letter of the AWS Infrastructure platform - IRAP ISM Letter of Compliance - Control Implementation Summary Additional reports that are available that evaluate and test controls implemented by AWS Infrastructure and which are available under NDA (as required): - Service Organisation Controls 1 (SOC1) Type II Report - Service Organisation Controls 2 (SOC2) Type II Report - ISO 27001 Certificate & Statement of Applicability - PCI Attestation of Compliance and PCI Responsibility Summary To find out more information about the additional reports see the AWS Compliance FAQs. To request access to AWS’ security documentation as it pertains to Australian Government customers, or contractors conducting business with the Australian government, please contact AWS Sales and Business Development or send an email to awscompliance@amazon.com. |
An IRAP assessor is the only individual accredited as qualified to perform an assessment of an ICT system against the Australian Government ISM and describes areas of compliance and non-compliance, describes residual risks and remediation actions and provides recommendations to a Certification Authority on certification.
Document Control |
Documentation |
Federal Agency Package |
SLED Package |
AWS Partner |
DRM |
IRAP Report Stage 2 |
X |
|
|
| DRM | ASD Certification Report | X | ||
Public |
X |
X |
X |
|
Public |
X |
X |
X |
|
DRM |
Control Implementation Summary |
X |
X |
X |
How are these documents distributed? · Public documents - are delivered via email or made publicly available on this site. · NDA documents are emailed as password protected attachments within Adobe pdfs once a NDA has been confirmed as signed. This requires Adobe Reader 9.0 or later to access. · DRM documents are strictly controlled using digital rights management from Adobe LiveCycle manager and require Adobe Reader 9.0 or later to open. Typically they prevent copying of content and are viewable for a defined period of time to only those individuals who require them. What are the access requirements for these documents? All packages require appropriate NDAs between the organisation and AWS. Requests made by contractors conducting security assessments for accreditations on behalf of federal government agencies or SLEDs will also require written permission from a government security representative with authorisation to grant access. What additional documentation is available to me so that I can gain assurance of running Australian government workloads on AWS? See: AWS Risk and Compliance Whitepaper Amongst the certifications and reports that AWS maintains found on the compliance programs page and as an example of the extensive nature of the controls that AWS implements globally. It should also be noted that AWS has an Authority to Operate (ATO) under the United States government FedRAMP program where controls are derived from NIST800-53Rev4. These controls are extensive and publicly available and may provide additional confidence for the customer of the high level of assurance in running workloads on AWS. Additional reports that are available that evaluate and test controls implemented by AWS Infrastructure: - Service Organisation Controls 1 (SOC1) TypeII Report - Service Organisation Controls 2 (SOC2) TypeII Report o SOC2 Availability o SOC2 Security - Service Organisation Controls 3 (SOC3) - ISO 27001 Certificate & Statement of Applicability - PCI Attestation of Compliance and PCI Responsibility Summary - AWS Security Controls Summary To request access to AWS’ compliance documentation, please contact AWS Sales and Business Development or send an email to awscompliance@amazon.com. |
