GCP cleared to host Unclassified data

The Australian Cyber Security Centre (ACSC) has added Google Cloud Platform to the Certified Cloud Services List (CCSL) for Unclassified workloads.

A total of 16 GCP services and a physical Google Cloud data centre in Sydney have achieved the certification, clearing them for use by Australian government agencies.

The ACSC has concluded that Google Cloud Platform meets the stringent principles and polices defined in the Protective Security Policy Framework (PSPF) and Information Security Manual (ISM).

The certified services span categories comprising compute, storage, networking, security, management, data analytics and databases, and include Google’s Compute Engine, Cloud Storage and Virtual Private Cloud services.

According to ACSC Head Alastair MacGibbon, Google only sought certification for hosting data up to the Unclassified level, and was therefore only assessed for this purpose.

“Protecting Australians from cyber threats is one of our greatest national security challenges. It’s important that we have rigorous standards for the management of our information,” MacGibbon said.

“If an agency’s security and risk needs can be met with a cloud certified to Unclassified DLM, this increases their choices in meeting their business objectives.”

The ACSC has meanwhile moved to correct the record regarding inaccurate reporting suggesting that third-party services built on ACSC certified cloud services automatically inherit this ACSC certification.

“The ACSC does not assess third-party solutions and therefore cannot confirm if their security meets Australian Government standards,” MacGibbon said.

He recommended that organisations considering third-party solutions built on certified cloud services conduct their own independent security assessment, certification and accreditation activities.

Image credit: ©stock.adobe.com/au/Melpomene

Please follow us and share on Twitter and Facebook. You can also subscribe for FREE to our weekly newsletter and quarterly magazine.