What is the Hosting Certification Framework (HCF)?

HCF registration has been paused since 3 November 2025. No new provider can apply, and certified providers cannot seek a supplementary assessment, until Home Affairs finishes reforming the framework. The PSPF expects HCF 2 to open for certification "from late 2026 or early 2027", and PSPF Release 2026 rewrote the two requirements that send government customers to certified providers. The facts below come from the HCF site as read on 11 October 2026, the March 2021 framework document the site still links, PSPF Release 2026 and the SOCI Act as compiled on 4 June 2026.

Two errors recur in older pages about the HCF. The first is ownership: several still say the Digital Transformation Agency (DTA) runs the HCF, but Home Affairs has administered it since 1 May 2023. The second is scope. The HCF is not a technical security standard like the ISM. It certifies who owns and controls a provider's facilities and supply chain, and it reaches physical security through that door.

Four terms carry the rest. Strategic and Assured are the two certified levels. A Relevant Change is an event, such as a new security manager or a sale of the land, that a certified provider must clear with the government before it happens. Core capabilities are the five things a provider must own or control, and physical access security is one of them.

Why the Hosting Certification Framework matters

The HCF exists to put the Whole-of-Government Hosting Strategy, released in March 2019, into effect, in particular its requirement that "all data must be hosted with the appropriate level of privacy, sovereignty, and security controls". The March 2021 framework says it will help agencies mitigate supply chain and data centre ownership risks. The HCF site lists the benefits as compliance with data sovereignty, ownership structure, liability, supply chain and transparency arrangements, lower risk from ownership and supply chain change, and certainty about the hosting environment for both industry and entities.

It reaches a data centre in three ways.

The government customer is the first route. PSPF Release 2026 requires security classified information and systems of government significance to be hosted on a cloud or data centre service certified under the HCF or HCF 2 (Requirement 0111), and it requires non-corporate Commonwealth entities to use the Data Centre Facilities Supplies Panel when they buy data centre space (Requirement 0112). Both requirements carry the date 1 July 2026, and the Summary of Changes confirms Release 2026 changed both.

The contract is the second. HCF requirements apply to new contracts and extensions to existing contracts from 30 June 2022. Extensions with a provider still awaiting certification are capped at one year, with the option of one more, and an entity can ask Home Affairs for an exemption while certification is pending.

The SOCI Act is the third, and it only works one way. If a data centre is a critical data storage or processing asset, an HCF Strategic certificate replaces the risk management program with an annual report for the services it covers. No other HCF outcome changes a SOCI duty.

For a physical security team, the framework matters because it treats physical access as something the provider must control, not something it can hand to whoever offers the lowest price. Physical access security is a core capability. A change to the facility's security measures that lowers its level of security is a Relevant Change. And the supply chain the framework assesses includes security personnel and the providers of access control and monitoring systems.

How the Hosting Certification Framework works, step by step

The framework assesses a provider once, binds it with contract clauses, and then watches for change. Read the 2021 document for what is assessed; it was written when the DTA ran the framework, so read the HCF site for who administers it today.

What the framework certifies

The 2021 framework describes the service a hosting provider sells to government as "space in data centre facilities divided into segregated and secured data halls, including physical access security to this space", together with the core infrastructure that keeps the environment running: generators, electrical power, and climate control through cooling and ventilation. It notes that hosting providers typically reach tenants' equipment, the cabinets and racks, only in emergencies, and do not know the type and sensitivity of the data hosted. Where a systems integrator, managed service provider or cloud provider hosts government data, it does know, so the framework adds risk mitigations and certifies each data centre facility arrangement the provider uses.

What is assessed splits into two lists. Core capabilities must sit under the provider's ownership and control, or under owners who agree to the provisions. Supply chain capabilities are assessed for security and risk instead.

The three levels

The HCF site describes three outcomes. Strategic "represents the highest level of assurance and is only available to Service Providers that allow the government to specify ownership and control conditions", and a Strategic provider includes increased security controls. Assured "provides safeguards against change of ownership or control through financial penalties", aimed at minimising the Commonwealth's cost of moving out if a provider changes its profile. Uncertified "offers minimal protections to government".

Which level a customer needs depends on its risk profile, the classification and sensitivity of its data, and its own risk assessment. The site's guidance is that customers with a high-risk profile, or seeking extra protection, may require Strategic; customers with a low-risk profile and sensitive data that does not need additional protection may use Assured; and an uncertified provider can host non-sensitive data, or data the customer's risk assessment finds appropriate. The 2021 framework adds that a higher level does not guarantee a contract and a lower one does not preclude it.

Relevant Change: what keeps a certificate

Certification is not a one-off. The 2021 framework calls continuous disclosure of relevant change "a key principle underpinning a provider's ability to maintain their certification", and both levels must seek the agency's approval before any Relevant Change occurs. Strategic providers also agree to keep the government fully informed of events that may lead to one, to periodic reviews of supply chain risk controls, and to clauses that list no changes to the security measures and procedures.

Two of the five items are physical security events in plain terms. Replacing the data centre security manager or a guard subcontractor falls under the first. Changing the facility's security measures in a way that lowers its level of security falls under the fourth.

Where the PSPF points to the framework

PSPF Release 2026 describes the HCF in s 15.2.1 as policy guidance that "outlines controls to assess and certify the access to information and data, supply chain of processed, stored or communicated information and data, and ownership and control of services providers". The same section says cloud or data centre services used to host OFFICIAL: Sensitive or PROTECTED systems and information are HCF certified, that entities may use an uncertified provider for UNOFFICIAL and OFFICIAL information, and that cloud hosting of SECRET or TOP SECRET information is only through community or private clouds in line with the ISM.

The requirements and the HCF site's own scope statement are worth reading side by side, because they do not use the same words.

The PSPF binds the entity, so Requirement 0111's wording, "security classified or systems of government significance information and data", is the one an entity's auditor tests. The HCF site's sentence describes the framework's reach. Section 15.2.3 adds the reason ownership matters at all: a foreign-owned provider may be subject to extrajudicial control, and the entity's assessment should consider the provider's locality, ownership, control and where support is provided from. It points to ASIO's Protective Security Circular 149, "Physical security certification of outsourced ICT facilities", which sits on GovTEAMS.

Facility and Enclave on the certified list

The certified provider list labels data centre entries as "Certified Strategic Facility" or "Certified Strategic Enclave". Treat the two words as list labels. The framework text read for this guide does not define them, so when a provider shows you either, ask which facility, which part of it, and which services the certificate covers.

The SOCI switch for Strategic certificates

The SOCI Act's risk management program, the CIRMP, applies to critical data storage or processing assets. Section 30AB(4) carves out one case: the CIRMP Part does not apply to an asset used to provide services covered by an HCF Strategic certificate held by the responsible entity. Section 30AQ then asks for an annual report within 90 days after the end of the financial year, approved by the board where there is one.

The switch covers the services the certificate covers, not the operator. A facility outside the certificate, or services the certificate does not cover, stay under the CIRMP, including its physical security rule, CIRMP Rules s 11. The SOCI physical security post covers what that rule asks.

Gaining and keeping certification, as the 2021 framework sets it out

Registration is paused, so these steps describe what the framework asks rather than a process anyone can start this month.

The 2021 document defines key personnel as supply chain personnel with an access pass to technical areas and areas with plant critical to the data centre's operation, such as cleaners, security personnel, technicians and maintenance personnel. For a physical security team, that is the population whose vetting the Strategic level checks.

HCF 2 and the registration pause

Home Affairs states the pause in one sentence on the HCF site's home and framework pages: it "will pause the HCF Certification registration of prospective service providers and HCF Certified providers seeking supplementary assessment effective from 3 November 2025 until HCF reforms have been completed". It adds that certified providers will not be affected, so their certificates still serve government customers under Requirement 0111.

The PSPF gives the only published timing for what comes next. Section 15.2.1 says the framework "is undergoing reforms to enhance risk mitigations and strengthen the Commonwealth's data security across the infrastructure, platform and software layers", and that "from late 2026 or early 2027, service providers will be able to gain certification for hosting services under the new policy, Hosting Certification Framework 2". Requirement 0111 already names both frameworks, so a service certified under either meets it.

No HCF 2 criteria have been published. Until they are, a provider preparing for it can keep the records the current framework already asks for: the ownership and control map, the supply chain list, the vetting records for key personnel, and the evidence that physical access to each data hall is controlled. That work carries over whatever the new criteria say, because Requirement 0111 and the SOCI carve-out in s 30AB(4) both turn on certification, and certification turns on that record.

A worked example: one operator, two facilities, one year of change

Ridgeline Data Centres is an Australian colocation operator with two facilities. CBR1 in Canberra hosts PROTECTED systems for three Commonwealth entities and holds a Certified Strategic Facility listing. SYD2 in Sydney serves banks and a state government agency and was never put forward for certification. The name and the figures are fictional; the framework, the PSPF and the SOCI Act are not.

Two facilities, two sets of duties. The government customers at CBR1 bring the PSPF with them. Kingfisher Records Agency, whose own data hall the PSPF security zones guide follows, bought its disaster recovery space at CBR1 through the Data Centre Facilities Supplies Panel because Requirement 0112 tells it to, and chose a certified facility because Requirement 0111 does. SYD2's customers bring their own audits instead.

The SOCI question. Ridgeline's board asked in July 2026 whether either facility is a critical data storage or processing asset. Its lawyers flagged the open question first: whether selling space, power and cooling, with the tenant running its own equipment, is a "data storage or processing service" in the Act's sense. On the assumption that a customer's s 12F(3) notice could bring a facility in, CBR1's certified services would fall under s 30AB(4) and the s 30AQ report, while SYD2 would carry the full CIRMP, including the physical security rule in s 11. Ridgeline now keeps one physical security record for both, so the answer changes only which report it writes.

A year of Relevant Change. Four events at CBR1 in 2026 were tested against the five kinds of Relevant Change.

The third event is the one most operators would get wrong. A newer, supported access control head-end improves security, and item iv only covers changes that decrease it. But the Strategic outline clauses also list no changes to the security measures and procedures, so Ridgeline treated the upgrade as needing approval and sent the commissioning report with the request. The approval took eleven days and the cutover went ahead in July.

Preparing for HCF 2. SYD2's largest bank customer asked in September whether Ridgeline would certify SYD2 under HCF 2. Ridgeline cannot register while the pause holds, so it began the groundwork the current framework already asks for: an ownership map for the SYD2 land and building, the supply chain list for guarding, maintenance and the access control vendor, and the access records for each data hall.

Common mistakes

Most errors come from stale pages and from treating the HCF as a security control standard.

1. Naming the DTA as the owner. Home Affairs has administered the HCF since 1 May 2023. Correct your own documents and tender responses.
2. Planning a certification this quarter. Registration has been paused since 3 November 2025. Build the record now and apply when registration reopens.
3. Treating HCF certification as a physical security certificate. It certifies ownership, control and supply chain, with physical access security as one core capability. The zones the PSPF sets, and their certification, are a separate question for the government customer.
4. Treating IRAP and the HCF as the same check. Requirement 0109 asks for an IRAP assessment of cloud providers; Requirement 0111 asks for HCF certification. Track both.
5. Assuming any certificate takes a facility out of the SOCI CIRMP. Only a Strategic certificate does, only for the services it covers, and the s 30AQ report replaces the program.
6. Missing Relevant Changes in the security team. A new security manager, a new guard subcontractor or a reduction in security measures can each be a Relevant Change. Put them on the same log as ownership changes.
7. Quoting HCF 2 dates beyond the PSPF's. The PSPF says late 2026 or early 2027. Anything more specific is not published.
8. Reading "Facility" and "Enclave" as defined certification types. They are labels on the certified list. Ask what each certificate covers.

The HCF compared with its neighbours

The HCF sits among requirements that each test a different thing. Sorted by what each one certifies or assesses, they stop competing.

The PSPF security zones guide, the IRAP page and the ISO 27001 page cover three of those rows in their own right.

Standards and references

Hosting Certification Framework site (read 11 October 2026). The home page carries the pause notice, the scope sentence and the 1 May 2023 machinery-of-government change; the Framework overview page carries the three levels, who the framework applies to and the 30 June 2022 implementation date.

Hosting Certification Framework, March 2021, version 2. The framework document the site links. Read the Framework Scope section for hosting services and core capabilities (Tables 1 and 2), the Certification Overview for the levels and what each asks, Maintaining Certification for Relevant Change, and the Appendix for the clause outlines. It was written when the DTA administered the framework.

HCF certified service providers list. The live list, with data centre entries labelled Certified Strategic Facility or Certified Strategic Enclave. Re-check it before naming a provider as certified.

PSPF Release 2026, s 15.2. Requirements 0109, 0110, 0111 and 0112, the HCF 2 timing in s 15.2.1, the panel in s 15.2.2, and foreign ownership in s 15.2.3. The Summary of Changes confirms Requirements 0111 and 0112 changed in this release.

SOCI Act, compilation C2026C00213 (4 June 2026). Section 12F for critical data storage or processing assets, s 30AB(4) for the Strategic certificate carve-out, and s 30AQ for the annual report that replaces the program.

ASIO Protective Security Circular 149, Physical security certification of outsourced ICT facilities. Cited by the PSPF and held on GovTEAMS.

How Alvor helps

With Alvor, a provider keeps the record certification and Relevant Change disclosure depend on, so the answer to a government customer's question is already written down.

You can add any framework in Alvor. The HCF's clause outlines, the PSPF requirements a customer passes down and the SOCI CIRMP Rules can each go into Compliance through the framework builder in their own wording, with owners and evidence against each requirement, and ISO 27001:2022 installs from the framework library. Evidence is uploaded or linked once, carries a valid-until date, and is reused across the controls it supports, so a vetting record or an access review serves every framework that asks for it.

The supply chain the framework assesses runs through Third-Party Risk Management. A requester's intake gets a tier from a fixed scoring rule, the vendor answers one questionnaire in the external portal, an analyst scores it, findings carry deadlines, and a named person decides on the residual risk. That is where the guard subcontractor, the maintenance contractor and the access control vendor sit. Asset Management records each asset's upstream and downstream dependencies and its end-of-life and end-of-support dates, so the power, cooling and access control systems behind a data hall sit on one map. Risks are scored on likelihood and impact in Risk Management, and history is hash-chained, so the dates on disclosures and approvals stand up later.

Alvor runs as a dedicated single-tenant instance in the Sydney region (ap-southeast-2), on your own servers, or air-gapped, and the AI Assistant is bring-your-own-model, including self-hosted models.

For the facility, Alvor Advisory's data centre physical security work assesses a facility against the PSPF, the ISM, SOCI and customers' audits, designs the boundaries and prepares the evidence a certifier or assessor reads. Certification stays with Home Affairs. For the SOCI program, Alvor Advisory's SOCI readiness review confirms which assets are captured and which obligations attach.