Hosting Certification Framework, Draft July 2025 ​

Written by Claude Haiku 4.5 from the extracted text on 28 Feb 2026. It can miss or misread redacted and scanned pages. Check the source before relying on it.

The Hosting Certification Framework (HCF) is a standardised security and risk management framework developed by the Department of Home Affairs to certify data centre providers (DCPs) and cloud service providers (CSPs) handling security-classified government information. The framework applies to Non-corporate Commonwealth Entities (NCEs) and Systems of Governance Significance (SoGS), establishing consistent compliance requirements for hosting services storing, processing, and communicating classified data. The HCF addresses supply chain and ownership risks, mitigates digital infrastructure vulnerabilities, and reinforces safeguarding of classified information. The framework outlines certification roles, application processes, continuous monitoring obligations, compliance enforcement, and non-compliance sanctions. It aligns with related governance frameworks including the Protective Security Policy Framework, Security of Critical Infrastructure Act, Information Security Manual, and Foreign Investment Review Board requirements.