Data centre physical security · Australia
A data centre in Australia can answer to the PSPF, the ISM, SOCI and its customers' audits at once, and to the HCF if it hosts government data. One layered design, documented once and mapped to each regime, gives every assessor the same record. Each regime still tests it its own way, and the HCF also looks at who owns and controls the facility. We assess the facility, design the boundaries and prepare the evidence.
Current as of October 2026:PSPF Release 2026, ISM September 2026
Second route, from the site gate
Power · Cooling · Fuel · Meet-me room · Risers · Security control room
Illustrative plan, not a site design.
Which rules apply
The PSPF binds Commonwealth entities, and its Requirements 0084 and 0085 apply the ISM to them on a risk-based approach. Both reach a commercial operator through its government customers.
Find the row that describes your facility. A facility can sit in more than one row, so read every row that fits.
| Your situation | PSPF | ISM | HCF | SOCI CIRMP | ISO 27001 / SOC 2 / PCI DSS |
|---|---|---|---|---|---|
| Commonwealth entity, own facility | Binds you | Binds you | Does not apply | Does not apply | Does not apply |
| Commonwealth entity using a commercial facility | Binds you | Binds you | Use a certified provider1 | Does not apply | Does not apply |
| Operator hosting classified information or systems of government significance | Through your government customer | Through IRAP or contract2 | Through your government customer3 | Does not apply | Through your customers' audits |
| Operator whose asset is a critical data storage or processing asset (s 12F) | Reference model | Reference model | Does not apply | Binds you4 | Through your customers' audits |
| Operator holding an HCF Strategic certificate | Through your government customer | Through IRAP or contract | Binds you | Replaced by the s 30AQ report5 | Through your customers' audits |
| A critical infrastructure entity's own data centre holding business critical data | Reference model | Reference model | Does not apply | Binds you6 | Does not apply |
| Operator with private customers only | Reference model | Reference model | Does not apply | Does not apply7 | Through your customers' audits |
Does not apply: HCF, SOCI CIRMP, ISO 27001 / SOC 2 / PCI DSS
Does not apply: SOCI CIRMP, ISO 27001 / SOC 2 / PCI DSS
Does not apply: SOCI CIRMP
Does not apply: HCF
Does not apply: HCF, ISO 27001 / SOC 2 / PCI DSS
Does not apply: HCF, SOCI CIRMP7
Reference model: it does not bind you, but it gives you a public, documented model to design and test against.
PSPF Release 2026 Req 0111 has security classified information and systems of government significance hosted on a cloud or data centre service certified under the HCF or HCF 2. Req 0112 has non-corporate Commonwealth entities buy data centre space through the Data Centre Facilities Supplies Panel.
PSPF Req 0109 expects cloud providers to hold an IRAP assessment against the latest ISM from the previous 24 months. The ISM is not legally binding unless legislation or a direction requires it. The ISMIRAP
Home Affairs paused HCF registration for new providers on 3 November 2025. The PSPF says providers will be able to certify under HCF 2 from late 2026 or early 2027. The Hosting Certification Framework explained
The enhanced CIRMP rules (LIN 26/075, in force from 10 June 2026) list nine classes in s 4A(1), and critical data storage or processing assets are not one of them. An asset declared under s 51 after 10 June 2026 could still be brought in. The SOCI Act explainedSOCI readiness advisory
Under SOCI s 30AB(4), the CIRMP Part does not apply to an asset used to provide services covered by an HCF Strategic certificate the responsible entity holds; s 30AQ asks instead for an annual report within 90 days of the end of the financial year, approved by the board where there is one. The carve-out is for Strategic certificates only.
The CIRMP Rules take a critical infrastructure entity's own data storage system that meets SOCI s 9(7) to be part of that entity's asset, so the asset's own program covers it.
Private customers can still bring SOCI in. Under s 12F(2), if a customer is the responsible entity for a critical infrastructure asset and you know your asset is used wholly or primarily for a service relating to its business critical data, your asset is a critical data storage or processing asset.
When teams bring us in
Each one starts with a request from a customer, an auditor or a deadline. Here is what we do about each.
A government customer asks about Release 2026
Our government customer wants to know how we support PSPF Requirements 0111 and 0112.”
PSPF Release 2026 changed both requirements on 1 July 2026. Req 0111 covers where classified information and systems of government significance are hosted, and Req 0112 covers how non-corporate Commonwealth entities buy data centre space.
What we do
We map your facility and its evidence to what each requirement asks of your customer, so their security team gets a straight answer and you know where your evidence stands.
The HCF explainedA customer says your service holds business critical data
A customer has told us our service relates to their business critical data.”
Under SOCI s 12F(3), a responsible entity tells its data storage or processing provider when the service relates to business critical data. Whether that captures your asset turns on whether it is used wholly or primarily for that service.
What we do
We work through the test with you and your lawyers against how the facility is actually used. If the asset is captured, we build the physical security part of your CIRMP and the evidence behind it.
SOCI physical security for data centresGetting ready for HCF 2
HCF registration is paused and we want to be ready when HCF 2 opens.”
Home Affairs paused registration for new providers on 3 November 2025 while it reforms the framework. The PSPF says providers will be able to certify under HCF 2 from late 2026 or early 2027.
What we do
We assess physical access security, one of the core capabilities the current HCF ties to ownership and control, and keep the evidence current so the application is not where the work starts.
The HCF explainedA tenant's auditor asks about your access list
Our tenant's SOC 2 auditor wants evidence that they review who can enter our facility.”
SOC 2 CC6.4 restricts physical access to facilities such as data centres, and its points of focus cover creating, modifying, removing and reviewing that access. The tenant owns the review. The access list lives in your systems.
What we do
We set up a review your tenants can run and evidence: who holds access to their space, the tenant's sign-off, and every change recorded in your access control system.
A zone is due for certification again
One of our security zones is due for certification again.”
PSPF s 24.2.3 makes certification time-limited: recertification follows expiry, a change in business impact level, significant changes to the architecture or controls, or conditions the Accreditation Authority sets. Table 40 also expects electronic access control to run current patches with no obsolete components.
What we do
We check the zone against its certified state, find what has drifted, and prepare the evidence for the Certification Authority the PSPF names.
PSPF security zones explainedEvery request lands on the same facility.
We document it once and map the record to each regime that asks.
One layered design
The PSPF tells you to build all five layers of physical security (s 23.2). CIRMP s 11(1)(e) makes you prove all five by test.
Respond and recover are organisational capabilities, not properties of a fence or a rack.
What CIRMP section 11 requires of a data centreBuilt into the facility
Run by your organisation
What we assess
We walk the facility from the site perimeter to the plant room. Each area is checked once and mapped to the clauses that ask for it, so one walk answers every regime.
| Area and what we check | PSPF / ISM | CIRMP s 11 | ISO 27001 A.7 | SOC 2 |
|---|---|---|---|---|
| Site and perimeterWhere the site sits, its standoff, site access and parking, and the perimeter line. | PSPF Req 0191, Table 36 | s 11(1)(b) | A.7.1 | CC6.4 |
| Entry, visitors and critical workersWho may enter, how visitors are escorted, and who counts as a critical worker. | PSPF Table 38 | s 11(1)(d) | A.7.2 | CC6.4 |
| Data halls and zonesWhich Security Zone each hall needs, set by the aggregated classification it holds, and the containers that go with it. | PSPF Req 0094, Table 22 · ISM-0810, ISM-1053 | s 11(1)(a) | A.7.3, A.7.6 | CC6.4 |
| Cage, rack and containersCage and rack locks, and the container class the zone and the classification call for. | PSPF Table 22 · ISM-1530, ISM-0813 | s 11(1)(d) | A.7.8 | CC6.4 |
| Keys and credentialsHow keys, cards and codes are issued, changed, removed and reviewed. | ISM-1074 | s 11(1)(d) | A.7.2 | CC6.4 |
| Monitoring and alarmsAlarm class and who certifies it, monitoring coverage, and that no unauthorised person can observe systems or screens. | PSPF s 25.6, Table 40 · ISM-0164 | s 11(1)(c), (1)(e) | A.7.4 | CC6.4 |
| Plant and pathwaysPower, cooling, fuel, the meet-me room, risers and cabling: the plant the HCF treats as core infrastructure. | ISM-0813, ISM-1296 | s 11(1)(a), (1)(b) | A.7.11, A.7.12 | A1.2 |
| Natural hazards and environmentFire, flood, heatwave and the other natural hazards the site faces, and the protections against each. | PSPF Table 36 | s 11(1)(b) | A.7.5 | A1.2 |
| Equipment and media lifecycleEquipment and media secured when not in use, maintenance access, and disposal that leaves nothing recoverable. | ISM-0161 | No matching clause | A.7.10, A.7.13, A.7.14 | CC6.5 |
| Response and testingWho answers an alarm, and a test that the arrangements can detect, delay, deter, respond and recover. | PSPF s 23.2 | s 11(1)(c), (1)(e) | No matching clause | No matching clause |
| Security systems maintenanceAccess control on current patches with no obsolete components, and alarms serviced by an authorised provider. | PSPF Table 40, s 25.6 | No matching clause | A.7.13 | No matching clause |
For every check behind these areas, with the evidence to ask for and the reference in each standard, use our item-level data centre physical security audit checklist.
Standards in scope
Availability ratings and security standards are often quoted side by side. Here is what each one says it covers on security, in its current edition.
| Standard | Current edition | What it covers on security |
|---|---|---|
| TIA-942 | TIA-942-C, May 2024 | Physical security is one of its subsystems, alongside architecture, telecommunications, power, cooling, fire protection, safety and monitoring. Ratings run from Rated-1 to Rated-4. |
| EN 50600 and ISO/IEC 22237 | EN 50600-2-5:2021 · ISO/IEC 22237-6:2024 | These are the security parts of each series. ISO/IEC 22237-6 covers unauthorised access, intrusion, internal fire, and internal and external environmental events. |
| Uptime Institute Tiers | Tier Certification | Uptime says its topology and operational sustainability standards do not cover security. Tier Certification is an availability and resilience classification, though its evaluation does look at physical security. |
| ISO/IEC 27001 | ISO/IEC 27001:2022 (AS/NZS ISO/IEC 27001:2023 in Australia) | Annex A holds 14 physical controls, A.7.1 to A.7.14, from perimeters and physical entry to supporting utilities, cabling and secure disposal. ISO 27001 explained |
| SOC 2 | 2017 Trust Services Criteria | CC6.4 restricts physical access to facilities such as data centres to authorised personnel. Its points of focus cover creating, modifying, removing and reviewing access, and points of focus are not mandatory. SOC 2 explained |
| PCI DSS | PCI DSS v4.0.1 | Requirement 9 covers restricting physical access to cardholder data. PCI DSS explained |
How the work runs
Data centre work runs on the same four tracks as the rest of the practice. Each stage ends on a decision that stays yours: carry on with us, take it in-house, or stop where you are.
We confirm which regimes reach your facility, walk the five boundaries and the plant, and rank the gaps with the evidence behind each one.
We design the boundaries and zone layout with the Commonwealth entity, as input to its facility security plan under Req 0190. Where construction must follow the ASIO Technical Notes, we design with the SCEC-endorsed consultant or adviser who works from them.
We fix access control, monitoring and alarms alongside your facilities team and installers. For Type 1A alarm work, we scope in a SCEC-endorsed Security Zone consultant.
We watch for the changes that trigger recertification, prepare the evidence for the CIRMP annual report or the s 30AQ report, and run the access reviews your tenants' auditors ask for.
Certification and accreditation
PSPF Release 2026 keeps the two steps apart: certification confirms the controls, and accreditation accepts the residual risk before operational use (Req 0198).
| Facility, control or regime | Who certifies | Who accredits |
|---|---|---|
| PSPF Security Zones and their controls | ||
| Zones One to FourReq 0196, 0198 · Tables 40, 41 | The entity's Chief Security Officer, or a delegated security practitioner | Chief Security Officer or delegate |
| Zone Five holding TOP SECRET or aggregated information with a catastrophic business impactReq 0197, 0198 | ASIO-T4 | Chief Security Officer or delegate |
| Outsourced facility housing assets with a catastrophic business impactReq 0096 | ASIO-T4 | ASD |
| Sensitive Compartmented Information Facility (SCIF)Req 0199 | Accredited by ASD under the National SCIF Accreditation Program before operational use | |
| SCEC-approved Type 1A alarm, Zones Four and FiveTable 40 | A SCEC-endorsed Security Zone consultant | Counts towards the zone's accreditation |
| Commercial alarm (Zones One to Three) and electronic access control (all zones)Table 40 | A suitably qualified installer or designer | Counts towards the zone's accreditation |
| Other regimes: who signs off | ||
| HCF certification | Home Affairs, which administers the HCF. Registration has been paused since 3 November 2025. | |
| IRAP assessmentReq 0109 | An ASD-endorsed IRAP assessor, against the latest ISM; for cloud providers, within the previous 24 months | |
| SOCI CIRMP | No certifier. Your board, where you have one, approves the annual report | |
| ISO/IEC 27001:2022 | An accredited certification body | |
| SOC 2 | A CPA firm, which attests in a SOC 2 report | |
| PCI DSS v4.0.1 | A Qualified Security Assessor, or a self-assessment | |
| Uptime Tier | Uptime Institute, as an availability and resilience classification | |
| TIA-942 | Usually a certification body licensed by TIA, rather than TIA itself | |
Accredited by ASD under the National SCIF Accreditation Program before operational use
Home Affairs, which administers the HCF. Registration has been paused since 3 November 2025.
An ASD-endorsed IRAP assessor, against the latest ISM; for cloud providers, within the previous 24 months
No certifier. Your board, where you have one, approves the annual report
An accredited certification body
A CPA firm, which attests in a SOC 2 report
A Qualified Security Assessor, or a self-assessment
Uptime Institute, as an availability and resilience classification
Usually a certification body licensed by TIA, rather than TIA itself
Certification stays with the authority each regime names, so the design and the certificate always come from different hands.
For Zone Five areas and SCIFs, we prepare the facility around them and the evidence your cleared staff present.
PSPF security zones explainedGuides
Each guide takes one part of this page further, with the clauses quoted and the dates stated.
Zones One to Five in PSPF Release 2026, which zone PROTECTED information needs, and who certifies and accredits each.
Read the guideStrategic, Assured and Uncertified, the registration pause since 3 November 2025, and what PSPF Req 0111 and 0112 ask.
Read the guideWhen s 12F captures a data centre, the duties in s 11, and the routes by which the June 2026 enhanced rules can reach one.
Read the postEvery check, grouped by the five boundaries and the plant, with the evidence to ask for. Printable, with no sign-up.
Read the postFAQ
The questions operators and agency security teams bring to a first conversation.
Tell us what the facility hosts, who its customers are, and which certificate, report or audit comes next. We scope the work in writing before anyone walks the site.