Australian Signals Directorate (ASD) closes Cloud Services Certification Program (CSCP)

%asset_thumbnail_alt

Following an independent review, the Australian Government’s Australian Signals Directorate (ASD) has decided to close its Cloud Services Certification Program (CSCP) on and from 2 March 2020.

All existing certifications will remain valid until 30 June 2020, after which the ASD certifications will be void.

It is common for agencies procuring cloud services under the Queensland Information Technology Contracting (QITC) Framework to require suppliers to obtain and maintain ASD certification as one of the agency’s minimum requirements.  In particular, suppliers responsible for hosting, storing or processing extremely sensitive information were required to be certified by the ASD at the ‘protected’ classification level.

Agencies will continue to be responsible for undertaking appropriate due diligence and a comprehensive risk assessment prior to procuring cloud services.  There are a significant number of resources available to agencies to assist in undertaking a risk assessment.  Agencies should also ensure that they review and, where applicable, comply with the suite of Queensland Government ICT-as-a-service policies and guidelines.

The ASD has also developed a number of guides, including the Cloud Computing Security Considerations, which may be of assistance to agencies.

If you have any questions about procuring cloud services, whether under the QITC Framework or utilising the supplier’s terms and conditions, Crown Law can help.