Search

Cyber and security

2.53 A range of cyber security and related legislation, policies and frameworks are applicable to the SSA ecosystem, and government procurement and contracting more generally. As the technology and cyber security sector continues to rapidly evolve and responds to new and emerging threats and vulnerabilities, the Australian Government and sellers must continually adapt.

2.54 The SSAs generally support these legislative and policy settings by facilitating buyers’ alignment with the requirements through head agreements and underlying contracts, and through enabling government agencies to meet the requirements, for example through providing products that are or can be assessed against the Information Security Manual (ISM) requirements.

2.55 However, the SSAs generally contain lower levels of base protections specific to cloud services contracts. The SSAs offer opportunities to include improved protections in contracts, but these need to be negotiated with the sellers. Therefore, when considering the cyber and security legislative and policy ecosystem, there remains opportunities for the government to introduce greater consistency in representing cyber and security requirements. The SSA terms and conditions related to cyber and security are represented in various forms and structures throughout the SSA head agreements, with varying levels of detail and various references to specific legislation and policy.

Protective Security Policy Framework (PSPF) and Information Security Manual (ISM)

2.56 Central to the Australian Government cyber security policy landscape is the PSPF which, across six security domains, prescribes what applicable government entities must do to protect their people, information and resources, both domestically and internationally. The relevance to SSAs is evident through this PSPF statement:

"Non-government organisations and third-party service providers may be required to implement aspects or parts of the PSPF. This will be detailed in relevant deeds or agreements between the Australian Government and the non-government organisations or third-party service providers."

2.57 SSA head agreements contain provisions related to compliance with the PSPF and ISM requirements. In some cases, the responsibility for including these provisions in contracts between government agencies and SSA sellers is devolved to the buyer. The is represented in various ways, for example:

• Compliance with the requirements of the PSPF, ISM and Privacy Act (either in accordance with the head agreement, or as specified in a contract with a government entity).
• Compliance with other specified security requirements.
• Developing a Commonwealth Data Protection Plan for Customer Data, which must be consistent with the requirements of the Privacy Act 1998, PSPF and ISM requirements.

2.58 While devolving responsibility is considered appropriate, as it allows agencies to consider their risk context in negotiating these terms, this introduces challenges relating to:

• Consistency in the application of the minimum PSPF and ISM requirements and standardisation of the terms and conditions.
• Ensuring the contract adequately covers security requirements specific to an agency.
• Maintaining relevant expertise within procurement and contract management teams to ensure the provisions are appropriate in the context of the agency.

2.59 The SSAs also generally reference seller or other security standards. While alternative or additional standards may be appropriate, agencies must have the capability to assess these alternative standards and be aware of their obligations to report compliance with these standards in their protective security reporting. This approach risks introducing inconsistencies in the application of Australian Government cyber security standards.

2.60 While the SSAs contain general provisions relating to cyber security, stakeholders identified the need to establish a minimum or standardised set of cyber and security clauses for inclusion in SSAs that cannot be overridden. Consultation with the Department of Home Affairs (Home Affairs) and ASD will be essential to identify and define these requirements. 

2.61 Further, stakeholders identified the need to define digital and data sovereignty and localisation requirements as they relate to critical products and capabilities in the technology sector. Once agreed, there is an opportunity for the Australian Government to undertake analysis of the types of capabilities and data that warrant being subject to sovereignty requirements.

2.62 To achieve the above, Home Affairs, ASD and the DTA together should:

• Establish the minimum set of cyber and security clauses within SSAs which cannot be overridden by seller terms when a buyer enters a contract.
• Define data and digital sovereignty, with consideration of localisation requirements and existing policy (e.g. the Hosting Certification Framework).
• Undertake an assessment of the existing Australian Government technology landscape (the Digital Investment Plans could be used to support this activity) to identify the specific technology and capability that should be subject to data and digital sovereignty requirements.
• Determine the appropriate mechanism to enforce the requirements (e.g. Protective Security Policy Framework directives).

2.63 The approach to implementing additional provisions in SSAs will require consideration due to the additional requirements this will place on both buyers and sellers. For example, to reduce the burden, the following could be considered:

• Head agreements with SSA sellers could include specific provisions for digital and data sovereignty related to the capabilities they provide, enabling the buyer to include any additional requirements in their contracts by exception.
• PSPF Directives could require Accountable Authorities to implement measures to achieve compliance with digital and data sovereignty, placing the onus on buyers to negotiate and manage these requirements with SSA sellers.

Secure Cloud

2.64 Section 15 of the PSPF includes direction on cyber security programs, including:

• The Secure Cloud Strategy that emphasises the advantages to be gained from moving from on-premises, owned and operated infrastructure to cloud computing, while recognising the challenges in adoption including lack of knowledge, outdated operating models, and difficulties in gaining business support for the transition.
• To assist with adopting secure cloud (as described by the Secure Cloud Strategy), agencies are required to use Cloud Service Providers that have completed an Infosec Registered Assessors Program (IRAP) assessment for their cloud services. The sellers with an SSA offering cloud-based services support this requirement with a range of cloud-based services having undergone IRAP assessment that can be consumed by government entities.
• Due to the evolving nature of the products and services offered under the SSA arrangements, it is imperative that agencies maintain awareness of which specific products and services are IRAP assessed when establishing arrangements with the SSA sellers and ensuring that emerging products are assessed on an as required basis.
• The Hosting Certification Framework (HCF) assists the Australian Government agencies to identify and source hosting services aligned to their risk profile, classification and sensitivity of their data, and internal risk assessment. The HCF applies to Data Centre Providers and Cloud Service Providers, and enables certification at three levels: In collaboration with the SSA sellers, the DTA could maintain a centralised list for reference by buyers.
  • Strategic: represents the highest level of assurance and is only available to Service Providers that allow government to specify ownership and control conditions. A Certified Strategic Service Provider offers additional protections to government compared with a Certified Assured Service Provider. These include increased security controls. Due to these additional protections, government customers with a high-risk profile or those seeking additional protections for their data may require the services of a Certified Strategic Service Provider.
  • Assured: provides safeguards against change of ownership or control through financial penalties that are aimed at minimising the transition costs borne by the Commonwealth if a Service Provider alters their profile. Government customers with a low-risk profile and sensitive data, which has been deemed by the government customer to not need additional security protections, may seek the services of a Certified Assured Service Provider.
  • Uncertified: offers minimal protections to government. Government customers may use the services of an Uncertified Service Provider to host non-sensitive data or where their internal risk assessment determines it appropriate to do so.
• The SSAs support the intent of the HCF through various means:
  • Several SSA sellers provide certified cloud services, including Certified Strategic.
  • SSA sellers provide solutions that leverage certified cloud services.
  • SSA sellers provide solutions that do not require the use of certified cloud services, for example, a SaaS product hosted in a non-certified data centre where the use case involves non-sensitive data and acceptance through a risk assessment.

2.65 For both IRAP assessed and HCF certified cloud services, government entities must maintain awareness and visibility of the scope and currency of the assessments. This is particularly important as only a subset of the offerings (within the broad ecosystem of products and solutions) from the SSA sellers (and sellers more generally) are IRAP assessed or HCF certified.

Cyber Security Act 2024 (Cyber Security Act)

2.66 The Cyber Security Act includes measures to: 

• Mandate minimum cyber security standards for smart devices.
• Introduce a mandatory ransomware and cyber extortion reporting obligation for certain businesses to report ransom payments.
• Introduce a Limited Use obligation for the National Cyber Security Coordinator to encourage industry engagement with the government following cyber incidents.
• Establish a Cyber Incident Review Board to conduct reviews of significant cyber incidents and share lessons learned.

2.67 Legislation, in the form of Rules, supports the measures under the Cyber Security Act. The initial rules took effect on 30 May 2025 (Ransomware Payment Reporting Rules and the Cyber Incident Review Board Rules) and further rules will come into effect 4 March 2026 (Security Standards for Smart Devices Rules).

2.68 The Cyber Security Act and Rules are applicable to the SSA sellers where they meet the definition of a ‘reporting business entity’. The review identified that the head agreements do not reference the Cyber Security Act, largely attributable to the Act coming into effect in late 2024.

Security of Critical Infrastructure Act 2018 (SOCI Act)

2.69 The SOCI Act establishes the legal obligations for entities that own, operate, or have direct interests in critical infrastructure assets. The 2023 Critical Infrastructure Resilience Strategy defines critical infrastructure as:

those physical facilities, supply chains, information technologies and communication networks, which if destroyed, degraded or rendered unavailable for an extended period, would significantly impact the social or economic wellbeing of the nation, or affect Australia’s ability to conduct national defence and ensure national security.

2.70 The SOCI Act defines each class of critical infrastructure asset and applies to SSA sellers where they meet the definition of a “responsible entity” in the SOCI Act.

2.71 The review notes that while the above arrangements are positive, the head agreements with the SSA sellers inconsistently reference or include provisions specific to the SOCI Act. For example, head agreements contain:

• Consultation provisions relevant to the SOCI Act.
• Clauses specific to incident reporting.
• In some cases, no specific reference to the SOCI Act.

2023-2030 Australian Cyber Security Strategy (ACS Strategy)

2.72 The ACS Strategy outlines a range of initiatives aligned to six ‘cyber shields’ that will help Australia become a world leader in cyber security by 2030, with the intention of working with industry to reinforce the shields and build cyber resilience. It can be reasonably expected that emerging regulation, policies, frameworks and amendments will need to be reflected in any current and future SSAs. 

Privacy Act 1988 (Privacy Act)

2.73 Head agreements for the SSAs contain specific provisions related to the Privacy Act, requiring SSA sellers to ensure compliance. 
 

Secondary benefits

3.22 The review identified a range of other benefits of the single seller arrangements (SSAs) as secondary benefits. While these benefits are more difficult to quantify, they are important when assessing the overall value and relevance of the SSA model.

Enhancing growth of the Australian technology sector 

3.23 The review acknowledges the substantial contribution the SSA sellers make to Australia by employing a local workforce, establishing partnering arrangements with Australian companies and sponsoring a range of initiatives to foster innovation. 

3.24 Further, the review obtained a range of examples outlining the economic contributions the SSA sellers have made to Australia, including:

• The SSA sellers employ over 10,000 Australians. See Appendix A: Overview of SSA sellers for more information.
• Direct investment by the SSAs in Australia, including: Microsoft’s data centres established in Canberra, Melbourne and Sydney, the AWS data centres established in Sydney and Melbourne, and the IBM Technology Park data centre in Ballarat, Victoria, operated since 1995, and the Oracle Data Centres in Sydney and Melbourne and Oracle Cloud in Canberra.
• Supporting the growth of Australian companies through partner networks, with AWS, IBM and Microsoft estimating 6,000 companies, 1,400 companies and 9,000 companies in their respective Australian partner networks. See Appendix A: Overview of SSA sellers for more information.

Primary benefits

3.1 Stakeholders reported seeing benefits from the single seller arrangements (SSAs), particularly through:

• Greater discounts reducing purchasing costs, including price stability and predictability, for all buyers regardless of size or respective buying power.
• Improved efficiency in contracting through pre-negotiated arrangements, led by the Digital Transformation Agency (DTA), lowering overheads and reducing contracting costs for consuming agencies.
• Consistent and aligned terms and conditions that are pre-negotiated, improving contract compliance and risk management and often result in more favourable outcomes for buyers.

3.2 These elements all contribute to improved value for money, as consistently recognised by all stakeholder groups, and are further detailed below.

Greater discounts - reduction in purchasing costs 

3.3 The SSAs aggregate demand across government, enabling the Commonwealth to negotiate better prices for some technologies. 

3.4 Although the specific value of these discounts for each of the SSA sellers is commercially sensitive (some sellers require the signing of Non-Disclosure Agreements and Deed Polls which place limits on the Commonwealth discussing or publishing key aspects of the deals e.g. discounts made available), analysis conducted with the DTA indicated the total value of these discounts was at least $1.6 billion to the Commonwealth over the period from July 2019 to June 2024. (For the avoidance of doubt, this is not a “saving” as per Finance nomenclature, rather it is a cost avoidance. This amount is a conservative estimate based on the available information reported to DTA. The methodology to calculate this for each SSA varied depending on the nature of the contractual arrangement. No discount value was included where amounts could not be reasonably substantiated, and lesser values were utilised wherever there was ambiguity in the discount amount which would have been realised under the contract.)

3.5 While the biggest buyers within the Commonwealth (e.g. Defence, Services Australia) often have sufficient buying power to negotiate suitable contracts, smaller buyers lack the same leverage. Without the SSAs, the review heard these smaller buyers would face significant potential implications, particularly in securing discounts and negotiating terms and conditions consistent with the Australian Government’s policy positions. Without the collective buying power of the SSAs, these agencies are likely to face reduced leverage in procurement negotiations, resulting in higher costs for technology products and services. 

3.6 Supporting the perspective that the SSAs reduce purchasing costs, 88% of survey respondents strongly agreed that discounts are a key monetary benefit of the SSAs. (Refer to Appendix D: Survey results.)

Improved efficiency in contracting

3.7 Buyers positively view the ability to leverage pre-negotiated arrangements, which reduces their spending on arrangement design, negotiation and management of large, complex head agreements. Commonly avoided costs include significant legal fees, administrative and procurement resource costs, and those costs associated with executive input and oversight. Survey respondents also identified lower procurement overheads (61% of respondents) and reduced contract management costs (59% of respondents) as benefits of the SSAs. Further details on the costs saved can be found the Costs section within this report.

3.8 This sentiment epitomises why the SSAs improve contracting efficiency. Smaller agencies benefit because they lack the capacity and resources to navigate complex technology contract negotiations. Of those surveyed, 80% identified simplified / streamlined procurement as a key benefit.