Hosting Certification steps
1. Review the HCF Readiness Guide
Review the Hosting Certification Framework Readiness Guide on the For Service Providers page.
The HCF Readiness Guide outlines the requirements for achieving certification as a Service Provider. This guide provides a comprehensive summary of the certification requirements and what the Certifications team will be looking for during an assessment. By understanding the requirements in advance, Service Providers can prepare themselves before registering for certification.
2. Register Interest
Register your interest in becoming certified under the Hosting Certification Framework.
Next step – The Certifying Authority will confirm your registration and issue a Hosting Certification Assessment Pack to be completed.
3. What is in the Assessment Pack?
The Hosting Certification Assessment Pack includes:
- Deed of Certification
- Service Provider Declaration
- Non-Disclosure Agreement
- Control Objectives.
The Deed of Certification is an agreement made between the Certifying Authority and a Service Provider. It sets out the contractual terms and conditions to obtain Certification for the services a Service Provider wishes to offer to a government customer.
You will receive a copy of the Hosting Certification Assessment Pack after registration is complete. You must fill-in, sign and return all documents to firstname.lastname@example.org to progress to the formal assessment stage.
4. How does the formal assessment process work?
The formal assessment will be conducted by the Certifying Authority or an authorised assessment team and may take an average of 3 to 6 months to complete.
Applicants will receive an outcome notification via email once the assessment is complete.
Where an applicant and their nominated service(s) successfully meet all the requirements of the Hosting Certification Framework, a Certificate of Hosting Certification will be issued. The Certificate is an official document that demonstrates to government customers that a supplier’s service has been certified under the Hosting Certification Framework.
Certificates are accompanied with the corresponding unique Certification IDs for each nominated service that has achieved Certification. The Certification IDs assist a government customer to verify the service is certified and to what level (Assured or Strategic).
5. Outcome notification
Upon achieving Certification, the Certifying Authority will notify the applicant via email and issue a Certificate of Hosting Certification. The Certificate will include the corresponding unique Certification ID for each nominated service that achieved Certification.
The unique ID verifies that a Service Provider has undertaken the formal Certification Assessment and a specific service has been certified in accordance with the Hosting Certification Framework. Service Providers responding to Australian Government hosting-related procurement request(s) should include the applicable ID (Provisional ID or Certification ID) of the service(s) being sought.
Applicants who undergo the Full Certification Assessment process but are not successful in meeting the Hosting Certification Framework requirements to achieve a Certification status will be deemed Uncertified and notified via email.
Unsuccessful applicants will not be publicly announced.
6. Maintain Certification
To maintain HCF Certification, HCF Certified Service Providers are obliged to meet ongoing disclosure requirements, including:
- An Annual Declaration Form.
- A biannual Service Provider Contract Form outlining the contracts held with Australian Government entities for the supply of certified services.
- Reporting any potential or upcoming Relevant Change that may adversely affect the Commonwealth. A Relevant Change includes:
- a change in board, management team, personnel or subcontractors
- a change in strategic direction, ownership or operations
- a change in security measures or procedures
- a sale or disposal of Australian land
- any transfers, assignments or disposals of any lease or real-estate
- any other circumstance that may adversely affect security or operations.
HCF Certified Service Providers may also be subject to Conditional and Annual Certification Reviews by the Certifying Authority.